<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="29012">
<package pkgid="60962e5dcc6e7edf4187dd5aa8db97fb070d97c9dd6ee10f21b8ea7b782fe8eb" name="389-ds" arch="aarch64">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="66f2e0ae0978ab9aff04ccfe89c0b39c86aad2af874924f14718fe0fd5462361" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="871f069ce9d19a7ef549fdd663dd251e1cb0894ca7dd8556c166e89241c0a986" name="389-ds" arch="s390x">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="d9b216d9738b662d40cec6f4636c4e59ac9aa6dabba2563bdf4102972c82a2b9" name="389-ds" arch="src">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="c09300a02834293cbb314212a5128ddccf9710e6473ce849f4b50834c72ce1ca" name="389-ds" arch="x86_64">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="39e5514280088eb6c48ffcae2febcb4917aba329f553b5d0220274af07e1372f" name="389-ds" arch="aarch64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="65c3bc78714ee0c888f8c0b4474d88219ca0f91d221f98831a107d06c37288eb" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="d84a0d44a29c35a8f7760202400199574529d2005fb6d79fd0254558a0bd4582" name="389-ds" arch="s390x">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="8ddaf45babed9b1081a6add1208ef4e266e6c5b14a313f56bcfa56a92e216a00" name="389-ds" arch="src">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="212a4be3d5235966b00b7c4a1c79adf64214bf38f8d898900604ce473d34903d" name="389-ds" arch="x86_64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="0368f349fe8e816b17ff6acc7b23d1dc1005654a7b30d0e1d70c8df8b381a614" name="389-ds" arch="aarch64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="74ab063994a334c92a80c7a9dfbfcc56824a20e07324e72a6a8749b27186ab35" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="10d9e56cef39561bc571393719dcc20e00dff6816ac281ddaccbf6450813fc90" name="389-ds" arch="s390x">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="438c7f3afee143fced09d054c2e05319ea90dd682d6bb3b3881fd20180eb4784" name="389-ds" arch="src">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="7b8236668af17a24a911b74a12789bacc4ddf32b8fb2abeb481759ef0a4505f9" name="389-ds" arch="x86_64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="02edeef35ba74870cf5b27ab23ade7c77cd665384cc833a2c86ee65ca00fdf80" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="4cd6c8fe39bf555285b636db615a5decddcb9b8a17b5f5c5047fe498b88a523e" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="581799be927b825ba2119629b89dcfe20f162e2f8415e6a5bc53f69d2fa573c4" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="42c83ba1bf562eedc13c641784480405cca2ee42f71c4520d4976bb8b02871f5" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="8776fdf4c890bd192f40d1853db3dc2fb3a4520dff8c5d534b40948e4e76e92b" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="1dd16a6b3e2a1223f6b63936d8b93fa15b9ed04daeff18eb4061d58f292f945d" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="33499cf7788d41d903c025c63295ccc71ef4ed6119977ba01d956cecfe488bc2" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="5b09439c26d50c365715b2c9ba7ba2265b53d0cfcb904742739f9f0fb44ee448" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="b036e38d8fef144bfc9d31f87f9e334e100dd3d57cded5c344140857d68dc697" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="7f9d66e0388c5523d9c9a9ad6b94b73d5e2265da179c9fd3182b1f4d1ba3be77" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="f2fae075c0d6670eca4273f298d64da145f872b3204c85884bb3c76312f21b44" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="fadd3fca1038747162f001095b1935d6c0eba834f39248e540f8e99f86d221d0" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="738d3c85a90cb15ec1b88913f03ee8877728899b53f48077e569f0cd867009b0" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="284b59baeb1c751221559f019f181dc8957072c3483ad96d70dc53e438db349b" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="63ce914683da1dcc7205587e0743a629899faf1b1629527ff836792845548ad6" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="8b37581104a94c01f6948c9c9b155054b07b81589d21f1803378b555a167ae1f" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="d239408a90ce53f082bbbe21280c375b5158b7e65689b57549490db5d7a1bfd7" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="833db83b48cc0afd6994e59f83b4689a0a3190a6a3776db45bae88361d083884" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="f72998045902fe502325a1d75bdefc6fcc17875aeca31fc11f0422e681d1b51b" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="b56f5c5b32d23ab31e875502304ae0f12f33ebfd179a399a33e14780da73329a" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="dac681f057dd17ebe044ffcd71b89b00d6aae6d0a05f118ec21b430d5717b6f8" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="619a7b637daba6d951bf78ef4010f62afa54b930860f2b647586268854e9a60b" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="afef0c94fc40cacffd96a9d7bacdfe57bd3c36da4b150855dca82fb6d5dc2bfe" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="8a70393192618581a8431af780dff751fa1decc8f9cf8694736b48c64dbe1035" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="8af5d5640ffcfb0a5a25f6a196a4dfba6bfd96e0f0d5a9bd67a9d7862f100cb4" name="AppStream" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="844cd5941c57aa9e02ae80a689b3da3fd819391c325982a875bf259f15b96014" name="AppStream" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="56483be9c92d9a201761067b64a759063ca2cac2795845177210d857d473898f" name="AppStream" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="c87fba4d4ca1908cafabbe82ca97ff47203db4caa75caeb6f47d3b8048b5081c" name="AppStream" arch="src">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="486c59da5a948c8a04f849c9dcfe1a371dc34eb11286f28c8b7cf17976487e89" name="AppStream" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="3ca0f12ec52e3b77d75ff9450e997254ecf12c07591b746b35a6c95a43979338" name="AppStream-compose" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="c74e1f67e22cfbfaad06883c435ae809288a22ea481d88b3e3b48465424c861b" name="AppStream-compose" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="1dab7a5c1d8bf8b358868199ea92bd9a3ef0bd3b9bd7135b8498e0754caafb0c" name="AppStream-compose" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="1eec6c4934925982aac38d300b1928fad8b41ede706d4d60f770848230d9c559" name="AppStream-compose" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="a71e291ba9d88334d227200b82d0f3394ca97649990ca9d1bb12cfaa74505733" name="AppStream-compose-devel" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="7d347b83f06b1d2878f88b0b0421241b2bb39974ba612980340fc605494818bd" name="AppStream-compose-devel" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="b87a854547a763e0627c5a9b7ca9a0f49b5ee6a18ace8485d6b26ae3d06c1f2a" name="AppStream-compose-devel" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="a0ca292998fba1953af0262fb1ce988222b3382bf0d3aeaa49bdf7a7a9bd907b" name="AppStream-compose-devel" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="a3c54ce3fafe5c84d1ac25c132a5775b086d5e193f844036fbe3564ca3388db9" name="AppStream-devel" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="f10d140fbf270939bfec37db2a1ccdfa38e1ca26a84afd97a18e961c84c2b373" name="AppStream-devel" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="ea8fd0f11727d1717a58d8497dba728a033cb3de4d83e03ebd12fc72b0ba4c27" name="AppStream-devel" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="df10814e4d7d96ec7dbf2abdc2e1ed0ea3889f2759f48734562de556735f905d" name="AppStream-devel" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="8716d445b995cf077b200aa9f0248da784d9e243628a26914922e56d327f9708" name="AppStream-doc" arch="noarch">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="7b9d7484c1cb1e4a3923bc6c67bc406ff623ddc7ec4b9f718807221725f14474" name="AppStream-lang" arch="noarch">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="9738e5f190424f915fecc8761c27ecd8a4fbbbd03ab0613698e6fe25c3a9c306" name="AppStream-qt6" arch="src">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="dc9a15c71a90d0666d09766034e3b2fb0ac7ef144ac088f7c2b2b37169eecdd9" name="HANA-Firewall" arch="ppc64le">
  <version epoch="0" ver="2.0.4" rel="150000.3.9.3"/>
  <changelog author="varkoly@suse.com" date="1426161600">- Initial Version of HANA-Firewall</changelog>
  <changelog author="hguo@suse.com" date="1443787200">- Bring HANA-Firewall out of technical preview with feature
  enhancements and major code clean-up.</changelog>
  <changelog author="varkoly@suse.com" date="1444132800">- Fix names in sysconfig file</changelog>
  <changelog author="hguo@suse.com" date="1445428800">- Remove unnecesary defaults from sysconfig.</changelog>
  <changelog author="hguo@suse.com" date="1445601600">- Fully integrate with SUSE firewall.</changelog>
  <changelog author="hguo@suse.com" date="1446724800">- Add missing changelog macro in spec file.</changelog>
  <changelog author="hguo@suse.com" date="1464955200">- Improve prompts in create_new_service.
- Relax file permissions in hana-firewall.d directory.
- Fix result file location for create_new_service.
- fate#320564 fate#320376</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Fix typo and incorrectly assigned default value in sysconfig file.
  Bump version to 1.1.2. (bsc#991919)</changelog>
  <changelog author="hguo@suse.com" date="1470398400">- Add several more TCP ports that are vital to HA operation into
  firewall service definition file.
  Bump version to 1.1.3 (bsc#992376)</changelog>
  <changelog author="hguo@suse.com" date="1475755200">- Merge HANA firewall rules into an existing "customrules" script
  if it is present.
- Bump version to 1.1.4 (bsc#1002744);</changelog>
  <changelog author="hguo@suse.com" date="1508328000">- Upgrade to upstream version 2.0 to work with firewalld in SLES 15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="hguo@suse.com" date="1518436800">- Upgrade to upstream version 2.0.1 to improve visibility of HANA
  related firewall services in firewalld configuration tool.
  (bsc#1080597)</changelog>
  <changelog author="abriel@suse.com" date="1648641600">- Adaption to new go compiler behavior regarding test and build
  (bsc#1197697)</changelog>
  <changelog author="varkoly@suse.com" date="1683028800">- Missing SCR Agent for reading and writing /etc/sysconfig/hana-firewall from yast2
  (bsc#1210981)</changelog>
  <changelog author="varkoly@suse.com" date="1715083200">- HANA-Firewall creates insufficient configuration.
  (bsc#1221231)</changelog>
</package>
<package pkgid="8b53ff293f23bcf3fbb1bed0f5435c971b581b964ee571c4ffbeb7fab48d7f4b" name="HANA-Firewall" arch="src">
  <version epoch="0" ver="2.0.4" rel="150000.3.9.3"/>
  <changelog author="varkoly@suse.com" date="1426161600">- Initial Version of HANA-Firewall</changelog>
  <changelog author="hguo@suse.com" date="1443787200">- Bring HANA-Firewall out of technical preview with feature
  enhancements and major code clean-up.</changelog>
  <changelog author="varkoly@suse.com" date="1444132800">- Fix names in sysconfig file</changelog>
  <changelog author="hguo@suse.com" date="1445428800">- Remove unnecesary defaults from sysconfig.</changelog>
  <changelog author="hguo@suse.com" date="1445601600">- Fully integrate with SUSE firewall.</changelog>
  <changelog author="hguo@suse.com" date="1446724800">- Add missing changelog macro in spec file.</changelog>
  <changelog author="hguo@suse.com" date="1464955200">- Improve prompts in create_new_service.
- Relax file permissions in hana-firewall.d directory.
- Fix result file location for create_new_service.
- fate#320564 fate#320376</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Fix typo and incorrectly assigned default value in sysconfig file.
  Bump version to 1.1.2. (bsc#991919)</changelog>
  <changelog author="hguo@suse.com" date="1470398400">- Add several more TCP ports that are vital to HA operation into
  firewall service definition file.
  Bump version to 1.1.3 (bsc#992376)</changelog>
  <changelog author="hguo@suse.com" date="1475755200">- Merge HANA firewall rules into an existing "customrules" script
  if it is present.
- Bump version to 1.1.4 (bsc#1002744);</changelog>
  <changelog author="hguo@suse.com" date="1508328000">- Upgrade to upstream version 2.0 to work with firewalld in SLES 15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="hguo@suse.com" date="1518436800">- Upgrade to upstream version 2.0.1 to improve visibility of HANA
  related firewall services in firewalld configuration tool.
  (bsc#1080597)</changelog>
  <changelog author="abriel@suse.com" date="1648641600">- Adaption to new go compiler behavior regarding test and build
  (bsc#1197697)</changelog>
  <changelog author="varkoly@suse.com" date="1683028800">- Missing SCR Agent for reading and writing /etc/sysconfig/hana-firewall from yast2
  (bsc#1210981)</changelog>
  <changelog author="varkoly@suse.com" date="1715083200">- HANA-Firewall creates insufficient configuration.
  (bsc#1221231)</changelog>
</package>
<package pkgid="58763b5397666c5ab986d7c13f57f971e2129d71c08c52ac07580b9e1cc57088" name="HANA-Firewall" arch="x86_64">
  <version epoch="0" ver="2.0.4" rel="150000.3.9.3"/>
  <changelog author="varkoly@suse.com" date="1426161600">- Initial Version of HANA-Firewall</changelog>
  <changelog author="hguo@suse.com" date="1443787200">- Bring HANA-Firewall out of technical preview with feature
  enhancements and major code clean-up.</changelog>
  <changelog author="varkoly@suse.com" date="1444132800">- Fix names in sysconfig file</changelog>
  <changelog author="hguo@suse.com" date="1445428800">- Remove unnecesary defaults from sysconfig.</changelog>
  <changelog author="hguo@suse.com" date="1445601600">- Fully integrate with SUSE firewall.</changelog>
  <changelog author="hguo@suse.com" date="1446724800">- Add missing changelog macro in spec file.</changelog>
  <changelog author="hguo@suse.com" date="1464955200">- Improve prompts in create_new_service.
- Relax file permissions in hana-firewall.d directory.
- Fix result file location for create_new_service.
- fate#320564 fate#320376</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Fix typo and incorrectly assigned default value in sysconfig file.
  Bump version to 1.1.2. (bsc#991919)</changelog>
  <changelog author="hguo@suse.com" date="1470398400">- Add several more TCP ports that are vital to HA operation into
  firewall service definition file.
  Bump version to 1.1.3 (bsc#992376)</changelog>
  <changelog author="hguo@suse.com" date="1475755200">- Merge HANA firewall rules into an existing "customrules" script
  if it is present.
- Bump version to 1.1.4 (bsc#1002744);</changelog>
  <changelog author="hguo@suse.com" date="1508328000">- Upgrade to upstream version 2.0 to work with firewalld in SLES 15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="hguo@suse.com" date="1518436800">- Upgrade to upstream version 2.0.1 to improve visibility of HANA
  related firewall services in firewalld configuration tool.
  (bsc#1080597)</changelog>
  <changelog author="abriel@suse.com" date="1648641600">- Adaption to new go compiler behavior regarding test and build
  (bsc#1197697)</changelog>
  <changelog author="varkoly@suse.com" date="1683028800">- Missing SCR Agent for reading and writing /etc/sysconfig/hana-firewall from yast2
  (bsc#1210981)</changelog>
  <changelog author="varkoly@suse.com" date="1715083200">- HANA-Firewall creates insufficient configuration.
  (bsc#1221231)</changelog>
</package>
<package pkgid="538ccb523dc43f1e00a50b18f6fa9288a644e037410775107ccb820c2b782899" name="Mesa" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4ff8ce9044b5a375a23a252186165fcb5fe198e71b9c7c755acadfa20c55b65a" name="Mesa" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="f975b24613315011daff881124f7731801fbfa2b4f95b43fabe819e8115aa21c" name="Mesa" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a705e70e3c533c4ebbb87fa76c7c34c5d3b54bef1dfcd69517cad8de1ba05016" name="Mesa" arch="src">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="59534e8eec4e576130ecdd1677fc8d275ac00fc4d0c8a55546aba2bafff3f2cd" name="Mesa" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="d22fbb0f09abcc011c4275b2443dc8e7b4f8e0ad33b176c34fcbe87f43a31eab" name="Mesa-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="18eedf6fbaf0283aff1ffd25f1b8fe408ea768ad5afad1450662d1e336590da7" name="Mesa-KHR-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="2a24e2b784af480f15e4f326fafa0878040c65d3985a6e7eb7916f35ba2f8726" name="Mesa-KHR-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="2c28dcc2e2112857d9094e53a938ccb30cd8394b0947205e75fabcfcb8ffb2c3" name="Mesa-KHR-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a15b75d61f3d0cc156a4300d172288c3f1d762e84934e8841255a0bc8e2f01fe" name="Mesa-KHR-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="80065c08f49029a4e0b8993deedba375f419a5841049b661dc246ce6937b41a9" name="Mesa-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="e4df26cb2d1a961e29142c69cff86d6173db9c6fd40dfb70ec00990969f2601e" name="Mesa-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="05d630c1b19786df3dfe80bb16385f83e800d0584a6e34e43a2f382f515fb154" name="Mesa-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="5beb4fa7791cd75ff48e932d607b4a3d83e31a715ffc2506c9eb24d27458cb87" name="Mesa-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="3450623cb40065a95edf7a65168fee2a9e9d0e73a2d762ea1a1f0fbe44ac3df3" name="Mesa-dri" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="b85c3a5c8494198c7074dd095190519823b4faf963a0093fa2304b192290888a" name="Mesa-dri" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="edc89c978bda4f7158680b245003621a9b71353e062cda63420031abf11c9957" name="Mesa-dri" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="3e09091ccb69b9be1c8f7af5cf162d809f8b23ddaf5ed9b79ccbd5b780b84493" name="Mesa-dri" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="932e0835005cb2c8fecda3c1036e0134e5d354896f4ff750bd677ba7b83e067e" name="Mesa-dri-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="64d4475f6d056ff2827fa4f191d9d7fe62859fb4ed5b1a9050d341ab159f1114" name="Mesa-dri-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="fca088335b7c01ce8455930e2b94784f5c0147faae8c42317e4678699f7fd796" name="Mesa-dri-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a7fc42fd38eb990b86841f735d964c03d03f2f3226f2bb036d870d976105fafd" name="Mesa-dri-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="daa3fd3f57de23c48cda460c51696aedb2527a22b68d6717feecce75f672b311" name="Mesa-dri-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="e9145d09855903d979f6030baa3873ad42dbcfe57a1f55b288d8b15319c22ade" name="Mesa-dri-nouveau" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="64351c63a47b2a09d0cf4ee91edaf72da6d0521ddbbd9b3e7631a319ee247573" name="Mesa-dri-nouveau" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="9866a0ac7173e32ae06e42d3344b5d440a4241b0441f3c90ce15638018310346" name="Mesa-dri-nouveau" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="d60c22fd7ebbf41bf19a7a3007b2aa5d7779b4677f0916ef36abc332b4b22ce2" name="Mesa-dri-nouveau-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="637dd4a730f9f447f70df22f3290e0ffab7f48e9cb83a85504f9d58a6ddc092b" name="Mesa-dri-vc4" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4cbb5f7aa8697f5624993d26192dc724a1d148ad34fca3128ee8d5ed07adae4d" name="Mesa-drivers" arch="src">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="c33245cbe7c4878a294857de3f71d66780f19eadc9eb71813afc469101a90545" name="Mesa-gallium" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="d4dc999f06c78163d82722cf91702451d72619714065cff5d1357b3fcff1a9a8" name="Mesa-gallium" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="209d876d9db8a0c8114943f4e9b46cee8193f0726d04701733b9c682345e4b6d" name="Mesa-gallium" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="fcfa46cf55b2d9abdfdcf57fb35f885def9fff7b02768c6d01bc5d505c1d6b14" name="Mesa-gallium-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="921d565bda22dbfb5c2fd4741c140833a3dc43f7c9ded54c02dca6a5bc86e9da" name="Mesa-libEGL-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="ab0b12d1347c74f3d41eda45b0920b0d5eb7c4d1e5f57c9751bfc9adc93df2df" name="Mesa-libEGL-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="350c559e5801d8663d03bd55cac46f8404470531970b54ab2f38c4440de588b7" name="Mesa-libEGL-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4953bf6cff208cb8f7212e09c27638bd3ff1fb6f7f682120a51d5d3878d43ef1" name="Mesa-libEGL-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="910d6e4e2abbc15fb5636522ddf363ac0a39ad7586276a4f6673fa8e591c294e" name="Mesa-libEGL-devel-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4edd97e2e145ed6250c5e49370f1e463ada074e19847be3b4fc9b455f22b83c9" name="Mesa-libEGL1" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="d1b204f505c749937363d910512a28d8a31675d42214dee2027e0b991853e95e" name="Mesa-libEGL1" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="f967a9c59ab6a89a72187b0862c15beb02f81cfa120970ea54afc94cc3703c94" name="Mesa-libEGL1" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="0862cfb043700377ce1e8b7b73a5ce807daecc634d25f25c5c88e03bcd4196d7" name="Mesa-libEGL1" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="874585c0474aeb6faadb57cd4d77d3f582e6f5ffae7105311ad25bcb9d5f6a6d" name="Mesa-libEGL1-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="bc3c6373e6a407df04f2ca98430cc36be2bff77ba0eb870ded0c94712f15c311" name="Mesa-libGL-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="08ff55330b3f84fc9dc6ffbab185dac38acaf48025bffc327d9999aa2bdba902" name="Mesa-libGL-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="69ca303d8431dcc227fcb8dde0dcc0cd515a435289b2525eb7da1213936c9d6a" name="Mesa-libGL-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a57a3ad5d1093f0af760f382d51d0fc0eec976d40ca9c572633c312343261484" name="Mesa-libGL-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4ca0652030034dbc6e0b37447df1b0e9589237551951518abbcd8eeb187815a3" name="Mesa-libGL-devel-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="73d0a357d8d410ebb3b929d1b1a23fc63f880612705506076fe1cc3a372b7efe" name="Mesa-libGL1" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="bd8011f44e743013c881494346e0aae7f43ae044e2c7008af2c37ce8b5e54974" name="Mesa-libGL1" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="50fae9c380bdb59badba7effab955db12589ce1011e35dbf9932e9e643992ff8" name="Mesa-libGL1" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="d58cd2073611a17f8011e0854901353dd1f0d397d44f44b2ea296e3d3ff2fdb5" name="Mesa-libGL1" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="e41d4a8f8fa1fea9cdc7b1c79d120a20f63aab2412746b2759f1a06765e1244f" name="Mesa-libGL1-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="107895580ce9ee4e293eed7b8d3150550f432eb1ba017628f731e3142c5b64e1" name="Mesa-libGLESv1_CM-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="f7420fdd9d2fcb2ac17beac8ead7ee4c04ba1d5e101803db28eb41e67bef094f" name="Mesa-libGLESv1_CM-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="f968f61f8c027a95f21c823609fe20bc56cb1a57ab265ade34a01204e5f85f99" name="Mesa-libGLESv1_CM-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="80d9f2abe4d30e97ad306894f113160e09bb713d487cc68033e39a6059475b08" name="Mesa-libGLESv1_CM-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a0a1b5cc82b1e66a92e1a87b09e207b96ce4f76ab874dea653de4736b722f61f" name="Mesa-libGLESv1_CM-devel-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4736d53d75239109d7b06a9ca874f2d50b57f3ba37b32bdcdabd9f0895afdca0" name="Mesa-libGLESv2-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="33b47411c40751a89f50f6247d348b276455dc01236a33c5118098ec52c09895" name="Mesa-libGLESv2-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="90d00e2bce3d804a9ec8a875e40553a7b4be35b94ca429d25dea604f39b2ca6f" name="Mesa-libGLESv2-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="9e55767c1f68ba0ee5d7f87fe5b0cbb971432e54c77ed896bdbeed31c099c8ad" name="Mesa-libGLESv2-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="59b7fc5411c4eecd247a05e155bf66dbf9ab5884ef26c045df650beae7280ded" name="Mesa-libGLESv2-devel-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="ecb8d1de3d80bb1b2727948e722bcedd9b014c4038731d7e749955f74f629463" name="Mesa-libGLESv3-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="b8d1901dc680a18c04107825a1312ad8dc34c1bbf1efebd4b15321321af9df5a" name="Mesa-libGLESv3-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="b1833c3fb290c8fc44b91af055904ef96bf7078ac371de06f15c5a09c35d86fc" name="Mesa-libGLESv3-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="3937ae7d4f3418f05e49c3d5089391830e06e8fd09d14e3788aa8ef671d1b19a" name="Mesa-libGLESv3-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a6eed22ec86822022557cb37d1fe80a22fe1feeaf705d16f67065f80e6a6a3b2" name="Mesa-libOpenCL" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="0e2fa094dcfa7f77eb2979c55f43f7b2be19de79c078a2d7349eb673eb3f495d" name="Mesa-libOpenCL" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="0d990d92ed0399b4e8d2057ee94afe67d31a254c53e5a10feba41d0f21baa49d" name="Mesa-libOpenCL" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="789b3bfd73e1fd6f2fcb989d915628bd317567b99076fbbf16bc72e439032e2f" name="Mesa-libd3d" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a474302381e089e6c81b574134bc3c827a72dd9f3a97a2c5c1fb4cb9bf73d9ba" name="Mesa-libd3d-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="770b9bfc1ac3a684e8ac716e82077dd470f1404de55afc295e97081802bea2e8" name="Mesa-libd3d-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="c2fe226416f736323d4296a6323d65f1dae989c7defb6a4e1a2d2d0182f528da" name="Mesa-libd3d-devel-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4bba8a1a319a7fa2088dde55ff8b6991dcf83ffc32e58bda799bd69f4427f334" name="Mesa-libglapi-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="812c5cb275bf9eec7c0a824c00b45be6ca322a75d4e2effb4709b32411d0b9cd" name="Mesa-libglapi-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="cee1147049f8e8dd4122bcde873e673101d17e62c7f586068f6a4ec46bd775c5" name="Mesa-libglapi-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="fde8f547c81251dab9290a95d0efe3a87501c7474bf4bd0516ad93fd3e42128e" name="Mesa-libglapi-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="042a63728e7518603f9436a4e069894347a742117f02684c3618c77b34160bce" name="Mesa-libglapi-devel-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="457a2fbb0f603d08dd63a76419b597617cb719acab52c6ee6c9b4fe61e707b23" name="Mesa-libglapi0" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="2f39f1082f76be8fbaa1dc90879e3525360dbe2cb2c825c8ef70ecf8060686d1" name="Mesa-libglapi0" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4ec5ec4d9d82e43cd79a8cd8fb2e83734354623a4bba31b627f010d022f5822b" name="Mesa-libglapi0" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="f3abdd24e1472df470dddc6791960cb6467b09e3f7bdfd623eaa37a425a1e5a3" name="Mesa-libglapi0" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="ffc3232b737dda46df0f434a1b01bb6838d6a40a517997ea77d48ee2e2fa8ca0" name="Mesa-libglapi0-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="b5791b2f562817a56544b95cfd7b6a651c3e1f85eec5b68ccdf61ce38fbbb4cb" name="Mesa-libva" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="139ffcf4c74ac6fe9e356fa40c651f2f806db1fd0fb9fe496a7d91bb458bb726" name="Mesa-libva" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="095203942b691f1697169703a0dc72d5d8d3326bc873bcc714f275f488a3fab3" name="Mesa-libva" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4bd435faaa0acce4c71bb844f6abca64cd5a5091e80d17536340bf299c69c790" name="Mesa-vulkan-device-select" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="da317ed1bc412c7b4333be008bddbf22975e37cca3eb812d01502f68768d1289" name="Mesa-vulkan-device-select" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="6bf2c90cad60b264d9ae05459e5c35eebef5650305133e081051034028d1091b" name="Mesa-vulkan-device-select-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a71496886b894a9b1e8d9dee09e794cdf4d2588898a86b5658dabd28e1e3ea01" name="Mesa-vulkan-overlay" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="76d07c740d2189ddcb89124e156c7ebd5c19386c264610f143e6e745192d7ab4" name="Mesa-vulkan-overlay" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="ac0da2ac9473336d6d9bd3eb99157d9458dbc05c28100b288fb2cc721c096750" name="Mesa-vulkan-overlay-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="1a426f997cc0168ecb250364fa6604b47bcd0564f029c7a96afae394fe72025d" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="10c3b0c8f2f597d6580a54a4adda9bf9ac011410a30476be5929ab8d4453cdc4" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="139d13b84200eaf590a3950ad9c9edb2f585822b6b582f183465546e1820c4c6" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="f76af917fc4c70f5236b36bf156fb77aa60f71407d84ceb877cd21fc0029dc13" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="0647d6b6c26df1d92782e8063ff2efc261af7cb22923d6c7a0a57b709df0ef22" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="0a867cc6fe29af059fd9a019b0a45371226898ca55f7db97d1da4f8d968b4e89" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="775cb5b1262e75054931916e6c500ed37ec763927d3d7637671926564d507974" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="f85ff2fa61a348b098d2004d3253d2df409eef5a0e8d6d9a9cbc49d965ecfee2" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="353ad28e5e90b2dc2ad00684508d64ca2c4dcdffce3c8c9e67b47162aaa9086b" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="aeb0d4d06e328123cfd8d5c218b0791b702393a6abf48b00012cef6b28ef4813" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="7a49daa1e8fc9d658bec6d6007882493f2f84c07ebb9e32e93e49bc17b8c151d" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="7904db243329c0a7ea97887bee3327a4b510187178090eedd78fa95b60ed8a77" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="59201665bcd24dbfa2976f389a070d12990a08e28b25b5f0d326dfe77afd712c" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="a481807ad7984249b399fe269ce6c8e8f74323e0e207cf4339d2c0cacd237888" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="8e01671d967da6c5aa852661ea3b262cc93106425d57477f6d0628cac2805051" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="6aed81613cc268499cfaa2d8eafcf38ce7ede2a30e05ab77be66ef6e6147e8cf" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="edb08833d6b7b3172078b06355e41fcba406482d0ce450669607c98f8a1f08a8" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="ff9576e06fcd06c95ac3eb9c5e9cd8768fc34b6cd57680822026f0d4608170f7" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="8720ee6b012231234a75572ba4d8bc30587fd05b0a070f0b76a78362bcff21db" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="82aa1f2c54e9894493af5c519b9531431f9627c6c20e62dee64b5e3064a792c7" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="b85e361467cadcf523f8951d6f7a2e6e7f306a6c7c939dd46f8c3fb3042fdfe6" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="83f3a7723396ac9a3a1d3408ae8747308db739af93fb87a480b720f043200db4" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="8f9386806342bf0dae48780ad612b72c336ca6eb2f53f9492da6b55400e88d78" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="e8bf775558315696bef3a10d4f3b7ec7a0ab1850dad741ad6d898cc70d1ed2e9" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="da59f9ee39a57e3c5285e6e2d9359adc9e1b023672e15810ac1e41372cd8cdf0" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="3cb4419cb681dea6227d89229d0d9f27b962b521c0ce8eab21f40682fb62a37a" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="c06b0bd51eacb622d196ef369f134bb8932ef50e8081e2babb73b9e7f3bb7c66" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="260a6f210b5c4ee33f04d14f76f43ab0491a2b04f3ae327edd281cbf3899b116" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="b4fdba3e5ac14cbbaa84065c49998c6fb4fca2112c3d1c822d8b1add032e907b" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="76b5d8578d2785318c31cba6204c28323590e31e41be84513eaaec31b188697c" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="1987219eaa9398db524e2524cc97d528c172c6b44d3cf2a2667aa0238a8ab0ee" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="68470f9f9f851ed1b996496f5095190f96577bbe0d1e1d620250458cf2570612" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="9468e08a1ab795fe76ff9afbbdcf35d061a6369a87df74f0fa66b1546f3f5312" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="909f531a11ba8ef960dbbc09c17162377d474c80430d89f4f681f62d201887bf" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="98f328c0839f662a46b889a311faadf7676ba40a6c0910d3f3359cc6067256f4" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="cc3fb2a401b3358bb2afc18edce736275c71933087eed77d3427c1338e316e8b" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="eb2f0bcf20acc560fef6197d849f3e28ade4d454f192d67420d5364190e3fa78" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="de6ed7fb46c1238e0e65cde8c3c86a2671a65c582af6cf3ac537138ad1c67e8e" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="068fc831029c6bf98c6796d621c92334080a95ed6da2b415161887183d69c05d" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="110a817fcce86028000c96e5e5e3764a9097c73cbc085d86efbc019904f1a41d" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="e25a71e060f8c0eff2dc8f55deacc1ac3fc02fa238e0ebd4357f484846a57e2d" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="f7d1493e9ea9b204541e47a8ac34c0e7a98696a0f3fe9135b15833ee7cb353cc" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="f45c24323d6dd794334fe7a2227c4f6c0143016990045477bf3b827b9158a9e2" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="bc647fa08b0f842c6d050478b86ba40e49cba36928472fe705f10fafc9bacd05" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="7786a908edb9e3efbc6cf8765fc86346ee0420e91757ae06b41782b15dd0e5a5" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="7fc115fff90d6fb3af395e9d7d60ad3a4f88d27f0da2cb7f59d9283dff1dac1a" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="97beed1d29098dd55b12f86be1fd9510e786528262ccfaa8a976e15a880053a5" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="7ec5f584e7660658a68422ecec882a26fe55185170c88afe59d533db6a460e78" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="72201647be6506e5f93137dbe62aa15d5da9cd9d494c98995d9113fc9c20f42f" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="01d27ac6b25c1558562856f550439714a025afedaa1f7cc4c332a1003cb2a317" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="7850cce9851c3e620a59b5bd98e07c9d9c72d578f8f1d04f2390ba119619ebf2" name="MozillaFirefox-branding-SLE" arch="aarch64">
  <version epoch="0" ver="128" rel="150200.9.16.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="357aa9cddffc634e7d8fbb8b8967a59ce99a1ca37c5340d5ae8889596f7ba1af" name="MozillaFirefox-branding-SLE" arch="ppc64le">
  <version epoch="0" ver="128" rel="150200.9.16.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="87d8d88ed77f8ef5dcb6da7eba6b0b329a33888cb2c3caa25b330f3baa266952" name="MozillaFirefox-branding-SLE" arch="s390x">
  <version epoch="0" ver="128" rel="150200.9.16.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="0eee3027f7c24e8d8e6201a62a3822a9df250762146b49f6aca5b42c2e4a1e38" name="MozillaFirefox-branding-SLE" arch="src">
  <version epoch="0" ver="128" rel="150200.9.16.1"/>
  <changelog author="pcerny@suse.com" date="1402660800">- marked as compatible with Firefox 31</changelog>
  <changelog author="pcerny@suse.com" date="1406808000">- disable call home features</changelog>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="4719486ccda5367e999312d9a7577ce329e86d892a296d134f5013072b0c6f66" name="MozillaFirefox-branding-SLE" arch="x86_64">
  <version epoch="0" ver="128" rel="150200.9.16.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="33ea4eb4ab51cc90961ae963eecaa892187ec3eb943cbba95496a29cb3eb8194" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="611d3b156fa58af24da069e971d39665eb79babaae1c3b4e0370817f46f85946" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="91a543f88528f1d35ce378cdc6ce8d23d92958dced46de37bfe9a9c20898a3e7" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="7d54e5f452aad714cff64be8a5b8b7582877467dea14909f1a19a4a11baaeb8a" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="ac98abf438179cc49f7ddb43e9d817bc024f2697b3d8a9355cfdbbea2a6311d0" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="c7735404599a515eb10598b5620230e3d3e02bbd1b2afd3e30d1455705d26984" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="64fbb23b27dd8742e673b32e58d0a57cc6937b2f3efdd9ec94fcf0cc522c2ab1" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="99c67e8d4e5e38b75659a393cf7db1c93bb8332def0b0da48ddb3bbcaee65e42" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="112e86ea6f2d7229f69cc0c044aed8b6565ee2ba64e110b4bf9fc4e355e2b3e5" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="5b298fe1e5133b6142903f1dc5aba903673a41fbb08425cc11631116a89946b4" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="36a2cc8eebfa76daf0711920182b825804b6f79a1353c3c396df585680aab6d8" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="14bb8185439331742af0f8d50fc55c7fac357f5fe8b3a1ea5d57a50e98701237" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="81e4f27f457283202b4686d78b0fa8e3c5e6dfc7adb6204982884cc9db5430f4" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="9480a328dd7fb1c2d3762dcc2fa64843062020206bb578a1c457bd481ff4246d" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="e01b0ecd7aaa609c597dda7ff899d7d34196b68b4f5f69018fdac10f93ac3c08" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="a3e043585684ac6160ca22bde40d162b79510bdc0a1324554b8c012e78bd25fd" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="cc690b7af5446ff6e1f1b15281c17dac2a0f88fb8bbf2286321c74b2c720aa92" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="b4823e6fe75c49ac70dcbef73e53324071ea57f0b5e9de2e36edc0579dc05e24" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="a9b8ca7ebc0bea744a0915b0f2d30ba8b79d9e109113c889f2d230381a2a015e" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="91a24494421318cbef9d2b5edc7f54fa4bde259a53b27c161ce1b0d4ced9cfd2" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="4378559cd9c7cd7efe7f1520017c07d77a8f5f11792ce53123698f0b73121701" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="9cf78971cfb6b5d404deb5da57defbff4f9a8724ba8c52a912e18181963e8d04" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="22615b53553f55077373cc9200d4164a0be73cca0b484f00a2976047b27c27c8" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="03da73bf3b56935629e019eb45d4059da27aaba56b4cb2b77fc677be76805a82" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="0d0d206e6d3e4fdd7dbeca84f1371e42d9d0a49c68afc00c1b88972a944ca298" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="5658c893883af8363b58d5478bb41c31bc1763b271d3dec349de9712e4c7720c" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="a820ec74a48957fcfda79827fff135ec2b3ba36859bd56c581cd4e2bc0550ac6" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="c445ab575b8e36665124fb64812ed11aacf6953c998456ab3aa3d346dc78fdc2" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="93018e4be194c2e6490ec243781f72bbab6adf1e0dbcb4d64021003b9a00cc18" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="7eaffde8287c830f417316051656d5a311b33273801f4be28048ee67967ba4f6" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="498e74705ad42d349c91b58dd6def13ac3026a54858c8a44765528e4b48cd184" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="a91eb6707ed4742c65f8c201be675a57c8db4e76db17e7d67c4589f3ad960db3" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="0de56cf849837f3bf8b0b0db36eccf9640bc3aa6e784e9508d150c9900cc22f4" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="2a74f1f9b19644e00b9d8ceed059b4a06a2e6de4f5e664c9546c31920d69ab03" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="9ac9eda6524d03a5370ae74b76b0480f5185ad9c2680ad144afec9a38c6fe046" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="11d9a007efd4c28eccb82bb50e1f76e006356c4f4d20a3dbd6f939d1d79f7d79" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="e171a275ac78264665b4c8e16f1436976c882f18a5f6ba1b42cb0dc8de01834f" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="43f23449c998050bc6e4027371793ce98041855802db1a0088ecc95fe2b96f3f" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="6aa98a07d3e0aa52f737c2ffac1f1fd800025b88e989357e6e6bf4a2a72395f5" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="643549872eb73d105747d488189c7aeed649d3a12e5109c81c494a85a1daf0cd" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="2df986d3c29663c63bd844266742980a304098879109557029c5babd872af10e" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="e5cdf8e54a7b6a05049f8ee16fe02fa1c9e89779fa1a3b19ef77b70c465f0282" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="23500b50d732c37447e3b25de15fb7220ddae1d0d972cffebcd58928912ef19a" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="56b342e7749fc9690b0ce8c09ecab820df20587d3fe67ac3fd1d77baff945c75" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="990dc4861f6d59cddd454069399bc313b20574639ad22e80e6452bde481dd87a" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="1b6c20da66df1297a939f22c745a14f1ec16ccaee099dc8e7ff7b6aee2774d97" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="c97ea79717d56c307ddd947ded2a75ca7e648cf21d175429782f64e4b09de286" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="39764cb75416421ed9cd0d05632bb4ee3b9d49ac941d3a9af1735b6d2d87c6ff" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="2d66b1fe6e1e0c24d216c53a9a8ea44eca5a34d54e5337c91b43be0609138f15" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="5ba196d9ba33a252c610bc3166aaaca681c7da48b6524d2eb1117ab8d7da6caa" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="b619db515a9f17f66bf0c897a81b3ccd1c3f19f03254f7f8ee754a53c2251b32" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="72e8de1214271dd63914b16455ab6e8fc8a6eee7b449ec230a077114e5ad023c" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="38c9b6cec1929bfa81e25b6d12eeaa6405027a5b92ea1f392a40f4762f7a59c7" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="4c7daf43b9dd430d737a5c2564e8c985a72dfb4c5564f57d40a9f21888768b0a" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="0b4abb2816b124373052d1d6b8370136f6ae87e194162da8bce34c01b136a5aa" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="625fe220d319a75461d51aaf1ccb606910ebc642301ee863a613b8b6929d52f8" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="d239168a9ba82d08e37d384e2937a5f3efd7d4de49301d4d8c3cd493988b1185" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="b6b3147537ff9bac7ad826e834a5f8e88e832d056798e04878329d4adde0168c" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="7be8cfedb8b1891ed42e6e9edc80c94982c0fa3db960939974082b24cfd516fc" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="343103d1ce481d13ada5a84673df6c3e154a1f1fea776f97cdfaa6605a09cae1" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="268f2255b7c2e395e1b25ecbe5bdab4172fb8c3ae1f58caf32db467ad4669e12" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="a221018753aef499f70b3f37547d23bd2e46236038685cd9fc42f5d9640bc23c" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="9710540ae59d3159ac72b55a0a73529b0c2b5bc6cb0b64e171ec2eeb796a24f4" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="40e76ecd4d8bc783882587acd620fc87b7ecc2bd93539035e8836bf6b8d15585" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="bd46767b26ebc0f6dc9275acd67dc3aeedebbf011ecff08d0635a145ccf3a533" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="a5636e2df779e66cdcf6b4d4c925667bc44eed34474c5ce407875627734eea4a" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="d45174be044d84824d20415c773ed8eb06d39c4510b0f9bc6850d1504ffebaeb" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="c1b479cfe8898cf5b0e5cf91df10548ff94f422ec363af1f2adbbf5a833ab969" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="490998741c59b4fedf737d778a9ee316ef61907bd58f8d3e9d7c4846c3f0dcbb" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="49699b1877940916c9b22eeb1f22dd4eadb7eac8748b8a94e19ff603219a00b4" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="98b8d0cae6f24d37b82205357c013e2b46980db20b83eb8e4f3bb834ab861e41" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="beaa18d95f51a6c0c6dd01d6cdc0bf496a498fee0572f9bfa606cbfe7428479e" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="ac7c3c5cd5139fcbb5f6ec6065d2f6c293099b65116c46bc27d58e4f95923f3a" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="5be6fe5f1369b7455580ad3a0e7cf4c3571779b2c1d04f1fea509c4f18f741c2" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="9ceb17fc8f10dcaa219d17becb8b0b8be409b65aa46f1107e5bdc074b3d21a7a" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="fa0946741b16e4ea7109f674e86f188bd60d94623717410caf6dfc9bb2afced3" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="55ee3f11f61e2e7b06a3c3a000af3741e6a68abab41e1a3cd23d91c77b8ba490" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="655a8bffd2b7d3d01e048761c34b6009d130800e11c8dcf51006d5615ca23699" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="ff88ce2f291306db139d24ffbbf656011fdb1d28fa33752b2675e03f39029536" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="e798a5fe5e158fdf479ec970d07fb192d15aaeb84cebb29bc97c47f9dd951e1a" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="b9b38c60ced916fa7baaab7c8db25575252dcccdaa7508ebeef68ef3de319560" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="2ccf250117e076e71bc0a7282511be4eead3e2b40f6b4e9cb1dab4e6fdea08b9" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="9cc114302ca475194eacd30c57c5b1e43a5754a059145442625cc90575e7c5bc" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="887d1f49d0fc9dac0b4769b541d4c57268ca2b2320dda71d15bcb17669ae6895" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="6123a47d5655bd9fe3ca0c7f33079da23557bce32f8a17df514711b584bf819e" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="3af5d9a94ca2cbcc929a6789a7a32810d267a0d8f93a3265b0f72b531ef6cbc7" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="c879de380ef4dcec2ad35ab21abb2f2569c6c00b4dbe50c19ba1d4bea26c68e8" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="5d8b9f52e76efb05883c2841671ab5538efa200e86c9abe9d3f23ef938c5a1e3" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="9cace12134e3e161691bb0bfc53188d166996154d1a3c69278aa112f3763ebce" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="525be4102969661c20f21317982da035e4cfadbd8752dae3712bc13eab59a8d1" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="4b59cc95780769fb8004993d76d4b853b43058adf680257674f06340823508fd" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="bfb9fea274045ed018f8019213803cc79fca5d309e94dcd31e7cba0ed1afe0dd" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="82df70694865d0df0a215345b32d14bdbd5c036deb02592a79a9be0fc93e503f" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="08c7580f7f4800d5f75ca922eca9e9b480814c47d7c5a7db0c22d1daa91cc349" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="13a5cf01a896d0af22c397c7978dfefbd6e0b5c47da5ea2fd965ed364b0d9532" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="72967cd2b217d78d02c6305ed0f22a84e80591973cbad7a1662b65fd6e2c4026" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="d64997d19bb0561152de9d518f4a5d38f998f007857e56650aa60cb4661b2593" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="0ac18b62f170b14e4d2d4313d9e6912c0a484955477571000a37f7e27e3e227b" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="a97ac27ff5644473a34e13daa5fb251176b50e14f78bf74d49038fd0147aec68" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="da21f420c8cf8b86cf69eb05229fb25e08ceb1aef97a2390b404c13fcc161ae4" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="a0cae92332a81931afd18a80e68f9a5840e3613b1113abc069998e2f812782e5" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="8b635114da54b446d4693e758a1851d30742703ac8651ee0fc551fe182b7ad83" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="6944115dcb4b6aaa8a221dd4ff8616c84cf85a7889f7a0d7823148460e7aa8f5" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="fd668505b6057cc86b31dfa3fe7390c6172ca51efefe931ee37070bb44407fd7" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="a60a5cea901cb80645967129d9a7cf2465a339368bbbdd85707eb26a24da58ce" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="415cbd152229a6bcb3ee1dcb529e8f67664b4abd78a44116dba9f4e5d14006ca" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="0c12aeb9567da70ec4a7cdbb6ca99e01fb4cfb5e124d166f352fee0970e03ac7" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="0cbcffabf801a49665fcad5c0ffc82f176ed5928c169a917d8f1da57f4313ab9" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="e627135f7b7dfdbdde39b152e5b960d8649b5b47cc8d3dbafe56eedf6b18ab2c" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="80b1af2e7b84b2bf9c80b7676e0da031ca594d8d285dda038b939d43981f735f" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="aa7672a8893da6d0094933260d1d996f8457cb3e7ef19184ee75d586ee37784c" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="160d9d66aba543bd9e7c06563ca658a1725d091b0421d2cc3aaa548026d41688" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="f43fd26c1331db3d62f06754033801f422561804ba17174724e8db11e7f8a6d2" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="abd75851c87cc60526446ccffeaf6aaaf969698b198b965df98c9d1940f9d973" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="6fa9dcdf36aaa0a8b3566fd844aa2286906f8096c56ec462161be4aa9599da8b" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="ed91b2c165171242619debb02b0be6713339f5be6a6ce9c9c2b1c563729fad27" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="090a425d1292b3d07451c35fce71054b70b1b5e18fee7221dba32aacf50120d4" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="3f21ee8e9242ac9cbc6e8d8ee03ae6e0e761242e509d6450f03f0cab9140b432" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="eaab9cc8158f595946a7b85843ee05cf9f7e775a94e46212393d42835be1e0f3" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="f86c008eb0b5762c053ebf08405ec777f52501e095321c5a2ea535ff28ad6661" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="2b9705f242cac4e3471a6be0eec51c0e88b16337b5572527fd88d8ce0c7c9706" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="35ef48302caa31c2b58fa9bc71302973628db2037d8efe1bff2a8a35aa68f2e0" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="72b6d6f4597531c0b3aefb740438de5908ad96ecfa8e0f269e0828660c42aaf8" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="0a029021b178ea58bf77a51831ac154cdb3a314a1edace2540cf4a57b3d74dcf" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="bf2e830ae09742cdb070a7c4fa66c4c9bae575e456aa6001dd23c9cb85a66246" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="ec647722f42ee15d929273c30116443dc587051efee489023eac711d2818dc9e" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="82e334b871736e59a86c024b6d3211d10bb27f85c3830fee92320a9c8f616a50" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="55735ec474002d058f136546ec6629f96e26d67234eb39a12eab173475734b46" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="c8b9fd7617347d4dbb63c9fd1d5afccc455fb239a147d8bd9f6c1614175f1f9e" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="5b804eadb3ab98e05fde8bc52da3c20c4374a18f8373e2fc4f887a0000a6bee3" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="440ab4d47fb8d6b106da36b59ad4c2cf18d39264007bcafa6e170450b35f8049" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="2785706ed159bd4a84889ab37e9879c68b9cb74d392040c9a1c767c725198f5e" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="ac60e564668ea51fb5d84baacd67bab08ff315d1dc707489d05400cd08601937" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="edfaa2767cdae9e9b162e73263517d8dc08317fc6db149703dab25f2de08640c" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="c72d621dda3b060679acc7ffd2858ebfa85d9f5039690432a6658b2139db9431" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="4af78d4e6abb584c16e73d7fc18ef4258d1ee0751e54bbc814ef879d09e0338f" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="232f22c91f9550b3b2d049b1b04367650551c534bd9ffaf66473690162b4b5cf" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="fef1f673a8f92d9e63713d45f6ba3f24f3ae6b0bde967ff4320defebae369c4f" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="be7828a2e17adbf4d8dea4e64edb01d97368814e4b90f9aa74c19889cde42fea" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="5a2ca8f2ea7bece457e36e5052e363111fda2f942e1a1fbc48a062ec4da8e2dc" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="4aba2662d9efa6b8cafd8adfed9c158e733e4fa82bb0f75c80bfe1771973ce94" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="080854a29d57db54c8055151076246ee21f7aaa0a89f1de7f19bce45b723e55d" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="e832999c38909ecf7c7d4e9c005c0b08530b64dda69657c243b3f50416468260" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="166e1557854f6883148a1b23e07d919bc66d6c0e66ca4f29b5a989a4973c7d24" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="d644a0bb8be1de8ff8a175dfa1f20f87ef49912f3022a62b4e48e739d2aa6a0f" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="5d31fda063fce4355835f1a910c1f118bd92fac47cc6900c7d564c5204ff980a" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="21825a5d9b0908059ecfb37722ff11c0c8216ef84eca2405cf369b5554d55d98" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="46b3fffe0d1ae59a4141aea1f380a4b7e6c959971c859ba0663c1dfd9c60de2f" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="1fb033d19af5bd3e7675b16a16017f2d4dc813980ca72dc93e6f85a66cfac1b7" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="c63c404542a7d4967c5f4ffb0ed0a98bc2067afddd719598a5e0e3800722ca50" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="9039191fb4c8d842c321a3d138d6eb8cf74d19fa84e83630cc70d00ce57aca24" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="67a8fcca46fbf7d7e4ebbadafbfd3f9434b7620feb26fdac8af7a1336859e406" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="30eaf460c6701b109f4b59446ebd503f5c8a99b892f3c673d557b182dcb27090" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="6673b5fd73ff6c8e244be8183fc5ea13132f3821c6d968f8d7702d6d1412ec5f" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="eb2823755635b6647febf2d5636880e4ee0648e89b985d360f5aaed5a4ae4faf" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="f8b087a9e5cfd3ffdef9919d36c1e52141c8bff86860e2ecf9666cb0fb0d7aaa" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="5e5bb6da4d5b120950040a0524497aa90ba27b60ce5fb0c7d831cf66b2a965d9" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="23f10f140c1490f58a5ae851d38508595c76bb1b514b21d4ba5761690e84f357" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="7b4c2bfc9e276676cf963013acff63689044c8b0080631a02252d3fdb33a9a55" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="9252adb5f9015fd1272cf40bf5aac0bc93401ce7ff67315e22977b4f1361b0b4" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="ba349cf0068a6b51f9a817e629996db54b41203dc519b93e8aa7e9f56e7c55fc" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="a8dc4061b9d9539ec0127d9b27cb3cb0a2399a3a7175a9df5ab5c6ccdeef2554" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="b3e490a0730ce7c509cf9579fcc49b89f1a0cff1aecf623da18107d933ce79e9" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="a9b6e34c039a9f99b451eff57d8b66987eb3597be6279a9f08422ec1a7f3d242" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="e6b16956208cf5423b0a882fbee5b3efb0bec378cb5577405d485ac2a78c45ba" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="234313cef37630c6c3358600585089166b3c219c8cefc541a4a1fac5a72f6e7d" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="efa4482675e99d92f7c911d7998446872e467ed1d6114f6356e35e61f6ae7e8a" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="314f75dcceb101d98b3416a17bafea7ddb7d32dde28c590406fca18c27449134" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="9ba3776caf6e90e69dc0ec4f5ac0b51a10105ee3f0dcdb64658c6fa7b2084346" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="c66ade353bf974a6b53df2658493de3412a116a2731be2a153eafc0a4ce7179d" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="9c981842de1e4fdc9539bb3db12d0aab9c3550dc9f8e7e31216bc31797b67f4d" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="da3db84fc84d6b1a138eaa80a751c844609869451a4b15fd0a965e988b98f5eb" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="e38346ab9a3d2074b15af67953691b9879e0dc7247010d7e1b0a0d198f999b90" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="92b543ff65c805f4a2e255d4f5bcbb4e507f7066d3b4278fef642f429b2dc53d" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="b67e09ad92610442508254fec9706db6c7e530cc88922c9d430a7ed787f200e9" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="a2d9a8a7957be49cee5ca4c63ba331be73a4567b68ca58e25f8d6ba7e1b2c4fb" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="0c2efba0c611f63f8d3666d6dc620b561d7a40e652f27f8df8189bf30213074c" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="4cb03a83b0852676d712cb1270c71aee5c07a2752f342a78236d12ab5fbeb6d8" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="b845adca41f605f61ec3f8366760fb4b09786179baf5fa5d7f1efc086dc797db" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="37325beac5605a8efd501a114a3cf9e80917ab0dfe651e45ff99a6cf0c0755c0" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="bf4e36128c3480a0a09ce4f95cdaca338087b8b336999e3357b07f0acfac5f02" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="e3f4dd5827f1203ea2ffc1de25b4f1e0729a25d490115a9506589d9e3161d97c" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="04c6baad8efefc96cce30af21afbf6e597d7a172d088c262846d9d0fe16553bb" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="bae2ec24a4914049ed27f6366b24ae6da3ccd21d1b0d13f4045444e7b1e61841" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="6de88bb6dc15fd73692e459a52bbb8b0c5f23edf84f5c0c959b13cac0a73bb19" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="3f44fe92325e27326e5e5381e9793704c716bfa8f458b79bb0daae3a64c81036" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="c74846b309e7faeca7d7743a7f5ee0ce82732e25595a473db5bf587eca2d0388" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="64076a3397953ca826ab59864999dfff79de447bb7df77f46efaa56c922602ca" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="ad20d9314a9fe71c53998a8c7c5211ac74a4a5c2c13c1f02f2c324d28a114f61" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="94be601d129dc8970ec4b926b83e0e9ee911b2783aab87e43dedde4d6194a9c1" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="523ab9217c8743ff8460286e27dd29ea35be4a651c5102e0474e14335de1a591" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="fea3ba88a40979e4479b90fe92ce6b17307c4439a42a8bc056c7fbfa3ea80559" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="02f4ab1bb8c0e8f81b3914efcc7f65af1478e03377dfe739391728d3d8aa7a0f" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="d49c5ec1fb4764a960a30d2a1e1aef53998de5f08e998344500697639f1ea7b9" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="a2b2a1e0838837b666f0002057f5ca571c4f35a87026320b4932e97575dd8fc8" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="42fe4dad76f7d27d578cc475a9eb196e637ae3536876a11bb4b28ce76ad5c054" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="928c05317251699f5bb2b857baaaff3260cb694eed69dc14fdfc71b439fd8831" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="dcff77240f40a6dfd4571554b96753885c32044ad4c5e671e2bdd240672a8fe8" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="c60c358e1a5cb6b92529cab5458c6b86d418c1f78fdecb812faff0d3b7871cff" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="a464c1157c1102525077dafed508a6bad2b3178456c6719680e126caa3cbed52" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="4ba9235621ccaac76f35971503f88e6607e1fe897dc817d6ddabdc25dc983b2f" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="647873670a57858b2cf7e06a704446854e3ec6d3b8ce617a2ed87225d8ae1c0d" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="78e6a358661d7bd74c5cb40c91d74b26dd100fd9e04a141b3d1584cfb61d7ca3" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="04a835b71a0b92b9f5391a65de143071a01d77645721cf74f748adbfc167d6b4" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="f9ba4cddbd38e31ef4633683f346c2a77545791d47f23e357872a1cd2af11fb8" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="214a0da621d83927d9042c1895f51f86558f8c7f107a9809da454edda58c3d89" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="ccbda10e37ff2fd9332890dc62e2371079b3d9087e2b9cc8c2e32fd8f43af5cf" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="4d99a02bef15f74485521266493733193e991776bd1fc315e2b2de832ffd05a3" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="ef77477cde6d333127494acfd785314c2a3e30de232b9483f551b33216fb2dc6" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="a71cfa141c9490ad1a18d1488733096714760be6f79a364eabd540a6ba42eb7f" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="9c7462289b0e1a9bf65de9dfa95488864595a89ab6c45d5ae6ebe693096091c5" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="d2df225ece7cd5a39d7b17aa440bc0e5ca2e81a9ab8669321d01b7e14160aa20" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="f0c8566dcd94c932b120fe7cdb677fb4c3531f535e1c7fc41b49f8f8068a8695" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="3622f05fed9d72143aed35d8f43cacbdc1a50b23baa474064f00eba48a79fae7" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="27d809cb2e87e1aff4593daae09ad185ba0f3d595eae685d71ce59355e655a7d" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="133503f0aa9e0e3f2ed2b2e1e12eeafc9e5fd7f234eb2b043bfcd029f75a06bf" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="8469112342027edb325146db3161896f07a3e8effaefe67061c84b73d45708d7" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="4644504eb28a6c5c8de5f12660ff2cb132e8d0b97a34d10d338d84b5850d1968" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="93e1c3830100d4db11c00bf994629ff15ff484b9728aa45d178b51978d78e508" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="ca96cbd18b88cd2571e3d36cdbe7abeb59a80550e1f4316d4a55b51b57d1664f" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="dd52d46c6d3cfd476416df1aa5aa47c13be5cf60ffdee448d832ff3227cd4c50" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="313acde4dfe0743cd354d1e1eb3420846ccdd8a608cf9a86444764f74d6859bd" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="1521dfbb8654c1ad3927547a1e3ebf18ebda8736f05cf237a89dce46542a18c6" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="5a1044222cc67fe18519783bd795171a4ced7382149311a32d8171e2476e9db1" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="13b2afb6813bf22e89d5f93f653115287b6d0fd02ff81599d5125f63bb16b2b4" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="f91afd25dc53f0c69c0dcf1ff61e29652a99975c161b159589446551295bbd02" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="570eca1092259e90cc31487df8095fac4145cb4ed3f6eb92fb52752ca512bfa9" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="11292ed78e64541cade9fbaec9aa58a51cc67543dbe89b1df7b9eddbd85572ea" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="6f4553b83137e3e9b68cebd399d3d8676b41b53bc319bd5fcb1bc553a5db415b" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="410455ed2f22d520e132a09c5e0f65804672b4ba91db8c56f72dc37158a2ec81" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="3c2d5385fde8267598bfabbfd77c39c9839eb3b9cde31590ea27fedd3b896bbe" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="135596aeb4fc2f8ba38e4b3b088da3491f867bce10179a3f5101eb637800e33b" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="d8fb293e575a312d6ab96fcbca0cfc2c51dd12fe82bbb33c870adc29b98e787c" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="20a8cf32718ca23103e5f1c6c89465ff01ef430f36fe181ee0268ede5662aa60" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="45fd419bb9d252fc163c9ac1e5bb181bddb4faeec255125a803c185dc72ba28f" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="21c52ccf028c1c2ef5ebe87239f0bfb1b51110582d15b8633357946b2d78f651" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="f4a640fd0acd0fbdfd627e6176a3274b8fbc584ef9a92db5020e61fa54e52530" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="3159158f038d2abbaa90b069b5620630a5fa7baff5b105c1572d3acbfc20b2bf" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="d0f4b7434ffbd84248b2f11e18ceac763cd8d8cc901e4d5bb6a974ac6d54fcc6" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="60daa90f906ee457ee3d2921a256401b34732e575e07a55cdcf82a6654f89934" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="a51a1693b91e2faa114a147908440f69e0fb480968eaffec0a518c932760acc6" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="142cdb4975184c9765a7bc9cc782d9610270c7c48808a1cbc3da0230eb51c6d5" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="9621a1ff7b1b5f4821d3749e121fc98efc6b988502d71f1f5f63d36d77c417c2" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="b53c073ebea7c065b88fba5fedac4a46c67126f58367350a15b3b595dd4719ab" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="15753b06659fc0e2705eabb37f6797d279c31e62d0b5936d99f2b5d3a8d70e50" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="4638f9901ff553819e75fb62b2d761bd7ab91067356cabe0630079d6fb1f3e41" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="abbe1b40b59c89c1853c2808eb339537b6ade7b1f49b2bb374ea22e4945da315" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="83caf2e16a98cffc22a81c95caef2f7ada3f25628425124f9c160de5c83d3376" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="99986c7e90ceb72eb8f5dff86f9f94d814ceb4cb0370cb8972bd8f46c1333cad" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="066f8e26b643b1de8518e3ced43475408ef88f9e248d0da89cd38b3b8d5a3f13" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="50ade53510e6f20c9de1da26e085fca095b8fd5702f7b28d10f707158e4250cd" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="f2b6a645fc295225ff971b0671f00db72c25ec58bcb58b92c6f65df9db4f216d" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="649393bf08c76b08d4c3cc331c66755ef458ed5b57dc774f61aec86a90639e16" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="7ba8860ad13f6319855bdda02c36e6c51a83fc24fd6e5369dd551212e465d19c" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="b2f04beb617b202dbba04074249d3415f5861ad9b61ae9e4094d80ea4587f901" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="ad20095c1461103cd063277d0748d4edac8ef51660727d01910ff2d015b5bd7a" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="3fb4958522bc82579d77e0215d862d5282ae3316d565068e8b80ff4c31cc707a" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="5c2eb89e797661e3d4e2b28cb7f41db8b573f74969e135f1782f56e7ae3a0ae1" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="ecedee9caae6a5d61e4e42048181e1c33e8f83a618d2067312dd79b5741a7bac" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="149b0ed73a935cdf917976e7f4e150a33b26262199d223c108dbcd7bfead0fa3" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="0b1d900fdfa2ed1e843fb01cb6ba0372b6f64e792b42af325c5829e2268add68" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="72315177033c0c635be40c5b9df1e6c1f5f57ecaa993feffbbe0b34fad407969" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="f4c07f7be7b3234dd1852bf56321241b08c03ca85f7e5d711cba55354b8f1115" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="38c11d5c19ecf6b711f2a11a2a1bf920408aa909096761dbc2c94e88540b4c42" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="32f3fef0dca2bba05cec09ac5e7ac9527dc2005160eb0aea65e3bf494b365726" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="4c7d22f5edeed3b6a509c4934e2351f98927173fda7627374832ca4ec8eb05b7" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="640cd434233054502393dae349609b0527abf00f47bdbf90ea3e2b7a782acc0c" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="ef9cb766a4625e3527918bf6fc9dcfee691f4ed5a064fcfc58dab4aa3718ffea" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="d4e9440848c8a969d6634dafb350f1d8c233dfd6e63a6bac4918df75bb897d16" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="4b030a5d6980ba2bf86e06fc75859a60a9893be48ea9cd969f6b8e0f0e115fad" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="d0568340928240fef88f8cdcfc5cc3c70931cb401efbee8d649952405a866f04" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="756b6a58d75bf228e8f097b8039c4bb4092d9b964df755a12d163e720c72e3fa" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="0d809d5d8467795e6e228977e057fb5e687b282aaf2dded5520114ec5935c296" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="9d2959909a8336496fe4c4e85c8017decdf6fa662a3485e52a461c78f50549b3" name="NetworkManager" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="2d5a6e17674afbed0784b8cd91a1b38de65c7e46e56de490433fdfe742a3baaa" name="NetworkManager" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="2434d2111245b044045f77bb20ba44f6a6d5c94558adba178ee8c276852bc330" name="NetworkManager" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="bf5f91906c807afa7dba30b0c42ca590e5bc112a04054238e3c188b47ceef55a" name="NetworkManager" arch="src">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="58a244f355b892cfaae060bbcb95748e80469ec0c82f7aabc142fb0a47535cf6" name="NetworkManager" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="b24e48ba95bc28c01ef6bc277a897e6411d724de0d647c76c6912ff9781a5052" name="NetworkManager-bluetooth" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="1f91aa4cb262e178770def0a546ff9bdb4dbea557c1cc8a287b02cc003dbaf83" name="NetworkManager-bluetooth" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="1678c151c7ff858bd58f1bf8861d3ba2d0941272e3ad356d14db11accac679d2" name="NetworkManager-bluetooth" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="f676c6315a934f5da997599a4ebe8a7065c83f5c05885ffccc39656ca3a83a6d" name="NetworkManager-bluetooth" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="a325f57058452704a35e7b0d57fcfad332c31d689502c83c972a83ca19ef1ad3" name="NetworkManager-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="cb6dd12beeb93e8ced46ca422890b01d85b1f87e16d7a5d56e6e5d5c9291039a" name="NetworkManager-cloud-setup" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="78c3b649afaf92f8d263a3fd8e7e7da86140bf1c4fe6ca12ad5fd21cb4545585" name="NetworkManager-cloud-setup" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e35fe7059fc7b50925656e31deeeb9a1492958d09e16d0420eac6bebe6401a1c" name="NetworkManager-cloud-setup" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e61672434148e4e2660e8d8d38281abdd1ed782fcdede0cae32603d6e50ba2e9" name="NetworkManager-cloud-setup" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="bc1bf0439cb48956be8fab55b4d84c491b4badeb7d3d0e19c35d3559b54657ab" name="NetworkManager-devel" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="cc00818ff7b976130280080242b6fea205647599e2bf8de04595ffb213445318" name="NetworkManager-devel" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="2c6efe42e2406658b61e4c7de8056b481038e7be9ba0652468be363b45ae2c31" name="NetworkManager-devel" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="5cca66d1b05df05f577921362ab27b4375ab5bfb578d690d29e5ab11f704b06f" name="NetworkManager-devel" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="f5940436f1957588697ecd379699ce97fc9d4af4a6c1d957d91ed21ed6fa8ad0" name="NetworkManager-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="8a3d957a31e706c127555a87df96e9282e44d05e71ef5680dc865d63051e2c4f" name="NetworkManager-lang" arch="noarch">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="ff1d43362f378c4f004e2ab95467f1d75f9d5ad2bfb31b40e5d90063b7aec4a7" name="NetworkManager-ovs" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="8fd7d835c2715415175b95b97f21f2d0754c4cc24a9fca2827c99f5544f8c696" name="NetworkManager-ovs" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="fbb855f3518d417848b2d6f38fad73d60eb490200b5ef85d47bc488da4c5c87a" name="NetworkManager-ovs" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e6bff24ee0db2972f964a0c298ff61a648e85aaaac5990ecddd2d5191d90f934" name="NetworkManager-ovs" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="f24728c555a281cc7a7421318bcf6dbb42a2916b71476b0a2b45f4a06605a172" name="NetworkManager-pppoe" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="91bcb0303ddf11142484dc2850649abee269ddfecf8c3899ec8fe4d8771f8943" name="NetworkManager-pppoe" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="58315657c14e29ae92d3b7b7eec86b65fdd11e3732355df3918a38ffcf4b62a3" name="NetworkManager-pppoe" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="8364de7a3caa1d44c5b13606186e275203fbad492dd31a0ed7d71e6ad6680bf5" name="NetworkManager-pppoe" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e75e4271d1798bbbce4307c9ee38d5c5a226885b99c53403b30b82eb2914cb0b" name="NetworkManager-tui" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e6362dfbec2ac0748f5b9822a8d70cd9a5600e82238046f875842eafb93bfab3" name="NetworkManager-tui" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="633701cf772a73d24f48c4f89bc72cfd9ba7ba64b36250f15883cefa96d9db48" name="NetworkManager-tui" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="8e7a35a106a9202ee7e4b7f592ea4d809edaad86f8d55a5888533a95d17af503" name="NetworkManager-tui" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="36df225b0b4ba5efd6efa1a66c5a4b80873888d25519de154d02bc13315a8088" name="NetworkManager-wwan" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="dc38789a135fd180d418a256f779ae329a2334e92ea8eaf9dc385d4d0130a92d" name="NetworkManager-wwan" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="1cf37e03d27bfcc2eb0c7df0164045ba9d90d5ebe53a00d4fe289bbcdd965e04" name="NetworkManager-wwan" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="ac7bf279a3264b6c47adbaa5a02599eaab5d355739f0d3912be91e027beb1593" name="NetworkManager-wwan" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="a616ef50501a1eab0baff115549c723cd68f43f3068e86e316baef428ad2b1ad" name="OpenIPMI" arch="aarch64">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="05a268c5077664b2dead41e3eb28b48a8fe9d880f91de6d4998395fe065ff3e4" name="OpenIPMI" arch="ppc64le">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="33daf99481879d9a3b75f2664c0f5d39127b365570f2f0a283afa05fc3b4a05f" name="OpenIPMI" arch="s390x">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="77b8ab3ec0554b4c9bbdd2520e1b771d3a4b1510fbc04cd93cb6c24fbbe9831d" name="OpenIPMI" arch="src">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="41a3568c88aeac1be0758dd4de0d49b7b696325a5858e3aa09cd3e60fa95f206" name="OpenIPMI" arch="x86_64">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="2361dfff3824112c31f4aa6c3c527f28b792bc10cb8fd83414ef620716847e26" name="OpenIPMI-devel" arch="aarch64">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="2d6d02b1c8bd49ab7d11d7e5103ec68757e4eec8966cebf378778b52a6a4a4ba" name="OpenIPMI-devel" arch="ppc64le">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="68542b5b49bd06009bac5f48c7c0e3b27736cc2d10566d1f595461ef89d400ef" name="OpenIPMI-devel" arch="s390x">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="229b046963f1f71eb162b555a72a692f3f4599957b907c3305eab4df48c1bf66" name="OpenIPMI-devel" arch="x86_64">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="d61728a1500d6a35e49c4fc4dae7096438f0eb110fef79a07b7dcf5aed13abb8" name="OpenIPMI-python3" arch="aarch64">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="ddf6c405490ab5f70b61d2306e6b1ad05cf27068b2a9b2ff13c86d5e2d3a3c3a" name="OpenIPMI-python3" arch="ppc64le">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="91affa7378eac222dc8df7089065c88fb8f7a2aecf5e0bff2733bc25a92404d9" name="OpenIPMI-python3" arch="s390x">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="a11181aeb979188338f61b4a3193906e8b69aa861928d2ec0e64a0e4a21f8795" name="OpenIPMI-python3" arch="x86_64">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="edf10d74afe9a5808353fcd4a700aca72b8fc9574991766c0942c47c7ec872d7" name="PackageKit" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="242a35e782f1c2cf52764cc47c40b35ff9027386edcb75a993cacdd18ea88e05" name="PackageKit" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="61e8cb31f92e27f52e2a8514eb18ef46f997632c80a862a6d3800d57758f22ff" name="PackageKit" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="91558d9c65dabb869a2290172333fd457dd4ba782830cf3f79442c763bcc3ed2" name="PackageKit" arch="src">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="7cda6daa85e46ec139dd7abe310c6cd157c3d29c8adee4600d6a0bd827937935" name="PackageKit" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="1f78ebaf8a198e9411b1a97dd2feb26b676fd122b639cb8126478d4c8993c290" name="PackageKit" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="5f04ee7ce71cd6fe18985f865b8086a1f5798a1c9d8d0f70eb0d45d2a5103478" name="PackageKit" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="b00e5fd218d9b1a50ef946b9afa129824a92f2e11e3ded338925674b4db2f845" name="PackageKit" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="81ae56efda9a56a1828b2459d67dfd5149d98a2f863cb355eeb5f490b1d7e9c7" name="PackageKit" arch="src">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="87b57be163e5f870c5289d08368ac974065e36cdbb38ac31432b60423145a77b" name="PackageKit" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="16cb26bc57089d9cb73053dde8b23f61ac4bc91a04485e6c9dbe1f7490938555" name="PackageKit" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="e87fc2aeb1fe45ba1b6605100b53d14447022a2fc199ada51e6b2b5c88eb30e6" name="PackageKit" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="bd84b033efd0f024bcab110d7c16a54efd2d704c315b1cb6cda1d6db5354ec3b" name="PackageKit" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="c8e7608ef440349d74d747f576560f62d0bcb38987cc54a9e7b31647394d488b" name="PackageKit" arch="src">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="9293c2adb3982354e698af7b0a2bb4a47030646eba28f5704c0abc4c2fde4bb2" name="PackageKit" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="f8d88ef5fb7c3013da12afe46633b72f0f023a13978fec668fb303c95947e9c6" name="PackageKit-backend-dnf" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="3f7c48731c1e413d112f0f414915fa8ce493414a9b534804c1e805498290d73b" name="PackageKit-backend-dnf" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="e6eb0b2a2a65c7226a5995857f43f45a4d555f4f65f11f408392b620228eb34b" name="PackageKit-backend-dnf" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="34ebac62adc360720ff2a82031a8d24ce7bde64091a30ca8f52c0ce578be5f54" name="PackageKit-backend-dnf" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="15e562ac20e61bab022fa6780f28dd560ddcbbf903af74641df835d57cbea684" name="PackageKit-backend-dnf" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="71bba0f18aece203106bbed861f5b6e307207aceb7f42554980f319872f76581" name="PackageKit-backend-dnf" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="dcd2eec48560422ca7f49b0700368e88e9ab5e557c98ed0d051778017633d647" name="PackageKit-backend-dnf" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="d64ea88b0e84cd5a3303b7a96b0ef86f90e60995d958d9ec84f70928050cb2d5" name="PackageKit-backend-dnf" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="b4d8a4f12728c4000b3a8aceb58eac70cd31dd904d50256c12d844b7ec959fdf" name="PackageKit-backend-dnf" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="af36ef107ed66ccec28519a5c7d3a8273fb6f53688228a5d53e30e24ac23b516" name="PackageKit-backend-dnf" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="c35caf9bcb3f6f490bfde00b0c3968922c948d5a2ca637aa7ab027fdc5de98df" name="PackageKit-backend-dnf" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="83013de86948bac18a7bc007e656261d8bd984747db22e59774736777383b1f5" name="PackageKit-backend-dnf" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="3d96880e305524eab23bf121b65744b2eed11202febddc85482248b831e1ae71" name="PackageKit-backend-zypp" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="7874859d99e0824523e8d58e55574183b924c058591ca584490c2baeb01cc893" name="PackageKit-backend-zypp" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="60456ba93f333cd868a72e31ca65a9ffbc389495bcdf25c7186ad47e08cf2ffd" name="PackageKit-backend-zypp" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="0eae9ae8b0453de6f76d626325938f43da051b58ff236c6570f00f7b8c3fe726" name="PackageKit-backend-zypp" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="24515b0b432820dfd45823de76e46adc3ab8d9897040658ef1a593aece695dcb" name="PackageKit-backend-zypp" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="ae5c1a696ba543f154398177b802e1c94f2e1ee36a17378a380ecd8cbde0b2e7" name="PackageKit-backend-zypp" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="ab8cebb75d5962420dc39eb7f6fa0dee1892b65c192cdcbc15499404e7222c65" name="PackageKit-backend-zypp" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="a99c93738ae033cc52db30662fc190e3b516907a848ee0fb2af25195fa29e00e" name="PackageKit-backend-zypp" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="5501254f3f51186e86f59ae8c2e674693adf064062e36a85ae5da9d802dbcac0" name="PackageKit-backend-zypp" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="7a1720c1edf06dd2b2e386bebaa6036882586784f6e4ed14e1f98cede5a210aa" name="PackageKit-backend-zypp" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="108d15ae8932f29e8f525b1ce8ba3db4361a9cc84e1ea30d2520e0d82e5db564" name="PackageKit-backend-zypp" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="dbe1dc7e6c0eb6f77ad476c1c43e60b7e5b30f0167a868cc8379a1d27141e68d" name="PackageKit-backend-zypp" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="ec3e8fc5819afec02382e909ab97af5f842ed23d4acff634c2dbe3d6e82b4b87" name="PackageKit-branding-SLE" arch="noarch">
  <version epoch="0" ver="12.0" rel="150600.22.2.4"/>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="b049d40bba76bf87f04e17a3a47ec44e52d191c5266812bfc5802ddeb75154cb" name="PackageKit-branding-SLE" arch="src">
  <version epoch="0" ver="12.0" rel="150600.22.2.4"/>
  <changelog author="ro@suse.de" date="1273752000">- rename changes template to changes.in again</changelog>
  <changelog author="vuntz@opensuse.org" date="1286366400">- Update so that we can ignore some files from /etc/PackageKit that
  should not get branded, like /etc/PackageKit/events. This fixes
  the build.</changelog>
  <changelog author="vuntz@opensuse.org" date="1286539200">- Bump version to 11.4.</changelog>
  <changelog author="vuntz@opensuse.org" date="1298030400">- Add PackageKit-branding-ZYpp.conf that gets installed as
  /etc/PackageKit/ZYpp.conf: this can be used to change the
  PackgeKit behavior when handling updates.</changelog>
  <changelog author="vuntz@opensuse.org" date="1304683200">- Package %{_sysconfdir}/PackageKit/CommandNotFound.conf again, as
  we build the command-not-found PackageKit utility again.</changelog>
  <changelog author="vuntz@opensuse.org" date="1309953600">- Bump version to 12.1.
- Add a Requires for PackageKit, since the branding package is
  useless without it.
- Update summary and description.
- Add Url tag.</changelog>
  <changelog author="vuntz@opensuse.org" date="1318507200">- Remove %{release} from the PackageKit versioned Requires, to not
  have to rebuild this package each time PackageKit rebuilds to
  keep it installable.</changelog>
  <changelog author="vuntz@opensuse.org" date="1331726400">- Rebase PackageKit-branding-vendor.patch.</changelog>
  <changelog author="vuntz@opensuse.org" date="1337774400">- Bump version to 12.2, to prepare for next version of openSUSE.</changelog>
  <changelog author="aj@suse.de" date="1357732800">- Bump version to 12.3 for next version of openSUSE</changelog>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="16c3eb6b431960e0a8d6359c2c716bc6f3e8c6010653d9ccc1d1cc9f77f0061f" name="PackageKit-branding-SLE" arch="noarch">
  <version epoch="0" ver="12.0" rel="150600.22.5.2"/>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="259c40ef5ee577fb650093051bdbfdec63f635c63826f02fee8c25e091deff1b" name="PackageKit-branding-SLE" arch="src">
  <version epoch="0" ver="12.0" rel="150600.22.5.2"/>
  <changelog author="ro@suse.de" date="1273752000">- rename changes template to changes.in again</changelog>
  <changelog author="vuntz@opensuse.org" date="1286366400">- Update so that we can ignore some files from /etc/PackageKit that
  should not get branded, like /etc/PackageKit/events. This fixes
  the build.</changelog>
  <changelog author="vuntz@opensuse.org" date="1286539200">- Bump version to 11.4.</changelog>
  <changelog author="vuntz@opensuse.org" date="1298030400">- Add PackageKit-branding-ZYpp.conf that gets installed as
  /etc/PackageKit/ZYpp.conf: this can be used to change the
  PackgeKit behavior when handling updates.</changelog>
  <changelog author="vuntz@opensuse.org" date="1304683200">- Package %{_sysconfdir}/PackageKit/CommandNotFound.conf again, as
  we build the command-not-found PackageKit utility again.</changelog>
  <changelog author="vuntz@opensuse.org" date="1309953600">- Bump version to 12.1.
- Add a Requires for PackageKit, since the branding package is
  useless without it.
- Update summary and description.
- Add Url tag.</changelog>
  <changelog author="vuntz@opensuse.org" date="1318507200">- Remove %{release} from the PackageKit versioned Requires, to not
  have to rebuild this package each time PackageKit rebuilds to
  keep it installable.</changelog>
  <changelog author="vuntz@opensuse.org" date="1331726400">- Rebase PackageKit-branding-vendor.patch.</changelog>
  <changelog author="vuntz@opensuse.org" date="1337774400">- Bump version to 12.2, to prepare for next version of openSUSE.</changelog>
  <changelog author="aj@suse.de" date="1357732800">- Bump version to 12.3 for next version of openSUSE</changelog>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="ebe7787ee3322e65464358fac86977e3987a133c48b2abea0e352e42d5aae80e" name="PackageKit-branding-SLE" arch="noarch">
  <version epoch="0" ver="12.0" rel="150600.22.7.3"/>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="f3b93089633cd6da6e886774388526278f511c52f83e507ca3216486536b33ca" name="PackageKit-branding-SLE" arch="src">
  <version epoch="0" ver="12.0" rel="150600.22.7.3"/>
  <changelog author="ro@suse.de" date="1273752000">- rename changes template to changes.in again</changelog>
  <changelog author="vuntz@opensuse.org" date="1286366400">- Update so that we can ignore some files from /etc/PackageKit that
  should not get branded, like /etc/PackageKit/events. This fixes
  the build.</changelog>
  <changelog author="vuntz@opensuse.org" date="1286539200">- Bump version to 11.4.</changelog>
  <changelog author="vuntz@opensuse.org" date="1298030400">- Add PackageKit-branding-ZYpp.conf that gets installed as
  /etc/PackageKit/ZYpp.conf: this can be used to change the
  PackgeKit behavior when handling updates.</changelog>
  <changelog author="vuntz@opensuse.org" date="1304683200">- Package %{_sysconfdir}/PackageKit/CommandNotFound.conf again, as
  we build the command-not-found PackageKit utility again.</changelog>
  <changelog author="vuntz@opensuse.org" date="1309953600">- Bump version to 12.1.
- Add a Requires for PackageKit, since the branding package is
  useless without it.
- Update summary and description.
- Add Url tag.</changelog>
  <changelog author="vuntz@opensuse.org" date="1318507200">- Remove %{release} from the PackageKit versioned Requires, to not
  have to rebuild this package each time PackageKit rebuilds to
  keep it installable.</changelog>
  <changelog author="vuntz@opensuse.org" date="1331726400">- Rebase PackageKit-branding-vendor.patch.</changelog>
  <changelog author="vuntz@opensuse.org" date="1337774400">- Bump version to 12.2, to prepare for next version of openSUSE.</changelog>
  <changelog author="aj@suse.de" date="1357732800">- Bump version to 12.3 for next version of openSUSE</changelog>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="d15beecd3c85e770feaacd93ce2174b210c61b08fca99f790ad457d7cea407ae" name="PackageKit-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="99bf72a04ac2ebda4fa950a20fe8ebae46367a0d31752c4a5b338b0fc95d1bee" name="PackageKit-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="b5ecb287bd69b4b3360ad2f80aae003259e60af0512ff01fd7499dd6dd0a03e4" name="PackageKit-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="93aa5ac1a52e19f24b3ba71b58dd8943c504ca19d5ef5aa447745ee753be5c53" name="PackageKit-devel" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="9654f62636b4f189a23539fa922b4f94e96613d002a9f3b5eda6b41f02555cd0" name="PackageKit-devel" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="c6afa8b6351ea9eaff326e083930d36d37657d4b7482ebfbb45199cc1f5b0631" name="PackageKit-devel" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="2630835d315a24e76c261b2e933bd81b39ed676f891ab12da31c4e4bdfc6494c" name="PackageKit-devel" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="30c09b77e649df871986dbb8cda014b91a0aa46cb93121d90decf8c053a6ec70" name="PackageKit-devel" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="ee2ac00c6ac376d18558d61ee8baf32de7953904ab01325bcd5e41492da848d0" name="PackageKit-devel" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="8f188c7006017d5d08944969185c1e9d2731abe371e4b5d1506d51f658149d89" name="PackageKit-devel" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="b11f1812406af7c636aceab50ad399fa2003db5d395f344bf352d0ceffe78439" name="PackageKit-devel" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="45defac5bcea273c6299217497dce7ffe33a18ef35d80c28f283712a3841289e" name="PackageKit-devel" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="bfe28b94c014133a58bda722ec53e720edd10184085dd7efd64c1f5c854ab588" name="PackageKit-devel" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="cbcefa5646e8db123176a6a49d1d888148e5ce13f101d3b3622df4551bd0d580" name="PackageKit-devel" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="b92cbd6da72ac7c317a73c00e440e0ce69cf943a2988c99f8f1f8eded04a719d" name="PackageKit-devel" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="2f6af57ea5d35fc77a8a464678c07f39792a9787851015f0991b660f1ec94470" name="PackageKit-gstreamer-plugin" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="5da541313a499bcacb0fff0b1888376202ba62a5c9618139c02afa4cd2c0a7df" name="PackageKit-gstreamer-plugin" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="010f248eb2b5112b310ad89c198831786c67bec91338b9531e05797e6c931b0d" name="PackageKit-gstreamer-plugin" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="2a20315555e9d17e8f11a27fa89c9fbb34513a103ae1f89a475abbaac0e63714" name="PackageKit-gstreamer-plugin" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="05001c4042ac43d171c329eff6dc1ac0c9b6e89908b55c6c89f1962ae1ce848e" name="PackageKit-gstreamer-plugin" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="5282f9a5470b82897e7af581ea2597b513a16c6d1b1fe362c32f66cfb3cadec0" name="PackageKit-gstreamer-plugin" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="d435ccab2f1751d83cef002c33d54ae7d87e1c97a919ffac27850ae132dd380d" name="PackageKit-gstreamer-plugin" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="5b3844387e2b684c5c8357e85e2b01b7de88a408e996725b92c458ede8f886e0" name="PackageKit-gstreamer-plugin" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="b48d7e5de4f85e9db9af309280c9c57caa61d0b0c8c6ee299b9149e6c937e267" name="PackageKit-gstreamer-plugin" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="adab6e390a1ba32c109d01c0cb65b430b907bf7756087ee045a178663f4e0f88" name="PackageKit-gstreamer-plugin" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="c0c47fd8df16b269046db33349b43bf4bbe10b3385ed7dcaecba6727d28053d8" name="PackageKit-gstreamer-plugin" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="15aba99ed1588032d7afd4c0e04d6019f042840c1ee3682c61aede8f0b2b24cc" name="PackageKit-gstreamer-plugin" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="fe8e3d969931a3d3d0d9f503725b744aaaa2b8511b619ef156e56e67125c2330" name="PackageKit-gtk3-module" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="36bda4ed9a819db6fda4ee05843dd9a333f4730f356ba379086528c2cc9d305d" name="PackageKit-gtk3-module" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="89e2a3fbb620953cc14ca8db100589940d17c8e4893adb8b1d9a5bc7791c91cb" name="PackageKit-gtk3-module" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="8da17828bd0a5c20a2e444685305afe476d727fe8201bb115097144854d36164" name="PackageKit-gtk3-module" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="3d2a67b2d0c5b464a33967496287982b4720dd3ceba6c24dde6dbedfd0336867" name="PackageKit-gtk3-module" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="f6c7f3fab73e092d33d910e70a2ccd32bc3b80f56838639573d40cf27fc7da24" name="PackageKit-gtk3-module" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="28ae7a1fa72acabec603188a5ebe18540dd6ffbad63d7c63dc3284607456bc14" name="PackageKit-gtk3-module" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="c6abb5b586a234de2fcaa26e04421d68df840923955ca5fd09ebfa8d21158fd1" name="PackageKit-gtk3-module" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="229ab73b9dd67a404a425d67f39b6a9afdf197f66ce29f2dd8bb5e56d79c2510" name="PackageKit-gtk3-module" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="a7bfae8478084caa660a51300e8f29f34c1b8517690b6dffba95dbe30d80b8fd" name="PackageKit-gtk3-module" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="c9651c420b743966c9c8ccb7a03a53553b7392ec1d40dc287722071e3db58cdd" name="PackageKit-gtk3-module" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="764a0894a7b577ee9f3659248f0081061d3598804b093723da22c9c31606e788" name="PackageKit-gtk3-module" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="b730553ee8bc61cb24b5a94f34233695f5ef0fc1aedd32fdf7caece6e4d2b0cf" name="PackageKit-lang" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="2bf77889cf9b27c0bb909373ab57e4982115da1297ada1eb42d0eb63640f9b2c" name="PackageKit-lang" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="9e2d280e9d93ad67dff5364a8d819edc57a6fa66ef86073432e1222b92914f33" name="PackageKit-lang" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="cfde0143f2b5d71dc8a2aa000c2b43107e788a3d475406319517f31839a174c2" name="SAPHanaSR" arch="noarch">
  <version epoch="0" ver="0.162.4" rel="150000.4.44.1"/>
  <changelog author="imanyugin@suse.com" date="1499342400">- Fix bsc#1045606: update man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1698926400">- Version bump to 0.162.2
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaTopology.7
    susCostOpt.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1706529600">- Version bump to 0.162.3
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * fix scope of variable 'site' to be global
    (bsc#1219194)
  * susChkSrv.py - relocate function logTimestamp()
  * update man pages:
    SAPHanaSR.7
    ocf_suse_SAPHana.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.162.4
  * unify global.ini examples
  * add demo script SAPHanaSR-upgrade-to-angi-demo
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7</changelog>
</package>
<package pkgid="43eb6fb753bd1990cc1f97c4964928053e1fc1a527de5a44078e979f3f2e6071" name="SAPHanaSR" arch="src">
  <version epoch="0" ver="0.162.4" rel="150000.4.44.1"/>
  <changelog author="imanyugin@suse.com" date="1499342400">- Fix bsc#1045606: update man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1698926400">- Version bump to 0.162.2
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaTopology.7
    susCostOpt.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1706529600">- Version bump to 0.162.3
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * fix scope of variable 'site' to be global
    (bsc#1219194)
  * susChkSrv.py - relocate function logTimestamp()
  * update man pages:
    SAPHanaSR.7
    ocf_suse_SAPHana.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.162.4
  * unify global.ini examples
  * add demo script SAPHanaSR-upgrade-to-angi-demo
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7</changelog>
</package>
<package pkgid="ad0a395c14e26b54b0ccd9e372f7c00c24b9c7606a09ce483c27ab2d402eb83c" name="SAPHanaSR-ScaleOut" arch="noarch">
  <version epoch="0" ver="0.185.3" rel="150000.45.1"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name server died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- add workaround for 'sapcontrol -function WaitforStopped'
  terminating to early.
  If the master name server dies and does not have a failover
  candidate but there are still running worker nodes the command
  'sapcontrol -function WaitforStopped' terminates to early and
  does not wait till all the remaining worker nodes are down.
  So the resource agent needs to wait during his 'stopSystem'
  function till the last "partial" node is down before returning
  a result to the cluster.
  (bsc#1196650)
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
  <changelog author="abriel@suse.com" date="1641816000">- change version to 0.181.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189532, bsc#1189533)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)
- add switch 'cib_access' to the SAPHanaSrMultiTarget hook to give
  control over the hook runtime.
  Default is 'all-on' which means there are 3 cib calls performed
  inside the hook script.
  Changing the value of 'cib_access' inside the global.ini file to
  'site-on' to perform the absolute minimum cib calls (only one)
  (bsc#1189540)</changelog>
  <changelog author="abriel@suse.com" date="1669723200">- Version bump to 0.184.1
  * add new HA/DR provider hook susChkSrv supporting a fast-dying
    indexserver
    (jsc#PED-1241, jsc#PED-1240)
  * add new HA/DR provider hook susTkOver for blocking manual
    takeovers
    (jsc#SLE-16347)
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix SAPHanaSR-replay-archive to handle hb_report archives again
    (bsc#1198897)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * add lost-nameserver-slave handling to SAPHanaTopology, to avoid
    toggeling SAPHanaController resource, if all nameserver-masters
    got lost.
    SAPHanaController keeps started, if WAITING4NODES event needs
    to be processed. This only keeps the resource "started".
    The SAP HANA instance will only be started, if enough nodes are
    available to fulfill the needs of the SAP HANA landscape.
  * add new tool SAPHanaSR-manageProvider to show, add and delete
    HA/DR provider sections in the global.ini of SAP HANA.
  * changes to the demote_clone function of the resource agent:
    if the role is '*:shtdown:shtdown:shtdown' (topology agent run
    into timeouts) the function fail with rc=1, to get the managed
    resource stopped
    changes to the stop_clone function of the topology agent:
    call landscapeHostConfiguration.py and set the roles as they
    were reported. If the command timed out, set the role to
    '*:shtdown:shtdown:shtdown' and return 1 to get the node
    fenced.
    The used timeout for the landscapeHostConfiguration.py call can
    be configured by the cluster action timeout, if needed. It will
    be 50% of the action timeout or the minimum of 300s.
    (bsc#1198127)
  * SAPHanaSRTools.pm: shows terminate node attribute too
  * change SAPHanaSR-manageAttr to support the different behaviour
    of 'crmadmin -qD' in different pacemaker versions
    (bsc#1200969)
  * fix HANA_CALL function to support MCOS environments again
    (bsc#1198780)
  * correct the order constraint in man page
    ocf_suse_SAPHanaTopology.7
    (bsc#1197239)</changelog>
  <changelog author="abriel@suse.com" date="1689249600">- Version bump to 0.185.0
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * fix the path for the HA/DR provider hook in the global.ini
    examples to be useful
    (bsc#1210573)
  * update man pages:
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1692964800">- Version bump to 0.185.1
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * modify /tmp full fix
    (bsc#1210728)
  * update man pages:
    SAPHanaSR-ScaleOut.7
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1702468800">- Version bump to 0.185.2
  * fix cluster state in SAPHanaSR-manageAttr by supporting the
    different behaviour of 'crmadmin -q -S' in different pacemaker
    versions
    (bsc#1217830)
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSrMultiTarget hook has successfully reported a
    SR event to the cluster a still existing fall-back state file
    will be removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaController.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.185.3
  * Fix the hexdump log for empty node states
  * Fix exception handling in function 'logTimestamp' of HA/DR
    provider SAPHanaSrMultiTarget.py (bsc#1218901)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR.py.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageProvider.8</changelog>
</package>
<package pkgid="c31b31fa0453ed8c11df97e3b2e756a396ea1878e24029248893af5f37fd6a22" name="SAPHanaSR-ScaleOut" arch="src">
  <version epoch="0" ver="0.185.3" rel="150000.45.1"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name server died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- add workaround for 'sapcontrol -function WaitforStopped'
  terminating to early.
  If the master name server dies and does not have a failover
  candidate but there are still running worker nodes the command
  'sapcontrol -function WaitforStopped' terminates to early and
  does not wait till all the remaining worker nodes are down.
  So the resource agent needs to wait during his 'stopSystem'
  function till the last "partial" node is down before returning
  a result to the cluster.
  (bsc#1196650)
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
  <changelog author="abriel@suse.com" date="1641816000">- change version to 0.181.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189532, bsc#1189533)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)
- add switch 'cib_access' to the SAPHanaSrMultiTarget hook to give
  control over the hook runtime.
  Default is 'all-on' which means there are 3 cib calls performed
  inside the hook script.
  Changing the value of 'cib_access' inside the global.ini file to
  'site-on' to perform the absolute minimum cib calls (only one)
  (bsc#1189540)</changelog>
  <changelog author="abriel@suse.com" date="1669723200">- Version bump to 0.184.1
  * add new HA/DR provider hook susChkSrv supporting a fast-dying
    indexserver
    (jsc#PED-1241, jsc#PED-1240)
  * add new HA/DR provider hook susTkOver for blocking manual
    takeovers
    (jsc#SLE-16347)
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix SAPHanaSR-replay-archive to handle hb_report archives again
    (bsc#1198897)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * add lost-nameserver-slave handling to SAPHanaTopology, to avoid
    toggeling SAPHanaController resource, if all nameserver-masters
    got lost.
    SAPHanaController keeps started, if WAITING4NODES event needs
    to be processed. This only keeps the resource "started".
    The SAP HANA instance will only be started, if enough nodes are
    available to fulfill the needs of the SAP HANA landscape.
  * add new tool SAPHanaSR-manageProvider to show, add and delete
    HA/DR provider sections in the global.ini of SAP HANA.
  * changes to the demote_clone function of the resource agent:
    if the role is '*:shtdown:shtdown:shtdown' (topology agent run
    into timeouts) the function fail with rc=1, to get the managed
    resource stopped
    changes to the stop_clone function of the topology agent:
    call landscapeHostConfiguration.py and set the roles as they
    were reported. If the command timed out, set the role to
    '*:shtdown:shtdown:shtdown' and return 1 to get the node
    fenced.
    The used timeout for the landscapeHostConfiguration.py call can
    be configured by the cluster action timeout, if needed. It will
    be 50% of the action timeout or the minimum of 300s.
    (bsc#1198127)
  * SAPHanaSRTools.pm: shows terminate node attribute too
  * change SAPHanaSR-manageAttr to support the different behaviour
    of 'crmadmin -qD' in different pacemaker versions
    (bsc#1200969)
  * fix HANA_CALL function to support MCOS environments again
    (bsc#1198780)
  * correct the order constraint in man page
    ocf_suse_SAPHanaTopology.7
    (bsc#1197239)</changelog>
  <changelog author="abriel@suse.com" date="1689249600">- Version bump to 0.185.0
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * fix the path for the HA/DR provider hook in the global.ini
    examples to be useful
    (bsc#1210573)
  * update man pages:
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1692964800">- Version bump to 0.185.1
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * modify /tmp full fix
    (bsc#1210728)
  * update man pages:
    SAPHanaSR-ScaleOut.7
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1702468800">- Version bump to 0.185.2
  * fix cluster state in SAPHanaSR-manageAttr by supporting the
    different behaviour of 'crmadmin -q -S' in different pacemaker
    versions
    (bsc#1217830)
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSrMultiTarget hook has successfully reported a
    SR event to the cluster a still existing fall-back state file
    will be removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaController.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.185.3
  * Fix the hexdump log for empty node states
  * Fix exception handling in function 'logTimestamp' of HA/DR
    provider SAPHanaSrMultiTarget.py (bsc#1218901)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR.py.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageProvider.8</changelog>
</package>
<package pkgid="d0f1804ce5c643f5638be76e4be4d3a44e9abce91b5b443d94637d1b8f0fd990" name="SAPHanaSR-ScaleOut-doc" arch="noarch">
  <version epoch="0" ver="0.185.3" rel="150000.45.1"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name server died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- add workaround for 'sapcontrol -function WaitforStopped'
  terminating to early.
  If the master name server dies and does not have a failover
  candidate but there are still running worker nodes the command
  'sapcontrol -function WaitforStopped' terminates to early and
  does not wait till all the remaining worker nodes are down.
  So the resource agent needs to wait during his 'stopSystem'
  function till the last "partial" node is down before returning
  a result to the cluster.
  (bsc#1196650)
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
  <changelog author="abriel@suse.com" date="1641816000">- change version to 0.181.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189532, bsc#1189533)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)
- add switch 'cib_access' to the SAPHanaSrMultiTarget hook to give
  control over the hook runtime.
  Default is 'all-on' which means there are 3 cib calls performed
  inside the hook script.
  Changing the value of 'cib_access' inside the global.ini file to
  'site-on' to perform the absolute minimum cib calls (only one)
  (bsc#1189540)</changelog>
  <changelog author="abriel@suse.com" date="1669723200">- Version bump to 0.184.1
  * add new HA/DR provider hook susChkSrv supporting a fast-dying
    indexserver
    (jsc#PED-1241, jsc#PED-1240)
  * add new HA/DR provider hook susTkOver for blocking manual
    takeovers
    (jsc#SLE-16347)
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix SAPHanaSR-replay-archive to handle hb_report archives again
    (bsc#1198897)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * add lost-nameserver-slave handling to SAPHanaTopology, to avoid
    toggeling SAPHanaController resource, if all nameserver-masters
    got lost.
    SAPHanaController keeps started, if WAITING4NODES event needs
    to be processed. This only keeps the resource "started".
    The SAP HANA instance will only be started, if enough nodes are
    available to fulfill the needs of the SAP HANA landscape.
  * add new tool SAPHanaSR-manageProvider to show, add and delete
    HA/DR provider sections in the global.ini of SAP HANA.
  * changes to the demote_clone function of the resource agent:
    if the role is '*:shtdown:shtdown:shtdown' (topology agent run
    into timeouts) the function fail with rc=1, to get the managed
    resource stopped
    changes to the stop_clone function of the topology agent:
    call landscapeHostConfiguration.py and set the roles as they
    were reported. If the command timed out, set the role to
    '*:shtdown:shtdown:shtdown' and return 1 to get the node
    fenced.
    The used timeout for the landscapeHostConfiguration.py call can
    be configured by the cluster action timeout, if needed. It will
    be 50% of the action timeout or the minimum of 300s.
    (bsc#1198127)
  * SAPHanaSRTools.pm: shows terminate node attribute too
  * change SAPHanaSR-manageAttr to support the different behaviour
    of 'crmadmin -qD' in different pacemaker versions
    (bsc#1200969)
  * fix HANA_CALL function to support MCOS environments again
    (bsc#1198780)
  * correct the order constraint in man page
    ocf_suse_SAPHanaTopology.7
    (bsc#1197239)</changelog>
  <changelog author="abriel@suse.com" date="1689249600">- Version bump to 0.185.0
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * fix the path for the HA/DR provider hook in the global.ini
    examples to be useful
    (bsc#1210573)
  * update man pages:
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1692964800">- Version bump to 0.185.1
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * modify /tmp full fix
    (bsc#1210728)
  * update man pages:
    SAPHanaSR-ScaleOut.7
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1702468800">- Version bump to 0.185.2
  * fix cluster state in SAPHanaSR-manageAttr by supporting the
    different behaviour of 'crmadmin -q -S' in different pacemaker
    versions
    (bsc#1217830)
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSrMultiTarget hook has successfully reported a
    SR event to the cluster a still existing fall-back state file
    will be removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaController.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.185.3
  * Fix the hexdump log for empty node states
  * Fix exception handling in function 'logTimestamp' of HA/DR
    provider SAPHanaSrMultiTarget.py (bsc#1218901)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR.py.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageProvider.8</changelog>
</package>
<package pkgid="43d7e0b632411e6e0bfe04ed9cb80055d4c03d61981f6b66ad27f7fd879c3a6e" name="SAPHanaSR-angi" arch="noarch">
  <version epoch="0" ver="1.2.7" rel="150500.3.9.1"/>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1681732800">- New package name and new version 1.001.4
  * New package SAPHanaSR-angi
    SAP HANA System Replication - A New Generation Interface
    (jsc#PED-6402)
  * support SAPHana ScaleUp and ScaleOut environments with one
    set of resource agents
- conflicting with the 'old' packages SAPHanaSR and
  SAPHanaSR-ScaleOut
- old changelog entries preserved for history reasons as
  SAPHanaSR-angi is based on all these changes.</changelog>
  <changelog author="abriel@suse.com" date="1688558400">- Version bump to 1.001.5
  * package is still in status 'technical preview'
  * add support for SAPHana ScaleOut environments without standby
    nodes
  * starting to rewrite SAPHanaSR tools from bash to python.
    SAPHanaSR-showAttr and SAPHanaSR-replay-archive
    The name of the tools is not changed by this action, but there
    are some improvements in functionality. See the man pages for
    details.
    The tools SAPHanaSR-monitor and SAPHanaSR-filter are deprecated.
    The classic version of these tools is still shipped in the
    package side-by-side to the rewritten and more powerful
    tools in /usr/bin. Their name is suffixed by '-legacy'.
    The classic version of the tools is deprecated and will be
    removed in a later package update.</changelog>
  <changelog author="fabian.herschel@suse.com" date="1691496000">- Version bump to 1.2.0
  * SAPHanaFilesystem RA added (poc status)</changelog>
  <changelog author="abriel@suse.com" date="1702641600">- Version bump to 1.2.3
  * package is still in status 'technical preview'
  * SAPHanaFilesystem RA has still POC status
  * add parameter 'ON_FAIL_ACTION' to SAPHanaFilesystem RA (POC)
  * improve the usage of SAP virtual hostnames
  * if the susHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * SAPHanaController: change default stop timeout from 3600 to 600
  * SAPHanaController: change default promote timeout from 3600 to
    900
  * try to make set_ and get_hana_attribute function more reliable
    by monitoring the result of the crm_attribute calls
  * fix typo in example srHook/global.ini_susHanaSR
  * fix missing trace section in example srHook/global.ini_susChkSrv
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susTkOver.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 1.2.7
  * package SAPHanaSR-angi and SAPHanaFilesystem RA are now
    in state 'supported'
  * add feature HANA 'FAST-STOP' and parameter 'ON_FAIL_ACTION'
  * new demo script SAPHanaSR-upgrade-to-angi-demo
  * added crm config examples
  * susHanaSR.py adapt syntax
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * susChkSrv.py - relocate function logTimestamp()
  * susHanaSR.py - catch possible I/O error
  * security improvements
    (bsc#1218696, bsc#1218698 and bsc#1218699)
  * remove instance parameter "REMOVE_SAP_SOCKETS", no longer
    supported
  * add detailed timing log messages for runtime information
  * add cache/live value optimization
  * new man page:
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-replay-archive.8</changelog>
</package>
<package pkgid="018c692ad22e0691d93dad0b46e98b28ff901c4059e1f6f8395dc9039dd490e2" name="SAPHanaSR-angi" arch="src">
  <version epoch="0" ver="1.2.7" rel="150500.3.9.1"/>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1681732800">- New package name and new version 1.001.4
  * New package SAPHanaSR-angi
    SAP HANA System Replication - A New Generation Interface
    (jsc#PED-6402)
  * support SAPHana ScaleUp and ScaleOut environments with one
    set of resource agents
- conflicting with the 'old' packages SAPHanaSR and
  SAPHanaSR-ScaleOut
- old changelog entries preserved for history reasons as
  SAPHanaSR-angi is based on all these changes.</changelog>
  <changelog author="abriel@suse.com" date="1688558400">- Version bump to 1.001.5
  * package is still in status 'technical preview'
  * add support for SAPHana ScaleOut environments without standby
    nodes
  * starting to rewrite SAPHanaSR tools from bash to python.
    SAPHanaSR-showAttr and SAPHanaSR-replay-archive
    The name of the tools is not changed by this action, but there
    are some improvements in functionality. See the man pages for
    details.
    The tools SAPHanaSR-monitor and SAPHanaSR-filter are deprecated.
    The classic version of these tools is still shipped in the
    package side-by-side to the rewritten and more powerful
    tools in /usr/bin. Their name is suffixed by '-legacy'.
    The classic version of the tools is deprecated and will be
    removed in a later package update.</changelog>
  <changelog author="fabian.herschel@suse.com" date="1691496000">- Version bump to 1.2.0
  * SAPHanaFilesystem RA added (poc status)</changelog>
  <changelog author="abriel@suse.com" date="1702641600">- Version bump to 1.2.3
  * package is still in status 'technical preview'
  * SAPHanaFilesystem RA has still POC status
  * add parameter 'ON_FAIL_ACTION' to SAPHanaFilesystem RA (POC)
  * improve the usage of SAP virtual hostnames
  * if the susHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * SAPHanaController: change default stop timeout from 3600 to 600
  * SAPHanaController: change default promote timeout from 3600 to
    900
  * try to make set_ and get_hana_attribute function more reliable
    by monitoring the result of the crm_attribute calls
  * fix typo in example srHook/global.ini_susHanaSR
  * fix missing trace section in example srHook/global.ini_susChkSrv
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susTkOver.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 1.2.7
  * package SAPHanaSR-angi and SAPHanaFilesystem RA are now
    in state 'supported'
  * add feature HANA 'FAST-STOP' and parameter 'ON_FAIL_ACTION'
  * new demo script SAPHanaSR-upgrade-to-angi-demo
  * added crm config examples
  * susHanaSR.py adapt syntax
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * susChkSrv.py - relocate function logTimestamp()
  * susHanaSR.py - catch possible I/O error
  * security improvements
    (bsc#1218696, bsc#1218698 and bsc#1218699)
  * remove instance parameter "REMOVE_SAP_SOCKETS", no longer
    supported
  * add detailed timing log messages for runtime information
  * add cache/live value optimization
  * new man page:
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-replay-archive.8</changelog>
</package>
<package pkgid="802afcce56204075ebe63de3faee067c32a55a1742d6e61330b317bd518099f6" name="SAPHanaSR-angi" arch="noarch">
  <version epoch="0" ver="1.2.9" rel="150500.3.12.2"/>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1681732800">- New package name and new version 1.001.4
  * New package SAPHanaSR-angi
    SAP HANA System Replication - A New Generation Interface
    (jsc#PED-6402)
  * support SAPHana ScaleUp and ScaleOut environments with one
    set of resource agents
- conflicting with the 'old' packages SAPHanaSR and
  SAPHanaSR-ScaleOut
- old changelog entries preserved for history reasons as
  SAPHanaSR-angi is based on all these changes.</changelog>
  <changelog author="abriel@suse.com" date="1688558400">- Version bump to 1.001.5
  * package is still in status 'technical preview'
  * add support for SAPHana ScaleOut environments without standby
    nodes
  * starting to rewrite SAPHanaSR tools from bash to python.
    SAPHanaSR-showAttr and SAPHanaSR-replay-archive
    The name of the tools is not changed by this action, but there
    are some improvements in functionality. See the man pages for
    details.
    The tools SAPHanaSR-monitor and SAPHanaSR-filter are deprecated.
    The classic version of these tools is still shipped in the
    package side-by-side to the rewritten and more powerful
    tools in /usr/bin. Their name is suffixed by '-legacy'.
    The classic version of the tools is deprecated and will be
    removed in a later package update.</changelog>
  <changelog author="fabian.herschel@suse.com" date="1691496000">- Version bump to 1.2.0
  * SAPHanaFilesystem RA added (poc status)</changelog>
  <changelog author="abriel@suse.com" date="1702641600">- Version bump to 1.2.3
  * package is still in status 'technical preview'
  * SAPHanaFilesystem RA has still POC status
  * add parameter 'ON_FAIL_ACTION' to SAPHanaFilesystem RA (POC)
  * improve the usage of SAP virtual hostnames
  * if the susHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * SAPHanaController: change default stop timeout from 3600 to 600
  * SAPHanaController: change default promote timeout from 3600 to
    900
  * try to make set_ and get_hana_attribute function more reliable
    by monitoring the result of the crm_attribute calls
  * fix typo in example srHook/global.ini_susHanaSR
  * fix missing trace section in example srHook/global.ini_susChkSrv
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susTkOver.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 1.2.7
  * package SAPHanaSR-angi and SAPHanaFilesystem RA are now
    in state 'supported'
    (jsc#PED-6403)
  * add feature HANA 'FAST-STOP' and parameter 'ON_FAIL_ACTION'
    (jsc#SAPSOL-133)
  * new demo script SAPHanaSR-upgrade-to-angi-demo
  * added crm config examples
  * susHanaSR.py adapt syntax
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * susChkSrv.py - relocate function logTimestamp()
  * susHanaSR.py - catch possible I/O error
  * security improvements
    (bsc#1218696, bsc#1218698 and bsc#1218699)
  * remove instance parameter "REMOVE_SAP_SOCKETS", no longer
    supported
  * add detailed timing log messages for runtime information
  * add cache/live value optimization
  * new man page:
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-replay-archive.8</changelog>
  <changelog author="abriel@suse.com" date="1730894400">- Version bump to 1.2.9
  * add SAPHanaSR-alert-fencing, an alert agent for cluster fencing
    alerts.
  * enhance SAPHanaController with the feature ON_FAIL_ACTION=fence
    This is part of the 'FAST-STOP' feature of the resource agents.
    (jsc#SAPSOL-196)
  * Improve handling of timeout return values for the resource
    agents
  * SAPHanaSR-showAttr - adding new option 'sitelist' and new
    output format 'csv' and 'cache'
  * new man page:
    SAPHanaSR-angi-scenarios.7
    SAPHanaSR-alert-fencing.8
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaController-scale-up.7
    SAPHanaController-scale-out.7
    SAPHanaTopology.7
    SAPHanaFilesystem.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    susChkSrv.py.7
    susCostOpt.py.7
    SAPHanaSR-showAttr.8
- add additional requires for SLE16
  /usr/bin/sudo and /usr/bin/logger</changelog>
</package>
<package pkgid="8df139a961d0cb77202418f3713d0cdc22507a405338a176a62c97cdf5835876" name="SAPHanaSR-angi" arch="src">
  <version epoch="0" ver="1.2.9" rel="150500.3.12.2"/>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1681732800">- New package name and new version 1.001.4
  * New package SAPHanaSR-angi
    SAP HANA System Replication - A New Generation Interface
    (jsc#PED-6402)
  * support SAPHana ScaleUp and ScaleOut environments with one
    set of resource agents
- conflicting with the 'old' packages SAPHanaSR and
  SAPHanaSR-ScaleOut
- old changelog entries preserved for history reasons as
  SAPHanaSR-angi is based on all these changes.</changelog>
  <changelog author="abriel@suse.com" date="1688558400">- Version bump to 1.001.5
  * package is still in status 'technical preview'
  * add support for SAPHana ScaleOut environments without standby
    nodes
  * starting to rewrite SAPHanaSR tools from bash to python.
    SAPHanaSR-showAttr and SAPHanaSR-replay-archive
    The name of the tools is not changed by this action, but there
    are some improvements in functionality. See the man pages for
    details.
    The tools SAPHanaSR-monitor and SAPHanaSR-filter are deprecated.
    The classic version of these tools is still shipped in the
    package side-by-side to the rewritten and more powerful
    tools in /usr/bin. Their name is suffixed by '-legacy'.
    The classic version of the tools is deprecated and will be
    removed in a later package update.</changelog>
  <changelog author="fabian.herschel@suse.com" date="1691496000">- Version bump to 1.2.0
  * SAPHanaFilesystem RA added (poc status)</changelog>
  <changelog author="abriel@suse.com" date="1702641600">- Version bump to 1.2.3
  * package is still in status 'technical preview'
  * SAPHanaFilesystem RA has still POC status
  * add parameter 'ON_FAIL_ACTION' to SAPHanaFilesystem RA (POC)
  * improve the usage of SAP virtual hostnames
  * if the susHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * SAPHanaController: change default stop timeout from 3600 to 600
  * SAPHanaController: change default promote timeout from 3600 to
    900
  * try to make set_ and get_hana_attribute function more reliable
    by monitoring the result of the crm_attribute calls
  * fix typo in example srHook/global.ini_susHanaSR
  * fix missing trace section in example srHook/global.ini_susChkSrv
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susTkOver.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 1.2.7
  * package SAPHanaSR-angi and SAPHanaFilesystem RA are now
    in state 'supported'
    (jsc#PED-6403)
  * add feature HANA 'FAST-STOP' and parameter 'ON_FAIL_ACTION'
    (jsc#SAPSOL-133)
  * new demo script SAPHanaSR-upgrade-to-angi-demo
  * added crm config examples
  * susHanaSR.py adapt syntax
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * susChkSrv.py - relocate function logTimestamp()
  * susHanaSR.py - catch possible I/O error
  * security improvements
    (bsc#1218696, bsc#1218698 and bsc#1218699)
  * remove instance parameter "REMOVE_SAP_SOCKETS", no longer
    supported
  * add detailed timing log messages for runtime information
  * add cache/live value optimization
  * new man page:
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-replay-archive.8</changelog>
  <changelog author="abriel@suse.com" date="1730894400">- Version bump to 1.2.9
  * add SAPHanaSR-alert-fencing, an alert agent for cluster fencing
    alerts.
  * enhance SAPHanaController with the feature ON_FAIL_ACTION=fence
    This is part of the 'FAST-STOP' feature of the resource agents.
    (jsc#SAPSOL-196)
  * Improve handling of timeout return values for the resource
    agents
  * SAPHanaSR-showAttr - adding new option 'sitelist' and new
    output format 'csv' and 'cache'
  * new man page:
    SAPHanaSR-angi-scenarios.7
    SAPHanaSR-alert-fencing.8
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaController-scale-up.7
    SAPHanaController-scale-out.7
    SAPHanaTopology.7
    SAPHanaFilesystem.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    susChkSrv.py.7
    susCostOpt.py.7
    SAPHanaSR-showAttr.8
- add additional requires for SLE16
  /usr/bin/sudo and /usr/bin/logger</changelog>
</package>
<package pkgid="56796144e77787eaec40627a45b56338fc3f2ede6f97eb98d38683f8cf49d043" name="SAPHanaSR-doc" arch="noarch">
  <version epoch="0" ver="0.162.4" rel="150000.4.44.1"/>
  <changelog author="imanyugin@suse.com" date="1499342400">- Fix bsc#1045606: update man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1698926400">- Version bump to 0.162.2
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaTopology.7
    susCostOpt.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1706529600">- Version bump to 0.162.3
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * fix scope of variable 'site' to be global
    (bsc#1219194)
  * susChkSrv.py - relocate function logTimestamp()
  * update man pages:
    SAPHanaSR.7
    ocf_suse_SAPHana.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.162.4
  * unify global.ini examples
  * add demo script SAPHanaSR-upgrade-to-angi-demo
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7</changelog>
</package>
<package pkgid="ac74198ca85ea27504297d47ef0cc9076f2ed5b0c70ad26eb330a8e55612fcb0" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.3.1"/>
  <changelog author="mgorse@suse.com" date="1692619200">- Update to version 2.41.91:
  + Properly handle toplevel window state changes in GTK4.
  + Do not keep processing frames while the view is unrealized
    when using DMA-BUF renderer.
  + Fallback to first render node returned by DRM when failing to
    get using EGLDevice.
  + Fix the build with libjxl &lt; 0.7.0.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
</package>
<package pkgid="cd65cabda6c6d064e57735912506836619ed033d1c8b0d615281dafda4d0513a" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.6.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
</package>
<package pkgid="51bfdd91c4dbe130fcd2abf23a5d91ca58871ecfd7f583b6eea4d2f4eb8ddfd4" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.3" rel="150600.12.9.1"/>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
</package>
<package pkgid="f402fb459061e9c6f49e6a9d8e9fce54453b3d35f68fd5750413eb420562ae44" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.0" rel="150600.12.12.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558, CVE-2024-27838, CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
</package>
<package pkgid="2a46b59e7898c652fd86b44286d09e47dcfb37cc52bbdb2424e0aa544a3d8791" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.3" rel="150600.12.16.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558, CVE-2024-27838, CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
</package>
<package pkgid="f6641ecd3f79b17823293b1929934167977c36d36f083f35cb7adaa34ad4a994" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.3" rel="150600.12.21.1"/>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
</package>
<package pkgid="66357789d77c102e20d261f724e311304ee86c8bffd6820b3140d2114debb37f" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.3.1"/>
  <changelog author="mgorse@suse.com" date="1692619200">- Update to version 2.41.91:
  + Properly handle toplevel window state changes in GTK4.
  + Do not keep processing frames while the view is unrealized
    when using DMA-BUF renderer.
  + Fallback to first render node returned by DRM when failing to
    get using EGLDevice.
  + Fix the build with libjxl &lt; 0.7.0.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
</package>
<package pkgid="2218e37ef2e90042f169d97d09d1079baed15e059599919c124a57e5c41ba3df" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.6.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
</package>
<package pkgid="3ae29990e655778908f431d27d8d0cf897f9ef8d7d400a8f7ad85cb021b137dd" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.44.3" rel="150600.12.9.1"/>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
</package>
<package pkgid="b6f285b9f078955078877649a26c60aec4bc32e85bd8859046c95b092dc69f89" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.46.0" rel="150600.12.12.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558, CVE-2024-27838, CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
</package>
<package pkgid="f1b7395bae575912beefb4c287368343ec686678b850895c3943c74dd2012a07" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.46.3" rel="150600.12.16.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558, CVE-2024-27838, CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
</package>
<package pkgid="74f69a31251856a6265bfaabafc6cb867f62bb34abedcf1f3131028d826adeb0" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.46.3" rel="150600.12.21.1"/>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
</package>
<package pkgid="677bf4943eca1e2577223e6deba0c46ea7051e153a0b3a0d7347d1d2760b2b7e" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.3.1"/>
  <changelog author="mgorse@suse.com" date="1692619200">- Update to version 2.41.91:
  + Properly handle toplevel window state changes in GTK4.
  + Do not keep processing frames while the view is unrealized
    when using DMA-BUF renderer.
  + Fallback to first render node returned by DRM when failing to
    get using EGLDevice.
  + Fix the build with libjxl &lt; 0.7.0.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
</package>
<package pkgid="519ac4f28accd5ccf971952f4e91b3074a3efe3a8b6e781ed031a0094c4c1a88" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.6.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
</package>
<package pkgid="2ea4c2dffe3ecf4ef13365f4136f83dc0b38749c6bc643298c61c20c7e9b4cc6" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.3" rel="150600.12.9.1"/>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
</package>
<package pkgid="7ebc92874f171f5a47e926f02b5ef3b0fdd6bd408003aeb461aa80742f3f260c" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.0" rel="150600.12.12.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558, CVE-2024-27838, CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
</package>
<package pkgid="3cc150d1107dc946ce95436bf3a8040939e1dbc5f215d7cac3e7904f476766cc" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.3" rel="150600.12.16.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558, CVE-2024-27838, CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
</package>
<package pkgid="7312685c5425dc1fd9356785f3538a08bda7bba983535cb0975887d091b7d8f7" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.3" rel="150600.12.21.1"/>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
</package>
<package pkgid="bd9492cd906dbf1d084580582422926baf8bd3659d4e347b8808635a03439891" name="aaa_base" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="b0535694a32366f93830f23822c77f7744792780621a2e8bb701ac6e9e770a6c" name="aaa_base" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="9338bc325b60e59b7a48492a7ffd6e7e302ba111ed0ee369bd67e9c4fb6c488f" name="aaa_base" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="862585b96b291271b7c68f130ab3ab75afc51eac570e5afff94270572a767130" name="aaa_base" arch="src">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="520a1a79da52c509673b5dff77405c93ff366e30912447d842d78c4a46fb3007" name="aaa_base" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="cc0a564104b1d93aff9b72f24c88175f500b5b3b4385e84dcc66e693a419c1a0" name="aaa_base" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="2245fa71807300a2153cddf948bceea291c7047d35bcb767e1fe037195cbe1c5" name="aaa_base" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="e65a213fd3e276ff937ec6e445dceaa8d400f038a51bb2b5d9dce4dca65c4814" name="aaa_base" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="c3d59ea176e6b9d7d3c8ea3902cbb173c9c27d3a9b6c3d8e8ea70648276fc5b4" name="aaa_base" arch="src">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="4dc19ec312ad01256d8abcc29ce141139c5a891f655e7d8fe6d181483f7fdcea" name="aaa_base" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="a02632e83d4aabbbda31919d1eab94df6857a3a1256c23312bbbee119897fa53" name="aaa_base-extras" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="0db0504c8c2911422db2fbcbfbd5d4958c333e4b2b85d30e315354d3ad425efd" name="aaa_base-extras" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="d817c2abee0c17c40110a0d91731452b21c9191aaadaaeff8228ec14362ef531" name="aaa_base-extras" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="e0ea28605bac277e348893eb71276b605568a6816e49a46e7ad11e2d9829ee6c" name="aaa_base-extras" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="c76ea85bd6311824975b3c4cb1c2aa25eb073dabfb00bb13366805ca479136db" name="aaa_base-extras" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="728fd6c12225eb329552425b6d258ef669470069654f39ae1164672615abe813" name="aaa_base-extras" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="d0286fecce1ac873cf6267fa530239090b0387f916f1ab95b4501946ebd48927" name="aaa_base-extras" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="e7b307e26aac6c348983703eb372f994d2be7d4e912028d8ac6267c48b91f906" name="aaa_base-extras" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="ec21a45a7bcb9cf8f1eb14ec5732dde579d52bd1fd22178fe0bd7bc8f15d540b" name="aaa_base-malloccheck" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="534987043fe1e7f9d970edf0c77d39fe0ca252961ef11db407b5c2389d7cd644" name="aaa_base-malloccheck" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="80a97f41c2c270de1f21bbb60939a4af12524cc25bc006b49fdab7af02a43809" name="aaa_base-malloccheck" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="4703a2799fe2f72fae2383fb53f566de046649061b60852c8610a2330d91a163" name="aaa_base-malloccheck" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="b25322920a733a10ff0d401df951307ad9c1c116922270a03a871a07516d023f" name="aaa_base-malloccheck" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="72fc2a2cb764313026094059399139fcbdcdacc99afb82ce88db3c26dfb51d56" name="aaa_base-malloccheck" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="530b3a05436b911f4d8edfc411014904e84fa59d422aaa8c75279ecb1a0efba1" name="aaa_base-malloccheck" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="24773bbf44a07db15a6ad2c5a7ef13f6fa2b962c3c033de25f363f5bd1b20b38" name="aaa_base-malloccheck" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="45764b49fe8a507fee4731946d4fec905e44f6293ed0b390f7f714d603374e31" name="aaa_base-wsl" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="11f91458b43459142414113a87e3e313265cdf0ebad4e0685efe536d3f494ef9" name="aaa_base-wsl" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="424150c0321234070da1bf198a144ae983b2f56b63a8230beb1ad8d334a61f07" name="aaa_base-wsl" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="b2542ad8fff7527a59c661537f3c76983058a0d4b4a564d389df2ae1d2efe188" name="aaa_base-wsl" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="2933cbb7f76ec18a1f163ad3915a440d7c7dd21bb0a76d7cb230eec0bb97df62" name="aaa_base-wsl" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="eb9703dabff90c17d130c55969bd10c73ed1a4bfe2e409cdada5e73f61be268c" name="aaa_base-wsl" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="65eaebf042553b69f79405993362dc8d260333b7cd9d0931440b1a6f5dc6d061" name="aaa_base-wsl" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="1831d96a2394f3d13422ee2e68023c8575312492b92b8b9f786a0cd32e9d2566" name="aaa_base-wsl" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="02cefa13a9c016190a4b2da88da1ea59d5c045fc52e5f2e79190a03fabbf2837" name="aardvark-dns" arch="aarch64">
  <version epoch="0" ver="1.11.0" rel="150500.3.6.1"/>
  <changelog author="danish.prakash@suse.com" date="1676376000">- First version of aardvark-dns</changelog>
  <changelog author="danish.prakash@suse.com" date="1679054400">- Fix libexecdir issue on Leap and SLE</changelog>
  <changelog author="danish.prakash@suse.com" date="1681300800">- Update to version 1.6.0:
  * v1.6.0 release
  * Update release notes for v1.6.0
  * fix(deps): update rust crate tokio to 1.27.0
  * use lower TTL for contianer entries
  * fix(deps): update rust crate syslog to ^6.0.1
  * fix(deps): update rust crate futures-util to 0.3.28
  * chore(deps): update dependency containers/automation_images to v20230330
  * Disable Dependabot in favor of Renovate
  * chore(deps): update dependency containers/automation_images to v20230320
  * build(deps): bump futures-util from 0.3.26 to 0.3.27
  * [CI:BUILD] Packit: trigger builds on commit to main branch
  * build(deps): bump anyhow from 1.0.68 to 1.0.70
  * fix lint issue with new rust version 1.68
  * Cirrus: Update to newer CI VM images
  * build(deps): bump chrono from 0.4.23 to 0.4.24
  * build(deps): bump libc from 0.2.139 to 0.2.140
  * build(deps): bump async-broadcast from 0.5.0 to 0.5.1
  * build(deps): bump signal-hook from 0.3.14 to 0.3.15
  * build(deps): bump futures-util from 0.3.25 to 0.3.26
  * build(deps): bump tokio from 1.25.0 to 1.26.0
  * [CI:DOCS] Clarify packit related comments
  * [CI:BUILD] Packit: initial enablement
  * Allow custom cargo binary path
  * Switch to explicit platform list for `cargo vendor-filterer`
  * bump to v1.6.0-dev
  * Add renovate.json5
  * Cirrus: Groom rust cache before updating</changelog>
  <changelog author="danish.prakash@suse.com" date="1688385600">- Update to version 1.7.0:
  * release v1.7.0
  * Update release notes for v1.7.0
  * fix(deps): update rust crate tokio to 1.29.0
  * fix(deps): update rust crate clap to 4.3.8
  * fix(deps): update rust crate clap to 4.3.5
  * run cargo update
  * [CI:BUILD] Packit: add Fedora downstream tasks
  * fix(deps): update rust crate clap to 4.3.4
  * chore(deps): update dependency containers/automation_images to v20230614
  * fix(deps): update rust crate clap to 4.3.3
  * fix(deps): update rust crate log to 0.4.19
  * fix(deps): update rust crate clap to 4.3.2
  * fix(deps): update rust crate clap to 4.3.1
  * cirrus: remove verify_vendor task
  * chore(deps): update dependency containers/automation_images to v20230601
  * fix(deps): update rust crate trust-dns-server to 0.22.1
  * chore(deps): update rust crate chrono to 0.4.26
  * fix(deps): update rust crate tokio to 1.28.2
  * fix(deps): update rust crate log to 0.4.18
  * chore(deps): update rust crate chrono to 0.4.25
  * fix(deps): update rust crate clap to 4.3.0
  * chore(deps): update dependency containers/automation_images to v20230517
  * fix(deps): update rust crate tokio to 1.28.1
  * chore(deps): update dependency containers/automation_images to v20230426
  * fix(deps): update rust crate clap to 4.2.7
  * fix(deps): update rust crate anyhow to 1.0.71
  * fix typo in makefile
  * fix(deps): update rust crate tokio to 1.28.0
  * fix(deps): update rust crate clap to 4.2.5
  * fix(deps): update rust crate syslog to ^6.1.0
  * fix(deps): update rust crate clap to 4.2.4
  * fix(deps): update rust crate clap to 4.2.3
  * fix(deps): update rust crate clap to v4
  * chore(deps): update dependency containers/automation_images to v20230405
  * bump to v1.7.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1689076800">- Disable restricting builds only for tier1 platforms
  i.e. only for x86_64 and aarch64 and enable for all.</changelog>
  <changelog author="danish.prakash@suse.com" date="1695902400">- Update to version 1.8.0:
  * Release v1.8.0
  * update release notes for v1.8.0
  * run cargo update
  * Packit: switch to @containers/packit-build team for copr failure notification comments
  * [CI:BUILD] Packit: tag @lsm5 on copr build failures
  * chore(deps): update rust crate chrono to 0.4.31
  * cargo: bump chrono to 0.4.30
  * test: IPv6 format is changed in v1.72.0
  * bump nix to 0.27.1
  * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0
  * fix(deps): update rust crate trust-dns-server to 0.23.0
  * [CI:BUILD] rpm: spdx compatible license field
  * fix(deps): update rust crate anyhow to 1.0.75
  * fix(deps): update rust crate tokio to 1.32.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * fix(deps): update rust crate tokio to 1.31.0
  * fix(deps): update rust crate anyhow to 1.0.74
  * fix(deps): update rust crate anyhow to 1.0.73
  * fix(deps): update rust crate log to 0.4.20
  * chore(deps): update dependency containers/automation_images to v20230809
  * fix(deps): update rust crate tokio to 1.30.0
  * fix(deps): update rust crate clap to 4.3.21
  * packit: Build PRs into default packit COPRs
  * chore(deps): update dependency containers/automation_images to v20230807
  * fix(deps): update rust crate anyhow to 1.0.72
  * fix(deps): update rust crate signal-hook to 0.3.17
  * fix(deps): update rust crate clap to 4.3.19
  * fix(deps): update rust crate clap to 4.3.15
  * fix(deps): update rust crate signal-hook to 0.3.16
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update rust crate clap to 4.3.11
  * fix(deps): update rust crate tokio to 1.29.1
  * fix(deps): update rust crate clap to 4.3.10
  * [CI:BUILD] RPM: cleanup spec and fix eln builds
  * bump to v1.8.0-devel</changelog>
  <changelog author="danish.prakash@suse.com" date="1701345600">- Update to version 1.9.0:
  * Release v1.9.0
  * v1.9.0 Update release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20231116
  * fix(deps): update rust crate tokio to 1.34.0
  * fix(deps): update rust crate async-broadcast to 0.6.0
  * update trust-dns to hickory
  * fix(deps): update rust crate futures-util to 0.3.29
  * fix(deps): update rust crate trust-dns-server to 0.23.2
  * fix(deps): update rust crate trust-dns-proto to 0.23.2
  * tmt: initial enablement
  * aardvark main: change error reporting
  * chore(deps): update dependency containers/automation_images to v20231004
  * fix(deps): update rust crate trust-dns-proto to 0.23.1
  * fix(deps): update rust crate trust-dns-client to 0.23.1
  * clippy: some format fixes
  * fix(deps): update rust crate tokio to 1.33.0
  * Bump to v1.9.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1706184000">- Update to version 1.10.0:
  * Release 1.10.0
  * Release notes for 1.10.0
  * chore(deps): update rust crate chrono to 0.4.32
  * chore(deps): update dependency containers/automation_images to v20240102
  * fix(deps): update rust crate futures-util to 0.3.30
  * fix(deps): update rust crate anyhow to 1.0.79
  * fix(deps): update rust crate tokio to 1.35.1
  * chore(deps): update dependency containers/automation_images to v20231208
  * fix(deps): update rust crate tokio to 1.35.0
  * fix duplicated IP CI flake
  * server: remove unused kill switch
  * fix(deps): update rust crate clap to ~4.4.10
  * Bump working version to v1.10.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1717416000">- Remove redundant source: cargo_config
- Update to version 1.11.0:
  * Release v1.11.0
  * v1.11.0 release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20240529
  * Internal networks cannot make external DNS requests
  * fix(deps): update rust crate anyhow to 1.0.86
  * fix(deps): update rust crate nix to 0.29.0
  * [skip-ci] RPM: use default __cargo macro across all envs
  * chore(deps): update dependency containers/automation_images to v20240513
  * fix(deps): update rust crate anyhow to 1.0.83
  * [skip-ci] Packit: separate `packages` key for rhel jobs
  * fix(deps): update rust crate libc to 0.2.154
  * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync
  * [skip-ci] Packit: Remove EL8 jobs
  * fix(deps): update rust crate syslog to ^6.1.1
  * fix reverse ipv6 lookup test flake
  * fix(deps): update hickory-dns monorepo to 0.24.1
  * chore(deps): update rust crate chrono to 0.4.38
  * Don't tear down all server threads on SIGHUP (bsc#1224167)
  * fix(deps): update rust crate anyhow to 1.0.82
  * fix(deps): update rust crate tokio to 1.37.0
  * Update to nix-0.28.0
  * update chrono package
  * chore(deps): update dependency containers/automation_images to v20240320
  * fix(deps): update rust crate anyhow to 1.0.81
  * tests: check queried domain name in reverse lookup tests
  * fix: set name for answers in reverse lookups
  * chore: fix typo in runner script
  * chore: fix log message when doing reverse lookup
  * fix(deps): update rust crate log to 0.4.21
  * fix(deps): update rust crate anyhow to 1.0.80
  * chore(deps): update rust crate chrono to 0.4.34
  * fix(deps): update rust crate async-broadcast to 0.7.0
  * fix(deps): update rust crate tokio to 1.36.0
  * [CI:DOCS] Packit: disable bodhi tasks
  * chore(deps): update rust crate chrono to 0.4.33
  * Bump to 1.11.0-dev</changelog>
</package>
<package pkgid="f88306473701582ef4a5ec91a887f49239797094cb2b804a711733b55779b65f" name="aardvark-dns" arch="ppc64le">
  <version epoch="0" ver="1.11.0" rel="150500.3.6.1"/>
  <changelog author="danish.prakash@suse.com" date="1676376000">- First version of aardvark-dns</changelog>
  <changelog author="danish.prakash@suse.com" date="1679054400">- Fix libexecdir issue on Leap and SLE</changelog>
  <changelog author="danish.prakash@suse.com" date="1681300800">- Update to version 1.6.0:
  * v1.6.0 release
  * Update release notes for v1.6.0
  * fix(deps): update rust crate tokio to 1.27.0
  * use lower TTL for contianer entries
  * fix(deps): update rust crate syslog to ^6.0.1
  * fix(deps): update rust crate futures-util to 0.3.28
  * chore(deps): update dependency containers/automation_images to v20230330
  * Disable Dependabot in favor of Renovate
  * chore(deps): update dependency containers/automation_images to v20230320
  * build(deps): bump futures-util from 0.3.26 to 0.3.27
  * [CI:BUILD] Packit: trigger builds on commit to main branch
  * build(deps): bump anyhow from 1.0.68 to 1.0.70
  * fix lint issue with new rust version 1.68
  * Cirrus: Update to newer CI VM images
  * build(deps): bump chrono from 0.4.23 to 0.4.24
  * build(deps): bump libc from 0.2.139 to 0.2.140
  * build(deps): bump async-broadcast from 0.5.0 to 0.5.1
  * build(deps): bump signal-hook from 0.3.14 to 0.3.15
  * build(deps): bump futures-util from 0.3.25 to 0.3.26
  * build(deps): bump tokio from 1.25.0 to 1.26.0
  * [CI:DOCS] Clarify packit related comments
  * [CI:BUILD] Packit: initial enablement
  * Allow custom cargo binary path
  * Switch to explicit platform list for `cargo vendor-filterer`
  * bump to v1.6.0-dev
  * Add renovate.json5
  * Cirrus: Groom rust cache before updating</changelog>
  <changelog author="danish.prakash@suse.com" date="1688385600">- Update to version 1.7.0:
  * release v1.7.0
  * Update release notes for v1.7.0
  * fix(deps): update rust crate tokio to 1.29.0
  * fix(deps): update rust crate clap to 4.3.8
  * fix(deps): update rust crate clap to 4.3.5
  * run cargo update
  * [CI:BUILD] Packit: add Fedora downstream tasks
  * fix(deps): update rust crate clap to 4.3.4
  * chore(deps): update dependency containers/automation_images to v20230614
  * fix(deps): update rust crate clap to 4.3.3
  * fix(deps): update rust crate log to 0.4.19
  * fix(deps): update rust crate clap to 4.3.2
  * fix(deps): update rust crate clap to 4.3.1
  * cirrus: remove verify_vendor task
  * chore(deps): update dependency containers/automation_images to v20230601
  * fix(deps): update rust crate trust-dns-server to 0.22.1
  * chore(deps): update rust crate chrono to 0.4.26
  * fix(deps): update rust crate tokio to 1.28.2
  * fix(deps): update rust crate log to 0.4.18
  * chore(deps): update rust crate chrono to 0.4.25
  * fix(deps): update rust crate clap to 4.3.0
  * chore(deps): update dependency containers/automation_images to v20230517
  * fix(deps): update rust crate tokio to 1.28.1
  * chore(deps): update dependency containers/automation_images to v20230426
  * fix(deps): update rust crate clap to 4.2.7
  * fix(deps): update rust crate anyhow to 1.0.71
  * fix typo in makefile
  * fix(deps): update rust crate tokio to 1.28.0
  * fix(deps): update rust crate clap to 4.2.5
  * fix(deps): update rust crate syslog to ^6.1.0
  * fix(deps): update rust crate clap to 4.2.4
  * fix(deps): update rust crate clap to 4.2.3
  * fix(deps): update rust crate clap to v4
  * chore(deps): update dependency containers/automation_images to v20230405
  * bump to v1.7.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1689076800">- Disable restricting builds only for tier1 platforms
  i.e. only for x86_64 and aarch64 and enable for all.</changelog>
  <changelog author="danish.prakash@suse.com" date="1695902400">- Update to version 1.8.0:
  * Release v1.8.0
  * update release notes for v1.8.0
  * run cargo update
  * Packit: switch to @containers/packit-build team for copr failure notification comments
  * [CI:BUILD] Packit: tag @lsm5 on copr build failures
  * chore(deps): update rust crate chrono to 0.4.31
  * cargo: bump chrono to 0.4.30
  * test: IPv6 format is changed in v1.72.0
  * bump nix to 0.27.1
  * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0
  * fix(deps): update rust crate trust-dns-server to 0.23.0
  * [CI:BUILD] rpm: spdx compatible license field
  * fix(deps): update rust crate anyhow to 1.0.75
  * fix(deps): update rust crate tokio to 1.32.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * fix(deps): update rust crate tokio to 1.31.0
  * fix(deps): update rust crate anyhow to 1.0.74
  * fix(deps): update rust crate anyhow to 1.0.73
  * fix(deps): update rust crate log to 0.4.20
  * chore(deps): update dependency containers/automation_images to v20230809
  * fix(deps): update rust crate tokio to 1.30.0
  * fix(deps): update rust crate clap to 4.3.21
  * packit: Build PRs into default packit COPRs
  * chore(deps): update dependency containers/automation_images to v20230807
  * fix(deps): update rust crate anyhow to 1.0.72
  * fix(deps): update rust crate signal-hook to 0.3.17
  * fix(deps): update rust crate clap to 4.3.19
  * fix(deps): update rust crate clap to 4.3.15
  * fix(deps): update rust crate signal-hook to 0.3.16
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update rust crate clap to 4.3.11
  * fix(deps): update rust crate tokio to 1.29.1
  * fix(deps): update rust crate clap to 4.3.10
  * [CI:BUILD] RPM: cleanup spec and fix eln builds
  * bump to v1.8.0-devel</changelog>
  <changelog author="danish.prakash@suse.com" date="1701345600">- Update to version 1.9.0:
  * Release v1.9.0
  * v1.9.0 Update release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20231116
  * fix(deps): update rust crate tokio to 1.34.0
  * fix(deps): update rust crate async-broadcast to 0.6.0
  * update trust-dns to hickory
  * fix(deps): update rust crate futures-util to 0.3.29
  * fix(deps): update rust crate trust-dns-server to 0.23.2
  * fix(deps): update rust crate trust-dns-proto to 0.23.2
  * tmt: initial enablement
  * aardvark main: change error reporting
  * chore(deps): update dependency containers/automation_images to v20231004
  * fix(deps): update rust crate trust-dns-proto to 0.23.1
  * fix(deps): update rust crate trust-dns-client to 0.23.1
  * clippy: some format fixes
  * fix(deps): update rust crate tokio to 1.33.0
  * Bump to v1.9.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1706184000">- Update to version 1.10.0:
  * Release 1.10.0
  * Release notes for 1.10.0
  * chore(deps): update rust crate chrono to 0.4.32
  * chore(deps): update dependency containers/automation_images to v20240102
  * fix(deps): update rust crate futures-util to 0.3.30
  * fix(deps): update rust crate anyhow to 1.0.79
  * fix(deps): update rust crate tokio to 1.35.1
  * chore(deps): update dependency containers/automation_images to v20231208
  * fix(deps): update rust crate tokio to 1.35.0
  * fix duplicated IP CI flake
  * server: remove unused kill switch
  * fix(deps): update rust crate clap to ~4.4.10
  * Bump working version to v1.10.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1717416000">- Remove redundant source: cargo_config
- Update to version 1.11.0:
  * Release v1.11.0
  * v1.11.0 release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20240529
  * Internal networks cannot make external DNS requests
  * fix(deps): update rust crate anyhow to 1.0.86
  * fix(deps): update rust crate nix to 0.29.0
  * [skip-ci] RPM: use default __cargo macro across all envs
  * chore(deps): update dependency containers/automation_images to v20240513
  * fix(deps): update rust crate anyhow to 1.0.83
  * [skip-ci] Packit: separate `packages` key for rhel jobs
  * fix(deps): update rust crate libc to 0.2.154
  * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync
  * [skip-ci] Packit: Remove EL8 jobs
  * fix(deps): update rust crate syslog to ^6.1.1
  * fix reverse ipv6 lookup test flake
  * fix(deps): update hickory-dns monorepo to 0.24.1
  * chore(deps): update rust crate chrono to 0.4.38
  * Don't tear down all server threads on SIGHUP (bsc#1224167)
  * fix(deps): update rust crate anyhow to 1.0.82
  * fix(deps): update rust crate tokio to 1.37.0
  * Update to nix-0.28.0
  * update chrono package
  * chore(deps): update dependency containers/automation_images to v20240320
  * fix(deps): update rust crate anyhow to 1.0.81
  * tests: check queried domain name in reverse lookup tests
  * fix: set name for answers in reverse lookups
  * chore: fix typo in runner script
  * chore: fix log message when doing reverse lookup
  * fix(deps): update rust crate log to 0.4.21
  * fix(deps): update rust crate anyhow to 1.0.80
  * chore(deps): update rust crate chrono to 0.4.34
  * fix(deps): update rust crate async-broadcast to 0.7.0
  * fix(deps): update rust crate tokio to 1.36.0
  * [CI:DOCS] Packit: disable bodhi tasks
  * chore(deps): update rust crate chrono to 0.4.33
  * Bump to 1.11.0-dev</changelog>
</package>
<package pkgid="a97d1de58e126323a2070b3231acf54d9cdfc381c5877bc30fd644c1c96fe605" name="aardvark-dns" arch="s390x">
  <version epoch="0" ver="1.11.0" rel="150500.3.6.1"/>
  <changelog author="danish.prakash@suse.com" date="1676376000">- First version of aardvark-dns</changelog>
  <changelog author="danish.prakash@suse.com" date="1679054400">- Fix libexecdir issue on Leap and SLE</changelog>
  <changelog author="danish.prakash@suse.com" date="1681300800">- Update to version 1.6.0:
  * v1.6.0 release
  * Update release notes for v1.6.0
  * fix(deps): update rust crate tokio to 1.27.0
  * use lower TTL for contianer entries
  * fix(deps): update rust crate syslog to ^6.0.1
  * fix(deps): update rust crate futures-util to 0.3.28
  * chore(deps): update dependency containers/automation_images to v20230330
  * Disable Dependabot in favor of Renovate
  * chore(deps): update dependency containers/automation_images to v20230320
  * build(deps): bump futures-util from 0.3.26 to 0.3.27
  * [CI:BUILD] Packit: trigger builds on commit to main branch
  * build(deps): bump anyhow from 1.0.68 to 1.0.70
  * fix lint issue with new rust version 1.68
  * Cirrus: Update to newer CI VM images
  * build(deps): bump chrono from 0.4.23 to 0.4.24
  * build(deps): bump libc from 0.2.139 to 0.2.140
  * build(deps): bump async-broadcast from 0.5.0 to 0.5.1
  * build(deps): bump signal-hook from 0.3.14 to 0.3.15
  * build(deps): bump futures-util from 0.3.25 to 0.3.26
  * build(deps): bump tokio from 1.25.0 to 1.26.0
  * [CI:DOCS] Clarify packit related comments
  * [CI:BUILD] Packit: initial enablement
  * Allow custom cargo binary path
  * Switch to explicit platform list for `cargo vendor-filterer`
  * bump to v1.6.0-dev
  * Add renovate.json5
  * Cirrus: Groom rust cache before updating</changelog>
  <changelog author="danish.prakash@suse.com" date="1688385600">- Update to version 1.7.0:
  * release v1.7.0
  * Update release notes for v1.7.0
  * fix(deps): update rust crate tokio to 1.29.0
  * fix(deps): update rust crate clap to 4.3.8
  * fix(deps): update rust crate clap to 4.3.5
  * run cargo update
  * [CI:BUILD] Packit: add Fedora downstream tasks
  * fix(deps): update rust crate clap to 4.3.4
  * chore(deps): update dependency containers/automation_images to v20230614
  * fix(deps): update rust crate clap to 4.3.3
  * fix(deps): update rust crate log to 0.4.19
  * fix(deps): update rust crate clap to 4.3.2
  * fix(deps): update rust crate clap to 4.3.1
  * cirrus: remove verify_vendor task
  * chore(deps): update dependency containers/automation_images to v20230601
  * fix(deps): update rust crate trust-dns-server to 0.22.1
  * chore(deps): update rust crate chrono to 0.4.26
  * fix(deps): update rust crate tokio to 1.28.2
  * fix(deps): update rust crate log to 0.4.18
  * chore(deps): update rust crate chrono to 0.4.25
  * fix(deps): update rust crate clap to 4.3.0
  * chore(deps): update dependency containers/automation_images to v20230517
  * fix(deps): update rust crate tokio to 1.28.1
  * chore(deps): update dependency containers/automation_images to v20230426
  * fix(deps): update rust crate clap to 4.2.7
  * fix(deps): update rust crate anyhow to 1.0.71
  * fix typo in makefile
  * fix(deps): update rust crate tokio to 1.28.0
  * fix(deps): update rust crate clap to 4.2.5
  * fix(deps): update rust crate syslog to ^6.1.0
  * fix(deps): update rust crate clap to 4.2.4
  * fix(deps): update rust crate clap to 4.2.3
  * fix(deps): update rust crate clap to v4
  * chore(deps): update dependency containers/automation_images to v20230405
  * bump to v1.7.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1689076800">- Disable restricting builds only for tier1 platforms
  i.e. only for x86_64 and aarch64 and enable for all.</changelog>
  <changelog author="danish.prakash@suse.com" date="1695902400">- Update to version 1.8.0:
  * Release v1.8.0
  * update release notes for v1.8.0
  * run cargo update
  * Packit: switch to @containers/packit-build team for copr failure notification comments
  * [CI:BUILD] Packit: tag @lsm5 on copr build failures
  * chore(deps): update rust crate chrono to 0.4.31
  * cargo: bump chrono to 0.4.30
  * test: IPv6 format is changed in v1.72.0
  * bump nix to 0.27.1
  * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0
  * fix(deps): update rust crate trust-dns-server to 0.23.0
  * [CI:BUILD] rpm: spdx compatible license field
  * fix(deps): update rust crate anyhow to 1.0.75
  * fix(deps): update rust crate tokio to 1.32.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * fix(deps): update rust crate tokio to 1.31.0
  * fix(deps): update rust crate anyhow to 1.0.74
  * fix(deps): update rust crate anyhow to 1.0.73
  * fix(deps): update rust crate log to 0.4.20
  * chore(deps): update dependency containers/automation_images to v20230809
  * fix(deps): update rust crate tokio to 1.30.0
  * fix(deps): update rust crate clap to 4.3.21
  * packit: Build PRs into default packit COPRs
  * chore(deps): update dependency containers/automation_images to v20230807
  * fix(deps): update rust crate anyhow to 1.0.72
  * fix(deps): update rust crate signal-hook to 0.3.17
  * fix(deps): update rust crate clap to 4.3.19
  * fix(deps): update rust crate clap to 4.3.15
  * fix(deps): update rust crate signal-hook to 0.3.16
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update rust crate clap to 4.3.11
  * fix(deps): update rust crate tokio to 1.29.1
  * fix(deps): update rust crate clap to 4.3.10
  * [CI:BUILD] RPM: cleanup spec and fix eln builds
  * bump to v1.8.0-devel</changelog>
  <changelog author="danish.prakash@suse.com" date="1701345600">- Update to version 1.9.0:
  * Release v1.9.0
  * v1.9.0 Update release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20231116
  * fix(deps): update rust crate tokio to 1.34.0
  * fix(deps): update rust crate async-broadcast to 0.6.0
  * update trust-dns to hickory
  * fix(deps): update rust crate futures-util to 0.3.29
  * fix(deps): update rust crate trust-dns-server to 0.23.2
  * fix(deps): update rust crate trust-dns-proto to 0.23.2
  * tmt: initial enablement
  * aardvark main: change error reporting
  * chore(deps): update dependency containers/automation_images to v20231004
  * fix(deps): update rust crate trust-dns-proto to 0.23.1
  * fix(deps): update rust crate trust-dns-client to 0.23.1
  * clippy: some format fixes
  * fix(deps): update rust crate tokio to 1.33.0
  * Bump to v1.9.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1706184000">- Update to version 1.10.0:
  * Release 1.10.0
  * Release notes for 1.10.0
  * chore(deps): update rust crate chrono to 0.4.32
  * chore(deps): update dependency containers/automation_images to v20240102
  * fix(deps): update rust crate futures-util to 0.3.30
  * fix(deps): update rust crate anyhow to 1.0.79
  * fix(deps): update rust crate tokio to 1.35.1
  * chore(deps): update dependency containers/automation_images to v20231208
  * fix(deps): update rust crate tokio to 1.35.0
  * fix duplicated IP CI flake
  * server: remove unused kill switch
  * fix(deps): update rust crate clap to ~4.4.10
  * Bump working version to v1.10.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1717416000">- Remove redundant source: cargo_config
- Update to version 1.11.0:
  * Release v1.11.0
  * v1.11.0 release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20240529
  * Internal networks cannot make external DNS requests
  * fix(deps): update rust crate anyhow to 1.0.86
  * fix(deps): update rust crate nix to 0.29.0
  * [skip-ci] RPM: use default __cargo macro across all envs
  * chore(deps): update dependency containers/automation_images to v20240513
  * fix(deps): update rust crate anyhow to 1.0.83
  * [skip-ci] Packit: separate `packages` key for rhel jobs
  * fix(deps): update rust crate libc to 0.2.154
  * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync
  * [skip-ci] Packit: Remove EL8 jobs
  * fix(deps): update rust crate syslog to ^6.1.1
  * fix reverse ipv6 lookup test flake
  * fix(deps): update hickory-dns monorepo to 0.24.1
  * chore(deps): update rust crate chrono to 0.4.38
  * Don't tear down all server threads on SIGHUP (bsc#1224167)
  * fix(deps): update rust crate anyhow to 1.0.82
  * fix(deps): update rust crate tokio to 1.37.0
  * Update to nix-0.28.0
  * update chrono package
  * chore(deps): update dependency containers/automation_images to v20240320
  * fix(deps): update rust crate anyhow to 1.0.81
  * tests: check queried domain name in reverse lookup tests
  * fix: set name for answers in reverse lookups
  * chore: fix typo in runner script
  * chore: fix log message when doing reverse lookup
  * fix(deps): update rust crate log to 0.4.21
  * fix(deps): update rust crate anyhow to 1.0.80
  * chore(deps): update rust crate chrono to 0.4.34
  * fix(deps): update rust crate async-broadcast to 0.7.0
  * fix(deps): update rust crate tokio to 1.36.0
  * [CI:DOCS] Packit: disable bodhi tasks
  * chore(deps): update rust crate chrono to 0.4.33
  * Bump to 1.11.0-dev</changelog>
</package>
<package pkgid="499610eb025fcb432bdd554fad706335c12167a736122dac7ed2e34339e46ba0" name="aardvark-dns" arch="src">
  <version epoch="0" ver="1.11.0" rel="150500.3.6.1"/>
  <changelog author="danish.prakash@suse.com" date="1676376000">- First version of aardvark-dns</changelog>
  <changelog author="danish.prakash@suse.com" date="1679054400">- Fix libexecdir issue on Leap and SLE</changelog>
  <changelog author="danish.prakash@suse.com" date="1681300800">- Update to version 1.6.0:
  * v1.6.0 release
  * Update release notes for v1.6.0
  * fix(deps): update rust crate tokio to 1.27.0
  * use lower TTL for contianer entries
  * fix(deps): update rust crate syslog to ^6.0.1
  * fix(deps): update rust crate futures-util to 0.3.28
  * chore(deps): update dependency containers/automation_images to v20230330
  * Disable Dependabot in favor of Renovate
  * chore(deps): update dependency containers/automation_images to v20230320
  * build(deps): bump futures-util from 0.3.26 to 0.3.27
  * [CI:BUILD] Packit: trigger builds on commit to main branch
  * build(deps): bump anyhow from 1.0.68 to 1.0.70
  * fix lint issue with new rust version 1.68
  * Cirrus: Update to newer CI VM images
  * build(deps): bump chrono from 0.4.23 to 0.4.24
  * build(deps): bump libc from 0.2.139 to 0.2.140
  * build(deps): bump async-broadcast from 0.5.0 to 0.5.1
  * build(deps): bump signal-hook from 0.3.14 to 0.3.15
  * build(deps): bump futures-util from 0.3.25 to 0.3.26
  * build(deps): bump tokio from 1.25.0 to 1.26.0
  * [CI:DOCS] Clarify packit related comments
  * [CI:BUILD] Packit: initial enablement
  * Allow custom cargo binary path
  * Switch to explicit platform list for `cargo vendor-filterer`
  * bump to v1.6.0-dev
  * Add renovate.json5
  * Cirrus: Groom rust cache before updating</changelog>
  <changelog author="danish.prakash@suse.com" date="1688385600">- Update to version 1.7.0:
  * release v1.7.0
  * Update release notes for v1.7.0
  * fix(deps): update rust crate tokio to 1.29.0
  * fix(deps): update rust crate clap to 4.3.8
  * fix(deps): update rust crate clap to 4.3.5
  * run cargo update
  * [CI:BUILD] Packit: add Fedora downstream tasks
  * fix(deps): update rust crate clap to 4.3.4
  * chore(deps): update dependency containers/automation_images to v20230614
  * fix(deps): update rust crate clap to 4.3.3
  * fix(deps): update rust crate log to 0.4.19
  * fix(deps): update rust crate clap to 4.3.2
  * fix(deps): update rust crate clap to 4.3.1
  * cirrus: remove verify_vendor task
  * chore(deps): update dependency containers/automation_images to v20230601
  * fix(deps): update rust crate trust-dns-server to 0.22.1
  * chore(deps): update rust crate chrono to 0.4.26
  * fix(deps): update rust crate tokio to 1.28.2
  * fix(deps): update rust crate log to 0.4.18
  * chore(deps): update rust crate chrono to 0.4.25
  * fix(deps): update rust crate clap to 4.3.0
  * chore(deps): update dependency containers/automation_images to v20230517
  * fix(deps): update rust crate tokio to 1.28.1
  * chore(deps): update dependency containers/automation_images to v20230426
  * fix(deps): update rust crate clap to 4.2.7
  * fix(deps): update rust crate anyhow to 1.0.71
  * fix typo in makefile
  * fix(deps): update rust crate tokio to 1.28.0
  * fix(deps): update rust crate clap to 4.2.5
  * fix(deps): update rust crate syslog to ^6.1.0
  * fix(deps): update rust crate clap to 4.2.4
  * fix(deps): update rust crate clap to 4.2.3
  * fix(deps): update rust crate clap to v4
  * chore(deps): update dependency containers/automation_images to v20230405
  * bump to v1.7.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1689076800">- Disable restricting builds only for tier1 platforms
  i.e. only for x86_64 and aarch64 and enable for all.</changelog>
  <changelog author="danish.prakash@suse.com" date="1695902400">- Update to version 1.8.0:
  * Release v1.8.0
  * update release notes for v1.8.0
  * run cargo update
  * Packit: switch to @containers/packit-build team for copr failure notification comments
  * [CI:BUILD] Packit: tag @lsm5 on copr build failures
  * chore(deps): update rust crate chrono to 0.4.31
  * cargo: bump chrono to 0.4.30
  * test: IPv6 format is changed in v1.72.0
  * bump nix to 0.27.1
  * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0
  * fix(deps): update rust crate trust-dns-server to 0.23.0
  * [CI:BUILD] rpm: spdx compatible license field
  * fix(deps): update rust crate anyhow to 1.0.75
  * fix(deps): update rust crate tokio to 1.32.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * fix(deps): update rust crate tokio to 1.31.0
  * fix(deps): update rust crate anyhow to 1.0.74
  * fix(deps): update rust crate anyhow to 1.0.73
  * fix(deps): update rust crate log to 0.4.20
  * chore(deps): update dependency containers/automation_images to v20230809
  * fix(deps): update rust crate tokio to 1.30.0
  * fix(deps): update rust crate clap to 4.3.21
  * packit: Build PRs into default packit COPRs
  * chore(deps): update dependency containers/automation_images to v20230807
  * fix(deps): update rust crate anyhow to 1.0.72
  * fix(deps): update rust crate signal-hook to 0.3.17
  * fix(deps): update rust crate clap to 4.3.19
  * fix(deps): update rust crate clap to 4.3.15
  * fix(deps): update rust crate signal-hook to 0.3.16
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update rust crate clap to 4.3.11
  * fix(deps): update rust crate tokio to 1.29.1
  * fix(deps): update rust crate clap to 4.3.10
  * [CI:BUILD] RPM: cleanup spec and fix eln builds
  * bump to v1.8.0-devel</changelog>
  <changelog author="danish.prakash@suse.com" date="1701345600">- Update to version 1.9.0:
  * Release v1.9.0
  * v1.9.0 Update release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20231116
  * fix(deps): update rust crate tokio to 1.34.0
  * fix(deps): update rust crate async-broadcast to 0.6.0
  * update trust-dns to hickory
  * fix(deps): update rust crate futures-util to 0.3.29
  * fix(deps): update rust crate trust-dns-server to 0.23.2
  * fix(deps): update rust crate trust-dns-proto to 0.23.2
  * tmt: initial enablement
  * aardvark main: change error reporting
  * chore(deps): update dependency containers/automation_images to v20231004
  * fix(deps): update rust crate trust-dns-proto to 0.23.1
  * fix(deps): update rust crate trust-dns-client to 0.23.1
  * clippy: some format fixes
  * fix(deps): update rust crate tokio to 1.33.0
  * Bump to v1.9.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1706184000">- Update to version 1.10.0:
  * Release 1.10.0
  * Release notes for 1.10.0
  * chore(deps): update rust crate chrono to 0.4.32
  * chore(deps): update dependency containers/automation_images to v20240102
  * fix(deps): update rust crate futures-util to 0.3.30
  * fix(deps): update rust crate anyhow to 1.0.79
  * fix(deps): update rust crate tokio to 1.35.1
  * chore(deps): update dependency containers/automation_images to v20231208
  * fix(deps): update rust crate tokio to 1.35.0
  * fix duplicated IP CI flake
  * server: remove unused kill switch
  * fix(deps): update rust crate clap to ~4.4.10
  * Bump working version to v1.10.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1717416000">- Remove redundant source: cargo_config
- Update to version 1.11.0:
  * Release v1.11.0
  * v1.11.0 release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20240529
  * Internal networks cannot make external DNS requests
  * fix(deps): update rust crate anyhow to 1.0.86
  * fix(deps): update rust crate nix to 0.29.0
  * [skip-ci] RPM: use default __cargo macro across all envs
  * chore(deps): update dependency containers/automation_images to v20240513
  * fix(deps): update rust crate anyhow to 1.0.83
  * [skip-ci] Packit: separate `packages` key for rhel jobs
  * fix(deps): update rust crate libc to 0.2.154
  * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync
  * [skip-ci] Packit: Remove EL8 jobs
  * fix(deps): update rust crate syslog to ^6.1.1
  * fix reverse ipv6 lookup test flake
  * fix(deps): update hickory-dns monorepo to 0.24.1
  * chore(deps): update rust crate chrono to 0.4.38
  * Don't tear down all server threads on SIGHUP (bsc#1224167)
  * fix(deps): update rust crate anyhow to 1.0.82
  * fix(deps): update rust crate tokio to 1.37.0
  * Update to nix-0.28.0
  * update chrono package
  * chore(deps): update dependency containers/automation_images to v20240320
  * fix(deps): update rust crate anyhow to 1.0.81
  * tests: check queried domain name in reverse lookup tests
  * fix: set name for answers in reverse lookups
  * chore: fix typo in runner script
  * chore: fix log message when doing reverse lookup
  * fix(deps): update rust crate log to 0.4.21
  * fix(deps): update rust crate anyhow to 1.0.80
  * chore(deps): update rust crate chrono to 0.4.34
  * fix(deps): update rust crate async-broadcast to 0.7.0
  * fix(deps): update rust crate tokio to 1.36.0
  * [CI:DOCS] Packit: disable bodhi tasks
  * chore(deps): update rust crate chrono to 0.4.33
  * Bump to 1.11.0-dev</changelog>
</package>
<package pkgid="10b88f9f5ec5363ee8d4399db52288a1e432298bb6b121223217bc7ad57fb076" name="aardvark-dns" arch="x86_64">
  <version epoch="0" ver="1.11.0" rel="150500.3.6.1"/>
  <changelog author="danish.prakash@suse.com" date="1676376000">- First version of aardvark-dns</changelog>
  <changelog author="danish.prakash@suse.com" date="1679054400">- Fix libexecdir issue on Leap and SLE</changelog>
  <changelog author="danish.prakash@suse.com" date="1681300800">- Update to version 1.6.0:
  * v1.6.0 release
  * Update release notes for v1.6.0
  * fix(deps): update rust crate tokio to 1.27.0
  * use lower TTL for contianer entries
  * fix(deps): update rust crate syslog to ^6.0.1
  * fix(deps): update rust crate futures-util to 0.3.28
  * chore(deps): update dependency containers/automation_images to v20230330
  * Disable Dependabot in favor of Renovate
  * chore(deps): update dependency containers/automation_images to v20230320
  * build(deps): bump futures-util from 0.3.26 to 0.3.27
  * [CI:BUILD] Packit: trigger builds on commit to main branch
  * build(deps): bump anyhow from 1.0.68 to 1.0.70
  * fix lint issue with new rust version 1.68
  * Cirrus: Update to newer CI VM images
  * build(deps): bump chrono from 0.4.23 to 0.4.24
  * build(deps): bump libc from 0.2.139 to 0.2.140
  * build(deps): bump async-broadcast from 0.5.0 to 0.5.1
  * build(deps): bump signal-hook from 0.3.14 to 0.3.15
  * build(deps): bump futures-util from 0.3.25 to 0.3.26
  * build(deps): bump tokio from 1.25.0 to 1.26.0
  * [CI:DOCS] Clarify packit related comments
  * [CI:BUILD] Packit: initial enablement
  * Allow custom cargo binary path
  * Switch to explicit platform list for `cargo vendor-filterer`
  * bump to v1.6.0-dev
  * Add renovate.json5
  * Cirrus: Groom rust cache before updating</changelog>
  <changelog author="danish.prakash@suse.com" date="1688385600">- Update to version 1.7.0:
  * release v1.7.0
  * Update release notes for v1.7.0
  * fix(deps): update rust crate tokio to 1.29.0
  * fix(deps): update rust crate clap to 4.3.8
  * fix(deps): update rust crate clap to 4.3.5
  * run cargo update
  * [CI:BUILD] Packit: add Fedora downstream tasks
  * fix(deps): update rust crate clap to 4.3.4
  * chore(deps): update dependency containers/automation_images to v20230614
  * fix(deps): update rust crate clap to 4.3.3
  * fix(deps): update rust crate log to 0.4.19
  * fix(deps): update rust crate clap to 4.3.2
  * fix(deps): update rust crate clap to 4.3.1
  * cirrus: remove verify_vendor task
  * chore(deps): update dependency containers/automation_images to v20230601
  * fix(deps): update rust crate trust-dns-server to 0.22.1
  * chore(deps): update rust crate chrono to 0.4.26
  * fix(deps): update rust crate tokio to 1.28.2
  * fix(deps): update rust crate log to 0.4.18
  * chore(deps): update rust crate chrono to 0.4.25
  * fix(deps): update rust crate clap to 4.3.0
  * chore(deps): update dependency containers/automation_images to v20230517
  * fix(deps): update rust crate tokio to 1.28.1
  * chore(deps): update dependency containers/automation_images to v20230426
  * fix(deps): update rust crate clap to 4.2.7
  * fix(deps): update rust crate anyhow to 1.0.71
  * fix typo in makefile
  * fix(deps): update rust crate tokio to 1.28.0
  * fix(deps): update rust crate clap to 4.2.5
  * fix(deps): update rust crate syslog to ^6.1.0
  * fix(deps): update rust crate clap to 4.2.4
  * fix(deps): update rust crate clap to 4.2.3
  * fix(deps): update rust crate clap to v4
  * chore(deps): update dependency containers/automation_images to v20230405
  * bump to v1.7.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1689076800">- Disable restricting builds only for tier1 platforms
  i.e. only for x86_64 and aarch64 and enable for all.</changelog>
  <changelog author="danish.prakash@suse.com" date="1695902400">- Update to version 1.8.0:
  * Release v1.8.0
  * update release notes for v1.8.0
  * run cargo update
  * Packit: switch to @containers/packit-build team for copr failure notification comments
  * [CI:BUILD] Packit: tag @lsm5 on copr build failures
  * chore(deps): update rust crate chrono to 0.4.31
  * cargo: bump chrono to 0.4.30
  * test: IPv6 format is changed in v1.72.0
  * bump nix to 0.27.1
  * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0
  * fix(deps): update rust crate trust-dns-server to 0.23.0
  * [CI:BUILD] rpm: spdx compatible license field
  * fix(deps): update rust crate anyhow to 1.0.75
  * fix(deps): update rust crate tokio to 1.32.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * fix(deps): update rust crate tokio to 1.31.0
  * fix(deps): update rust crate anyhow to 1.0.74
  * fix(deps): update rust crate anyhow to 1.0.73
  * fix(deps): update rust crate log to 0.4.20
  * chore(deps): update dependency containers/automation_images to v20230809
  * fix(deps): update rust crate tokio to 1.30.0
  * fix(deps): update rust crate clap to 4.3.21
  * packit: Build PRs into default packit COPRs
  * chore(deps): update dependency containers/automation_images to v20230807
  * fix(deps): update rust crate anyhow to 1.0.72
  * fix(deps): update rust crate signal-hook to 0.3.17
  * fix(deps): update rust crate clap to 4.3.19
  * fix(deps): update rust crate clap to 4.3.15
  * fix(deps): update rust crate signal-hook to 0.3.16
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update rust crate clap to 4.3.11
  * fix(deps): update rust crate tokio to 1.29.1
  * fix(deps): update rust crate clap to 4.3.10
  * [CI:BUILD] RPM: cleanup spec and fix eln builds
  * bump to v1.8.0-devel</changelog>
  <changelog author="danish.prakash@suse.com" date="1701345600">- Update to version 1.9.0:
  * Release v1.9.0
  * v1.9.0 Update release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20231116
  * fix(deps): update rust crate tokio to 1.34.0
  * fix(deps): update rust crate async-broadcast to 0.6.0
  * update trust-dns to hickory
  * fix(deps): update rust crate futures-util to 0.3.29
  * fix(deps): update rust crate trust-dns-server to 0.23.2
  * fix(deps): update rust crate trust-dns-proto to 0.23.2
  * tmt: initial enablement
  * aardvark main: change error reporting
  * chore(deps): update dependency containers/automation_images to v20231004
  * fix(deps): update rust crate trust-dns-proto to 0.23.1
  * fix(deps): update rust crate trust-dns-client to 0.23.1
  * clippy: some format fixes
  * fix(deps): update rust crate tokio to 1.33.0
  * Bump to v1.9.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1706184000">- Update to version 1.10.0:
  * Release 1.10.0
  * Release notes for 1.10.0
  * chore(deps): update rust crate chrono to 0.4.32
  * chore(deps): update dependency containers/automation_images to v20240102
  * fix(deps): update rust crate futures-util to 0.3.30
  * fix(deps): update rust crate anyhow to 1.0.79
  * fix(deps): update rust crate tokio to 1.35.1
  * chore(deps): update dependency containers/automation_images to v20231208
  * fix(deps): update rust crate tokio to 1.35.0
  * fix duplicated IP CI flake
  * server: remove unused kill switch
  * fix(deps): update rust crate clap to ~4.4.10
  * Bump working version to v1.10.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1717416000">- Remove redundant source: cargo_config
- Update to version 1.11.0:
  * Release v1.11.0
  * v1.11.0 release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20240529
  * Internal networks cannot make external DNS requests
  * fix(deps): update rust crate anyhow to 1.0.86
  * fix(deps): update rust crate nix to 0.29.0
  * [skip-ci] RPM: use default __cargo macro across all envs
  * chore(deps): update dependency containers/automation_images to v20240513
  * fix(deps): update rust crate anyhow to 1.0.83
  * [skip-ci] Packit: separate `packages` key for rhel jobs
  * fix(deps): update rust crate libc to 0.2.154
  * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync
  * [skip-ci] Packit: Remove EL8 jobs
  * fix(deps): update rust crate syslog to ^6.1.1
  * fix reverse ipv6 lookup test flake
  * fix(deps): update hickory-dns monorepo to 0.24.1
  * chore(deps): update rust crate chrono to 0.4.38
  * Don't tear down all server threads on SIGHUP (bsc#1224167)
  * fix(deps): update rust crate anyhow to 1.0.82
  * fix(deps): update rust crate tokio to 1.37.0
  * Update to nix-0.28.0
  * update chrono package
  * chore(deps): update dependency containers/automation_images to v20240320
  * fix(deps): update rust crate anyhow to 1.0.81
  * tests: check queried domain name in reverse lookup tests
  * fix: set name for answers in reverse lookups
  * chore: fix typo in runner script
  * chore: fix log message when doing reverse lookup
  * fix(deps): update rust crate log to 0.4.21
  * fix(deps): update rust crate anyhow to 1.0.80
  * chore(deps): update rust crate chrono to 0.4.34
  * fix(deps): update rust crate async-broadcast to 0.7.0
  * fix(deps): update rust crate tokio to 1.36.0
  * [CI:DOCS] Packit: disable bodhi tasks
  * chore(deps): update rust crate chrono to 0.4.33
  * Bump to 1.11.0-dev</changelog>
</package>
<package pkgid="2a5ce95b2a866ecf949ecd093516f7038ac096782a90f0ad09bf2f2693b2182f" name="adcli" arch="aarch64">
  <version epoch="0" ver="0.8.2" rel="150400.17.8.3"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1635163200">- Add --dont-expire-password option; (jsc#sle-21225);
  * 0036-Add-dont-expire-password-option.patch
  * 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
  <changelog author="scabrero@suse.de" date="1691582400">- Write SID before secret to Samba's db; (bsc#1214076);
  Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch</changelog>
  <changelog author="scabrero@suse.de" date="1702987200">- Populate Samba's secrets database using offline domain join;
  (bsc#1214076); Add
  0041-populate-samba-secrets-using-offline-domain-join.patch</changelog>
</package>
<package pkgid="5d206fc9bfd44445feff4928554de09f57f5341fecfa8dc1f55a7d885ff14a9a" name="adcli" arch="ppc64le">
  <version epoch="0" ver="0.8.2" rel="150400.17.8.3"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1635163200">- Add --dont-expire-password option; (jsc#sle-21225);
  * 0036-Add-dont-expire-password-option.patch
  * 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
  <changelog author="scabrero@suse.de" date="1691582400">- Write SID before secret to Samba's db; (bsc#1214076);
  Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch</changelog>
  <changelog author="scabrero@suse.de" date="1702987200">- Populate Samba's secrets database using offline domain join;
  (bsc#1214076); Add
  0041-populate-samba-secrets-using-offline-domain-join.patch</changelog>
</package>
<package pkgid="831cdac2e89526ff995ac71ed5d33d9c775097578d32b3b264c90fb8e3f229a2" name="adcli" arch="s390x">
  <version epoch="0" ver="0.8.2" rel="150400.17.8.3"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1635163200">- Add --dont-expire-password option; (jsc#sle-21225);
  * 0036-Add-dont-expire-password-option.patch
  * 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
  <changelog author="scabrero@suse.de" date="1691582400">- Write SID before secret to Samba's db; (bsc#1214076);
  Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch</changelog>
  <changelog author="scabrero@suse.de" date="1702987200">- Populate Samba's secrets database using offline domain join;
  (bsc#1214076); Add
  0041-populate-samba-secrets-using-offline-domain-join.patch</changelog>
</package>
<package pkgid="889ff13178298bf1963808b97ebcfb1178351f54392eea293180cd07e045e7a3" name="adcli" arch="src">
  <version epoch="0" ver="0.8.2" rel="150400.17.8.3"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1635163200">- Add --dont-expire-password option; (jsc#sle-21225);
  * 0036-Add-dont-expire-password-option.patch
  * 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
  <changelog author="scabrero@suse.de" date="1691582400">- Write SID before secret to Samba's db; (bsc#1214076);
  Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch</changelog>
  <changelog author="scabrero@suse.de" date="1702987200">- Populate Samba's secrets database using offline domain join;
  (bsc#1214076); Add
  0041-populate-samba-secrets-using-offline-domain-join.patch</changelog>
</package>
<package pkgid="a036f64118fa2fab0b9fb93848b8e212c8d58b7984edbbcba8014e77481ecdde" name="adcli" arch="x86_64">
  <version epoch="0" ver="0.8.2" rel="150400.17.8.3"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1635163200">- Add --dont-expire-password option; (jsc#sle-21225);
  * 0036-Add-dont-expire-password-option.patch
  * 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
  <changelog author="scabrero@suse.de" date="1691582400">- Write SID before secret to Samba's db; (bsc#1214076);
  Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch</changelog>
  <changelog author="scabrero@suse.de" date="1702987200">- Populate Samba's secrets database using offline domain join;
  (bsc#1214076); Add
  0041-populate-samba-secrets-using-offline-domain-join.patch</changelog>
</package>
<package pkgid="b1712d05e08fc20f3c0578dbe07a871446baf74580f62d92645f2e934abd9613" name="adcli-doc" arch="aarch64">
  <version epoch="0" ver="0.8.2" rel="150400.17.8.3"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1635163200">- Add --dont-expire-password option; (jsc#sle-21225);
  * 0036-Add-dont-expire-password-option.patch
  * 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
  <changelog author="scabrero@suse.de" date="1691582400">- Write SID before secret to Samba's db; (bsc#1214076);
  Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch</changelog>
  <changelog author="scabrero@suse.de" date="1702987200">- Populate Samba's secrets database using offline domain join;
  (bsc#1214076); Add
  0041-populate-samba-secrets-using-offline-domain-join.patch</changelog>
</package>
<package pkgid="b91ec3ca4454d3f9f22db74dadf9ee420cee670a3ad8fdfbf6f09b73cd69ae71" name="adcli-doc" arch="ppc64le">
  <version epoch="0" ver="0.8.2" rel="150400.17.8.3"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1635163200">- Add --dont-expire-password option; (jsc#sle-21225);
  * 0036-Add-dont-expire-password-option.patch
  * 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
  <changelog author="scabrero@suse.de" date="1691582400">- Write SID before secret to Samba's db; (bsc#1214076);
  Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch</changelog>
  <changelog author="scabrero@suse.de" date="1702987200">- Populate Samba's secrets database using offline domain join;
  (bsc#1214076); Add
  0041-populate-samba-secrets-using-offline-domain-join.patch</changelog>
</package>
<package pkgid="92c45a4a3ec8979ceb109b7a57626f206197eeca999f51e583243577fc9e29f2" name="adcli-doc" arch="s390x">
  <version epoch="0" ver="0.8.2" rel="150400.17.8.3"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1635163200">- Add --dont-expire-password option; (jsc#sle-21225);
  * 0036-Add-dont-expire-password-option.patch
  * 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
  <changelog author="scabrero@suse.de" date="1691582400">- Write SID before secret to Samba's db; (bsc#1214076);
  Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch</changelog>
  <changelog author="scabrero@suse.de" date="1702987200">- Populate Samba's secrets database using offline domain join;
  (bsc#1214076); Add
  0041-populate-samba-secrets-using-offline-domain-join.patch</changelog>
</package>
<package pkgid="a90cc5e9af514ffbdcf92731157cb83667aaf1b05a61ecd55f8535e91ea891b3" name="adcli-doc" arch="x86_64">
  <version epoch="0" ver="0.8.2" rel="150400.17.8.3"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1635163200">- Add --dont-expire-password option; (jsc#sle-21225);
  * 0036-Add-dont-expire-password-option.patch
  * 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
  <changelog author="scabrero@suse.de" date="1691582400">- Write SID before secret to Samba's db; (bsc#1214076);
  Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch</changelog>
  <changelog author="scabrero@suse.de" date="1702987200">- Populate Samba's secrets database using offline domain join;
  (bsc#1214076); Add
  0041-populate-samba-secrets-using-offline-domain-join.patch</changelog>
</package>
<package pkgid="aadfaf231783955907aa0712b8327b209d2fc677185b1fbce21455dc449f2f9b" name="alsa-utils" arch="aarch64">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="3f5b5e08f99e34808667930276a6e540149ecb7a30738e6782587a65cab763a0" name="alsa-utils" arch="ppc64le">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="6e527990f3414ab6cda072d7f7b8d0ddda3393ac1bf66f2e09d21ddbf4baf930" name="alsa-utils" arch="s390x">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="d375e08488dff04267649a9d60967f7ddcb9aec06d4856eb93c60eaae44aac14" name="alsa-utils" arch="src">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="b8f325a5003dac4e0eb05e2d48d66f538225d38d6517fc5d90c0ed0df1ada08f" name="alsa-utils" arch="x86_64">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="09451b04a6be37da44537ec0468de4db2425180e2b50ed0ac7e04f368e82656d" name="alsabat" arch="aarch64">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="30d78502134ce8291cb53f6c99be7f25126036b0dedc31bcefe0322b42e240aa" name="alsabat" arch="ppc64le">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="40610a8f5d6e7bcb2386e3b8e819cb2c4372f40b2c32ddf6d9cbf666585536ed" name="alsabat" arch="s390x">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="7b8497d7ea0cb3d111ccd080af47652c41e5607794c9eabb037848a7220e2e83" name="alsabat" arch="x86_64">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="f5acb4333f9ba4435a4bf2cbb6b582100947dacf644039f386f96b9329fdea67" name="ant" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="817a720836b054e4e80197e7fd409b929d5586f820e3261ad13965ecad0fb610" name="ant" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="b9882032a89398ccc435ea3f2cc5f383f3806e1488d54ed165d5db3e8e96c8c4" name="ant" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="0d40ab369f898d2ac65d3251096b037f1b98b59f4b119999a43e0e09f3c1b789" name="ant" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="1a97373c1c9d3facd0b58860a6fa1d173fba2957fcabcb5aa8c5c2f249ea7d9f" name="ant-antlr" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="f66b1883ac47296f7edd4b822d09abb2362a58cc0bca086a9b0d4bec85459976" name="ant-antlr" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="388ecc48785ae0549dac96f85df3a31f178b1ae12f8f7d36ec1c7ae80360208c" name="ant-antlr" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="ac8fffaa3fd6850772ec7a4dc2144949972ce6fe39725b24afcc0a8610e0c4d9" name="ant-antlr" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="9675fd504ca9496ad7e9ef51f95a51264e621f86761d210e3fbb15ec400b3788" name="ant-apache-bcel" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="680f37ebf9ba30abb395a5231813435c227dd7cdeb1c1e630517c9268c3b6ecb" name="ant-apache-bcel" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="71e3b4f01d8302672600056fac0ff43772696f015ee01e88800bfa5bb4da686f" name="ant-apache-bsf" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="3e6a9f011f07ca50b3416e350c190be0dd1229a9f7fc0a3ccdbd8c388e63d49b" name="ant-apache-bsf" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="368be49745f104d29e59b49c88323c7be2b26d9aa17dc77aa36971c512a9ff14" name="ant-apache-log4j" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="a0a923e2540c0cb9d64987086bdd42fee4565f80cb4cb43986460e99ec9a4df2" name="ant-apache-log4j" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="3c81786fc6c55af109af9f5c839e4efa9f3cee0d2c001fdbbb43230f6a17e921" name="ant-apache-oro" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="9e0b4d0496a46609dacba151e352c100f10e18cb7fdc84f65a7b2df1896abf70" name="ant-apache-oro" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="f85184bd1ca83900e99a0159ae3273580b4598e08dfd16227bd8b39a6dca2869" name="ant-apache-regexp" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="f318cacb16377b368dc6a4c8479b1ab8f7581f1eca7c82301e38a5a529befb9c" name="ant-apache-regexp" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="52309cbbca2e73fcf8744d90e8fc3e9415075f768191804e5cc2aa81e86b7896" name="ant-apache-resolver" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="b3d5ddbdff5372afbd41701a026252cfc19463bfd2f7bbd439048ae5292986ce" name="ant-apache-resolver" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="7da998f26ff5924ba7977be930b7d6a57420c58a771b04dbd0a74f6f4a43f228" name="ant-apache-xalan2" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="02fa94681c51f34d1b90d1e28e2f2a3c718f9b9c54b1899ea26833b2065a2380" name="ant-apache-xalan2" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="35382fd3d9e6ad3b4d30e77f57b032c858fa281d48e3a836841ef9b2b92049df" name="ant-commons-logging" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="899c1c84e5088d42f3f1ce045d0ee2ae3d06bd7d5978c86f65d32d72f7d9bc64" name="ant-commons-logging" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="6a3e5bb99604d1d2549fdfc3fb64a685ffadab5ddb151621733accf52f3ec921" name="ant-commons-net" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="5ba609a561e03a0b1b08028a29432825ff7085eb2e2277b7e35c0f377755aec6" name="ant-commons-net" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="fbc5f9d14a3c79ca97a51ebb4b9a6ab48d1cc9adf811f9de5f96342f0a873988" name="ant-imageio" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="56226ce87d5700d02788ca8d40c448124b02274d766113ae607b6a1d9d2f13ca" name="ant-imageio" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="be421c463f56b84178154364f72725daea51071bafd8cbbf04c3b1feb9c493bc" name="ant-jakartamail" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="734bc8cb91d7d53872c268781bd344ab1a844df4ea6889987a3b3e370c6e2b95" name="ant-jakartamail" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="fbc12591a5ecd2d7eed791a024d6d4542fd07a1b392a937ff577ec99f8699a15" name="ant-javamail" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="bda0a2f2307a920719fbe2ea909fe35b1ae115113ff45c7c1da709a4e5ece9c9" name="ant-javamail" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="6179b5bc9a84f59bb6eebd4bb1c653b57390c2d6e7da0ecd7ca06fbdd3d5ff33" name="ant-jdepend" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="6621f290d1de04c58f9052d9fc11ff44a4a4c45709e00f8e7ac3d3279a083071" name="ant-jdepend" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="8650ca83dac1c6e98b14778f4b1e80da0c68d59dab38b19ed6f2a2625fc18750" name="ant-jmf" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="092bc1cf0a5cb899e517f479f2e754616e3295c2c9ef799f6c01efe42e342eb8" name="ant-jmf" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="120d168cb500b0c10dbd858a5598eca680d6655a7d8ce7eac189a25e9e43c063" name="ant-jsch" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="8fbb1732d45341675fd4e280dc837c6471e6097f75e97755d64611301ac80881" name="ant-jsch" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="de561ed662bbe9a4b0c6c2a0c776a5f609304ddd2815f32d4fe9059fb06a8d99" name="ant-junit" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="be23b6e110d357905214d8c5679a352c3a3405c09ce78b30e68eea4ba21f3493" name="ant-junit" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="f5fce8da1c8b1de35aecb37313ec2e76c147fd20935038f1bedcc6aba0517688" name="ant-junit" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="f99e6f074de983ad70babcd752e0ac1bc3153ce65821e375a2f89e3163198c11" name="ant-junit" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="0b6feffb53325df3e9b21520964a1c2f0bd96322e893fd44a7c07887ce99512f" name="ant-junit5" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="273c0417a7d5389c8db27a9fe7bb54026788dfe6cd971ddafae0d3f97f144e59" name="ant-junit5" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="35454e30dcd36741439151137383f427509bec9fecf061cba6ab281264f7109d" name="ant-junit5" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="6558fa5ce673952c914bd452a04f475780f8cb30885c879a422287d672e3348f" name="ant-junit5" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="f610bd3257fc3d48f856d22237487660624e4df6fa53eb2c088830a7320f9a1a" name="ant-manual" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="63b66becbacc143f8c26f85376ba405fc88eac2a67ae56fb39af6af2650bc49a" name="ant-manual" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="3b2195c79c9090ff69f57495ffaae2e7d676e50b1aee3117136478d04f764492" name="ant-scripts" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="c1df7692eca1703c8dce1afe8773e67a0b795b436bc8ee194976fec26e00a2ec" name="ant-scripts" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="5f191773d5849d059b32eb6d338a2729a40bf2c06d63606fe162bb7958eb865f" name="ant-swing" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="439ee0c9ce3e48865f81400ce35e1b467da890d91fd750f83a089737b710b934" name="ant-swing" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="cc8ab96f7397814a3908ee5ff25ae406de7ccb9dd3f9706a94c140d645b06543" name="ant-testutil" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="5582a1c53e2b452ccb77dc1232caadbef1fd47ef6bb5fe60490da51618dfc8d5" name="ant-testutil" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="eb1138642cd6442cdf7436ce80b27151af201676ee27b8e66f65edd5bf419096" name="ant-xz" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="8262dff4d80daf4e595ba6875fce058d652cd7b7237de289a118673ce99802eb" name="ant-xz" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="07062ac75e044b6eddc3bbb0cfff3a18a052bd2f6c81d46d6cf95b8b2db1bf66" name="aom-tools" arch="aarch64">
  <version epoch="0" ver="3.7.1" rel="150600.3.3.1"/>
  <changelog author="elimat@opensuse.org" date="1614600000">- Update to version 2.0.2:
  * Prepare for the libaom v2.0.2 release
  * Call av1_setup_frame_size() when dropping a frame
  * Avoid memset in filter_intra_predictor module
  * Fix a typo bug in apply_temporal_filter_planewise
  * Modify the assertion in temporal filter intrinsics
  * Fix unit test ThreadTestLarge.EncoderResultTest/49
  * Add -Wimplicit-function-declaration as C flag only
  * Update CHANGELOG for libaom v2.0.1
  * Set allow_screen_content_tools to 0 in rt mode
  * chroma_check: don't access UV planes if monochrome</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620648000">- Update to version 3.1.0 (bsc#1185843):
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.1.0
  This release adds an "all intra" mode to the encoder, which significantly
  speeds up the encoding of AVIF still images at speed 6.
  - Upgrading:
    All intra mode for encoding AVIF still images and AV1 all intra videos:
    AOM_USAGE_ALL_INTRA (2) can be passed as the 'usage' argument to
    aom_codec_enc_config_default().
    New encoder control IDs added:
  - AV1E_SET_ENABLE_DIAGONAL_INTRA: Enable diagonal (D45 to D203) intra
    prediction modes (0: false, 1: true (default)). Also available as
    "enable-diagonal-intra" for the aom_codec_set_option() function.
    New aom_tune_metric enum value: AOM_TUNE_BUTTERAUGLI. The new aomenc option
  - -tune=butteraugli was added to optimize the encoder’s perceptual quality by
    optimizing the Butteraugli metric. Install libjxl (JPEG XL) and then pass
  - DCONFIG_TUNE_BUTTERAUGLI=1 to the cmake command to enable it.
- Includes 3.0
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.0.0
  This release includes compression efficiency improvement, speed improvement
  for realtime mode, as well as some new APIs.
  - Upgrading:
    Support for PSNR calculation based on stream bit-depth.
    New encoder control IDs added:
  - AV1E_SET_ENABLE_RECT_TX
  - AV1E_SET_VBR_CORPUS_COMPLEXITY_LAP
  - AV1E_GET_BASELINE_GF_INTERVAL
  - AV1E_SET_ENABLE_DNL_DENOISING
    New decoder control IDs added:
  - AOMD_GET_FWD_KF_PRESENT
  - AOMD_GET_FRAME_FLAGS
  - AOMD_GET_ALTREF_PRESENT
  - AOMD_GET_TILE_INFO
  - AOMD_GET_SCREEN_CONTENT_TOOLS_INFO
  - AOMD_GET_STILL_PICTURE
  - AOMD_GET_SB_SIZE
  - AOMD_GET_SHOW_EXISTING_FRAME_FLAG
  - AOMD_GET_S_FRAME_INFO
    New aom_tune_content enum value: AOM_CONTENT_FILM
    New aom_tune_metric enum value: AOM_TUNE_VMAF_NEG_MAX_GAIN
    Coefficient and mode update can be turned off via
    AV1E_SET_{COEFF/MODE}_COST_UPD_FREQ.
    New key &amp; value API added, available with aom_codec_set_option() function.
    Scaling API expanded to include 1/4, 3/4 and 1/8.
  - Enhancements:
    Better multithreading performance with realtime mode.
    New speed 9 setting for faster realtime encoding.
    Smaller binary size with low bitdepth and realtime only build.
    Temporal denoiser and its optimizations on x86 and Neon.
    Optimizations for scaling.
    Faster encoding with speed settings 2 to 6 for good encoding mode.
    Improved documentation throughout the library, with function level
    documentation, tree view and support for the dot tool.
  - Bug fixes:
    Aside from those mentioned in v2.0.1 and v2.0.2, this release includes the
    following bug fixes:
    Issue 2940: Segfault when encoding with --use-16bit-internal and --limit &gt; 1
    Issue 2941: Decoder mismatch with --rt --bit-depth=10 and --cpu-used=8
    Issue 2895: mingw-w64 i686 gcc fails to build
    Issue 2874: Separate ssse3 functions from sse2 file.</changelog>
  <changelog author="rpm@fthiessen.de" date="1625227200">- Update to version 3.1.1
  * Fix vmaf model initialization error when not set to tune=vmaf
  * Fix consistent crash on near-static screen content, keyframe
    related
  * Fix tune=butteraugli mode
- Disable NEON on arm where not available.</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- Update to version 3.1.2:
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.2
  * Avoid chroma resampling for 420mpeg2 input
  * Check array has two elements before using index 1
  * Fix DecodeScalabilityTest failure in realtime only
  * Store temporal_id and spatial_id of decoded frame
  * exports.cmake: use APPLE and WIN32 and use def for mingw-w64</changelog>
  <changelog author="pgajdos@suse.com" date="1629892801">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1633694400">- Update to version 3.1.3:
  * Update CHANGELOG for v3.1.3-rc2
  * Detect chroma subsampling more directly
  * Detect chroma subsampling more directly
  * image2yuvconfig() should calculate uv_crop_width
  * aom/aom_encoder.h: remove configure option reference
  * aom_encoder.h: fix rc_overshoot_pct range
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.3
  * aom_install: don't exclude msvc from install
  * aom_install: use relpath for install
  * aom_install: Install lib dlls to bindir</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634126400">- fix service data</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1634299200">- Update to version 3.2.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, as well
    as some new features.
  * New Features:
    + Introduced speeds 7, 8, and 9 for all intra mode.
    + Introduced speed 10 for real time mode.
    + Introduced an API that allows external partition decisions.
    + SVC: added support for compound prediction.
    + SVC: added support for fixed SVC modes.
  * Compression Efficiency Improvements:
    + Intra-mode search improvement.
    + Improved real time (RT) mode BDrate savings by ~5% (RT speed
    5) and ~12% (RT speed 6). The improvement was measured on the
    video conference set.
    + Improved real time mode for nonrd path (speed 7, 8, 9):
    BDrate gains of ~3-5%.
    + Rate control and RD adjustments based on ML research in VP9.
    Gains of ~0.5-1.0% for HD.
  * Perceptual Quality Improvements:
    + Added a new mode --deltaq-mode=3 to improve perceptual
    quality based on a differential contrast model for still
    images.
    + Added a new mode –deltaq-mode=4 to improve perceptual quality
    based on user rated cq_level data set for still images.
    + Weighting of some intra mode and partition size choices to
    better manage and retain texture.
  * Speedup and Memory Optimizations:
    + Further improved 2-pass good quality encoder speed:
    . Speed 2 speedup: 18%
    . Speed 3 speedup: 22%
    . Speed 4 speedup: 37%
    . Speed 5 speedup: 30%
    . Speed 6 speedup: 20%
    + Optimized the real time encoder (measured on the video
    conference set):
    . RT speed 5 speedup: 110%
    . RT speed 6 speedup: 77%
  * Bug Fixes
    + Issue 3069: Fix one-pass mode keyframe placement off-by-one
    error.
    + Issue 3156: Fix a bug in av1_quantize_lp AVX2 optimization.
- Drop libaom-CVE-2021-30474.patch: Fixed upstream.
- Drop libaom-CVE-2021-30475.patch: Fixed upstream.
- Remove changesgenerate option from _service file, use data from
  CHANGELOG to fill .changes instead as it it much nicer and human
  readable than just a list of commit messages.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645185600">- Update to version 3.3.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, some
    new features, and several bug fixes.
  * New Features
  - AV1 RT: Introducing CDEF search level 5
  - Changed real time speed 4 to behave the same as real time
    speed 5
  - Add --deltaq-strength
  - rtc: Allow scene-change and overshoot detection for svc
  - rtc: Intra-only frame for svc
  - AV1 RT: Option 2 for codec control AV1E_SET_ENABLE_CDEF to
    disable CDEF on non-ref frames
  - New codec controls AV1E_SET_LOOPFILTER_CONTROL and
    AOME_GET_LOOPFILTER_LEVEL
  - Improvements to three pass encoding
  * Compression Efficiency Improvements: Overall compression gains:
    0.6%
  * Perceptual Quality Improvements
  - Improves the perceptual quality of high QP encoding for
    delta-q mode 4
  - Auto select noise synthesis level for all intra
  * Speedup and Memory Optimizations
  - Added many SSE2 optimizations.
  - Good quality 2-pass encoder speedups:
    o Speed 2: 9%
    o Speed 3: 12.5%
    o Speed 4: 8%
    o Speed 5: 3%
    o Speed 6: 4%
  - Real time mode encoder speedups:
    o Speed 5: 2.6% BDRate gain, 4% speedup
    o Speed 6: 3.5% BDRate gain, 4% speedup
    o Speed 9: 1% BDRate gain, 3% speedup
    o Speed 10: 3% BDRate gain, neutral speedup
  - All intra encoding speedups (AVIF):
    o Single thread - speed 6: 8%
    o Single thread - speed 9: 15%
    o Multi thread(8) - speed 6: 14%
    o Multi thread(8) - speed 9: 34%
  * Bug Fixes
  - Issue 3163: Segmentation fault when using
  - -enable-keyframe-filtering=2
  - Issue 2436: Integer overflow in av1_warp_affine_c()
  - Issue 3226: armv7 build failure due to gcc-11
  - Issue 3195: Bug report on libaom (AddressSanitizer:
    heap-buffer-overflow)
  - Issue 3191: Bug report on libaom (AddressSanitizer: SEGV on
    unknown address)
- Drop libaom-devel Requires from libaom-devel-doc sub-package: We
  do not need the devel package to be able to read the devel
  documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1662292800">- Update to version 3.4.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. There are no ABI or API breaking changes in
    this release.
  * New Features:
  - New --dist-metric flag with "qm-psnr" value to use
    quantization matrices in the distortion computation for RD
    search. The default value is "psnr".
  - New command line option "--auto-intra-tools-off=1" to make
    all-intra encoding faster for high bit rate under
    "--deltaq-mode=3" mode.
  - New rate control library aom_av1_rc for real-time hardware
    encoders. Supports CBR for both one spatial layer and SVC.
  - New image format AOM_IMG_FMT_NV12 can be used as input to the
    encoder. The presence of AOM_IMG_FMT_NV12 can be detected at
    compile time by checking if the macro AOM_HAVE_IMG_FMT_NV12
    is defined.
  - New codec controls for the encoder:
    o AV1E_SET_AUTO_INTRA_TOOLS_OFF. Only in effect if
  - -deltaq-mode=3.
    o AV1E_SET_RTC_EXTERNAL_RC
    o AV1E_SET_FP_MT. Only supported if libaom is built with
  - DCONFIG_FRAME_PARALLEL_ENCODE=1.
    o AV1E_GET_TARGET_SEQ_LEVEL_IDX
  - New key-value pairs for the key-value API:
    o --auto-intra-tools-off=0 (default) or 1. Only in effect if
  - -deltaq-mode=3.
    o --strict-level-conformance=0 (default) or 1
    o --fp-mt=0 (default) or 1. Only supported if libaom is built
    with -DCONFIG_FRAME_PARALLEL_ENCODE=1.
  - New aomenc options (not supported by the key-value API):
    o --nv12
  * Compression Efficiency Improvements:
  - Correctly calculate SSE for high bitdepth in skip mode, 0.2%
    to 0.6% coding gain.
  - RTC at speed 9/10: BD-rate gain of ~4/5%
  - RTC screen content coding: many improvements for real-time
    screen at speed 10 (quality, speedup, and rate control), up
    to high resolutions (1080p).
  - RTC-SVC: fixes to make intra-only frames work for spatial
    layers.
  - RTC-SVC: quality improvements for temporal layers.
  - AV1 RT: A new passive rate control strategy for screen
    content, an average of 7.5% coding gain, with some clips of
    20+%. The feature is turned off by default due to higher bit
    rate variation.
  * Perceptual Quality Improvements:
  - RTC: Visual quality improvements for high speeds (9/10)
  - Improvements in coding quality for all intra mode
  * Speedup and Memory Optimizations:
  - ~10% speedup in good quality mode encoding.
  - ~7% heap memory reduction in good quality encoding mode for
    speed 5 and 6.
  - Ongoing improvements to intra-frame encoding performance on
    Arm
  - Faster encoding speed for "--deltaq-mode=3" mode.
  - ~10% speedup for speed 5/6, ~15% speedup for speed 7/8, and
    ~10% speedup for speed 9/10 in real time encoding mode
  - ~20% heap memory reduction in still-picture encoding mode for
    360p-720p resolutions with multiple threads
  - ~13% speedup for speed 6 and ~12% speedup for speed 9 in
    still-picture encoding mode.
  - Optimizations to improve multi-thread efficiency for
    still-picture encoding mode.
  * Bug Fixes:
  - b/204460717: README.md: replace master with main
  - b/210677928: libaom disable_order is surprising for
    max_reference_frames=3
  - b/222461449: -DCONFIG_TUNE_BUTTERAUGLI=1 broken
  - b/227207606: write_greyscale writes incorrect chroma in
    highbd mode
  - b/229955363: Integer-overflow in linsolve_wiener
  - https://crbug.com/aomedia/2032
  - https://crbug.com/aomedia/2397
  - https://crbug.com/aomedia/2563
  - https://crbug.com/aomedia/2815
  - https://crbug.com/aomedia/3009
  - https://crbug.com/aomedia/3018
  - https://crbug.com/aomedia/3045
  - https://crbug.com/aomedia/3101
  - https://crbug.com/aomedia/3130
  - https://crbug.com/aomedia/3173
  - https://crbug.com/aomedia/3184
  - https://crbug.com/aomedia/3187
  - https://crbug.com/aomedia/3190
  - https://crbug.com/aomedia/3195
  - https://crbug.com/aomedia/3197
  - https://crbug.com/aomedia/3201
  - https://crbug.com/aomedia/3202
  - https://crbug.com/aomedia/3204
  - https://crbug.com/aomedia/3205
  - https://crbug.com/aomedia/3207
  - https://crbug.com/aomedia/3208
  - https://crbug.com/aomedia/3209
  - https://crbug.com/aomedia/3213
  - https://crbug.com/aomedia/3214
  - https://crbug.com/aomedia/3219
  - https://crbug.com/aomedia/3222
  - https://crbug.com/aomedia/3223
  - https://crbug.com/aomedia/3225
  - https://crbug.com/aomedia/3226
  - https://crbug.com/aomedia/3228
  - https://crbug.com/aomedia/3232
  - https://crbug.com/aomedia/3236
  - https://crbug.com/aomedia/3237
  - https://crbug.com/aomedia/3238
  - https://crbug.com/aomedia/3240
  - https://crbug.com/aomedia/3243
  - https://crbug.com/aomedia/3244
  - https://crbug.com/aomedia/3246
  - https://crbug.com/aomedia/3248
  - https://crbug.com/aomedia/3250
  - https://crbug.com/aomedia/3251
  - https://crbug.com/aomedia/3252
  - https://crbug.com/aomedia/3255
  - https://crbug.com/aomedia/3257
  - https://crbug.com/aomedia/3259
  - https://crbug.com/aomedia/3260
  - https://crbug.com/aomedia/3267
  - https://crbug.com/aomedia/3268
  - https://crbug.com/aomedia/3269
  - https://crbug.com/aomedia/3276
  - https://crbug.com/aomedia/3278
  - https://crbug.com/chromium/1290068
  - https://crbug.com/chromium/1303237
  - https://crbug.com/chromium/1304990
  - https://crbug.com/chromium/1321141
  - https://crbug.com/chromium/1321388
  - https://crbug.com/oss-fuzz/44846
  - https://crbug.com/oss-fuzz/44856
  - https://crbug.com/oss-fuzz/44862
  - https://crbug.com/oss-fuzz/44904
  - https://crbug.com/oss-fuzz/45056</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1663848000">- Update to version 3.5.0:
  * This release is ABI compatible with the last one, including
    speedup and memory optimizations, and new APIs and features.
  * New Features
  - Support for frame parallel encode for larger number of
    threads. --fp-mt flag is available for all build
    configurations.
  - New codec control AV1E_GET_NUM_OPERATING_POINTS
  * Speedup and Memory Optimizations
  - Speed-up multithreaded encoding for good quality mode for
    larger number of threads through frame parallel encoding:
    . 30-34% encode time reduction for 1080p, 16 threads, 1x1
    tile configuration (tile_rows x tile_columns)
    . 18-28% encode time reduction for 1080p, 16 threads, 2x4
    tile configuration
    . 18-20% encode time reduction for 2160p, 32 threads, 2x4
    tile configuration
  - 16-20% speed-up for speed=6 to 8 in still-picture encoding
    mode
  - 5-6% heap memory reduction for speed=6 to 10 in real-time
    encoding mode
  - Improvements to the speed for speed=7, 8 in real-time
    encoding mode
  - Improvements to the speed for speed=9, 10 in real-time screen
    encoding mode
  - Optimizations to improve multi-thread efficiency in real-time
    encoding mode
  - 10-15% speed up for SVC with temporal layers
  - SIMD optimizations:
    . Improve av1_quantize_fp_32x32_neon() 1.05x to 1.24x faster
    . Add aom_highbd_quantize_b{,_32x32,_64x64}_adaptive_neon()
    3.15x to 5.6x faster than "C"
    . Improve av1_quantize_fp_64x64_neon() 1.17x to 1.66x faster
    . Add aom_quantize_b_avx2() 1.4x to 1.7x faster than
    aom_quantize_b_avx()
    . Add aom_quantize_b_32x32_avx2() 1.4x to 2.3x faster than
    aom_quantize_b_32x32_avx()
    . Add aom_quantize_b_64x64_avx2() 2.0x to 2.4x faster than
    aom_quantize_b_64x64_ssse3()
    . Add aom_highbd_quantize_b_32x32_avx2() 9.0x to 10.5x faster
    than aom_highbd_quantize_b_32x32_c()
    . Add aom_highbd_quantize_b_64x64_avx2() 7.3x to 9.7x faster
    than aom_highbd_quantize_b_64x64_c()
    . Improve aom_highbd_quantize_b_avx2() 1.07x to 1.20x faster
    . Improve av1_quantize_fp_avx2() 1.13x to 1.49x faster
    . Improve av1_quantize_fp_32x32_avx2() 1.07x to 1.54x faster
    . Improve av1_quantize_fp_64x64_avx2()  1.03x to 1.25x faster
    . Improve av1_quantize_lp_avx2() 1.07x to 1.16x faster
  * Bug fixes including but not limited to
  - aomedia:3206 Assert that skip_width &gt; 0 for deconvolve
    function
  - aomedia:3278 row_mt enc: Delay top-right sync when intraBC is
    enabled
  - aomedia:3282 blend_a64_*_neon: fix bus error in armv7
  - aomedia:3283 FRAME_PARALLEL: Propagate border size to all
    cpis
  - aomedia:3283 RESIZE_MODE: Fix incorrect strides being used
    for motion search
  - aomedia:3286 rtc-svc: Fix to dynamic_enable spatial layers
  - aomedia:3289 rtc-screen: Fix to skipping inter-mode test in
    nonrd
  - aomedia:3289 rtc-screen: Fix for skip newmv on flat blocks
  - aomedia:3299 Fix build failure with CONFIG_TUNE_VMAF=1
  - aomedia:3296 Fix the conflict --enable-tx-size-search=0 with
    nonrd mode --enable-tx-size-search will be ignored in non-rd
    pick mode
  - aomedia:3304 Fix off-by-one error of max w/h in
    validate_config
  - aomedia:3306 Do not use pthread_setname_np on GNU/Hurd
  - aomedia:3325 row-multithreading produces invalid bitstream in
    some cases
  - chromium:1346938, chromium:1338114
  - compiler_flags.cmake: fix flag detection w/cmake 3.17-3.18.2
  - tools/*.py: update to python3
  - aom_configure.cmake: detect PIE and set CONFIG_PIC
  - test/simd_cmp_impl: use explicit types w/CompareSimd*
  - rtc: Fix to disable segm for aq-mode=3
  - rtc: Fix to color_sensitivity in variance partition
  - rtc-screen: Fix bsize in model rd computation for intra
    chroma
  - Fixes to ensure the correct behavior of the encoder
    algorithms (like segmentation, computation of statistics,
    etc.)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1675857600">- Update to version 3.6.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. This release is ABI compatible with the last
    release.
  * New Features:
  - New values 20-27 (corresponding to levels 7.0-7.3 and
    8.0-8.3) for the encoder control
    AV1E_SET_TARGET_SEQ_LEVEL_IDX (note that the proposal to add
    the new levels are still in draft status). The original
    special value 24 (keep level stats only for level monitoring)
    is renumbered as 32.
  - New encoder control AV1E_SET_SKIP_POSTPROC_FILTERING to skip
    the application of post-processing filters on reconstructed
    frame in all intra mode.
  - New encoder option "kf-max-pyr-height": Maximum height of
    pyramid structure used for the GOP starting with a key frame
    (-1 to 5).
  - Make SVC work for screen content.
  - Rate control improvements to reduce frame-size spikes for
    screen content coding.
  - RISC-V architecture support with gcc toolchain.
  * Compression Efficiency Improvements:
  - Peak compression efficiency in VOD setting is improved by 1%.
  - 0.7% - 2.2% RTC encoding BDrate gains for real time speed 8
    to 10.
  - 15% RTC encoding BDrate gains for screen content speed 10.
  * Perceptual Quality Improvements:
  - Resolved a visual quality issue that was reported for high
    resolution clips (2K) for speed 4 and above in VOD use case.
  - Visual quality improvements to screen content coding.
  - Quality improvements to temporal layer RTC coding.
  * Speedup and Memory Optimizations:
  - RTC single-thread encoder speedup:
    . ~6% instruction count reduction for speed 5 and 6.
    . ~15% instruction count reduction for speed 7.
    . ~10% instruction count reduction for speed 8 to 10 (&gt;=360p
    resolutions).
  - RTC multi-thread encoder speedup (beyond single-thread
    speedup):
    . 5-8% encode time reduction for speed 7 to 10.
  - RTC screen-content encoder speedup:
    . 11% instruction count reduction for speed 9 and 10 (&gt;=720p
    resolutions).
  - ~5% reduction in heap memory requirements for RTC, speed 6 to
    10.
  * AVIF:
    . 4-5% speedup for speed 9 in still-picture encoding mode.
    . 3-4% heap memory reduction in still-picture encoding mode
    for 360p-720p resolutions with multiple threads.
  * Bug Fixes:
  - Added a workaround for an AV1 specification bug which makes
    TRANSLATION type global motion models unusable.
  - Fixed AddressSanitizer global-buffer-overflow errors in
    av1/encoder/arm/neon/av1_fwd_txfm2d_neon.c.
  - Fixed AddressSanitizer heap-buffer-overflow error in
    av1_wiener_convolve_add_src_neon().
  - chromium:1393384 Avoid scene detection on spatial resize.
  - aomedia:3308 Remove color artifacts under high motion.
  - aomedia:3310 Avoid out of memory failures with Visual Studio
    2017, 2019, and 2022 for Win32 x86 builds.
  - aomedia:3346 Make SVC work properly for screen content.
  - aomedia:3348 Fix a bug where an uninitialized search_site is
    used.
  - aomedia:3365 Work around what seems like a Visual Studio 2022
    compiler optimization bug.
  - aomedia:3369 Incorrect PSNR values reported by libaom for
    12-bit encode.
- Modernize spec, use cmake_build and ldconfig_scriptlets macros.</changelog>
  <changelog author="fcrozat@suse.com" date="1681992000">- Fix license tag to BSD-2-Clause and AOMPL-1.0.</changelog>
  <changelog author="fcrozat@suse.com" date="1683028800">- Revert to BSD-2-Clause licence tag to only use SPDX valid
  license tag.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1683720000">- Update to version 3.6.1:
  * aomedia:2871: Guard the support of the 7.x and 8.x levels for
    AV1 under the CONFIG_CWG_C013 config flag, and only output the
    7.x and 8.x levels when explicitly requested.
  * aomedia:3382: Choose sb_size by ppi instead of svc.
  * aomedia:3384: Fix fullpel search limits.
  * aomedia:3388: Replace left shift of xq_active by
    multiplication.
  * aomedia:3389: Fix MV clamping in av1_mv_pred.
  * aomedia:3390: set_ld_layer_depth: cap max_layer_depth to
    MAX_ARF_LAYERS.
  * aomedia:3418: Fix MV clamping in av1_int_pro_motion_estimation.
  * aomedia:3429: Move lpf thread data init to
    lpf_pipeline_mt_init().
  * b:266719111: Fix undefined behavior in Arm Neon code.
  * b:269840681: nonrd_opt: align scan tables.
  * rtc: Fix is_key_frame setting in variance partition.
  * Build: Fix build with clang-cl and Visual Studio.</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693569600">- New upstream release 3.7.0
  - New Features
  * New codec controls:
  * AV1E_SET_QUANTIZER_ONE_PASS: Set quantizer for each frame.
  * AV1E_ENABLE_RATE_GUIDE_DELTAQ: enable the rate distribution guided delta
    quantization in all intra mode. The "enable-rate-guide-deltaq" option is
    added for this control.
  * AV1E_SET_RATE_DISTRIBUTION_INFO: set the input file for rate
    distribution used in all intra mode. The "rate-distribution-info" option
    is added for this control.
  * AV1E_GET_LUMA_CDEF_STRENGTH
  * AV1E_SET_BITRATE_ONE_PASS_CBR
  * AOM_SCALING_MODE is extended to include 2/3 and 1/3 scaling.
  * aom_tune_metric is extended to include AOM_TUNE_VMAF_SALIENCY_MAP.
    The "tune" option is extended to include "vmaf_saliency_map".
  * SVC example encoder svc_encoder_rtc is able to use the rate control
    library.
  * Loopfilter level and CDEF filter level is supported by RTC rate control
    library.
  * New speed (--cpu-used) 11, intended for RTC screen sharing, added for
    faster encoding with ~3% bdrate loss with 16% IC (instruction count)
    speedup compared to speed 10.
  - Compression Efficiency Improvements
  * Improved VoD encoding performance
  * 0.1-0.6% BDrate gains for encoding speeds 2 to 6
  * Rate control accuracy improvement in VBR mode
  * RTC encoding improvements
  * Screen content mode: 10-19% BDrate gains for speeds 6 - 10
  * Temporal layers video mode, for speed 10:
  * 2 temporal layers on low resolutions: 13-15% BDrate gain
  * 3 temporal layers on VGA/HD: 3-4% BDrate gain
  - Perceptual Quality Improvements
  * Fixed multiple block and color artifacts for RTC screen content by
  * Incorporating color into RD cost for IDTX
  * Reducing thresholds for palette mode in non RD mode
  * Allowing more palette mode testing
  * Improved color sensitivity for altref in non-RD mode.
  * Reduced video flickering for temporal layer encoding.
  - Speedup and Memory Optimizations
  * Speed up the VoD encoder
  * 2-5% for encoding speed 2 to 4
  * 9-15% for encoding speed 5 to 6
  * ARM
  * Standard bitdepth
  * speed 5: +31%
  * speed 4: +2%
  * speed 3: +9%
  * speed 2: +157%
  * High bitdepth
  * speed 5: +85%
  * RTC speedups
  * Screen content mode
  * 15% IC speedup for speeds 6-8
  * ARM: 7% for speed 9, 3% for speed 10
  * Temporal layers video mode
  * 7% speedup for 3 temporal layers on VGA/HD, for speed 10
  * Single layer video
  * x86: 2% IC speedup for speeds 7-10
  * ARM: 2-4% speedup across speeds 5-10
  - Bug Fixes
  * aomedia:3261 Assertion failed when encoding av1 with film grain and
    '--monochrome' flag
  * aomedia:3276 ensure all allocations are checked (partial fix)
  * aomedia:3451 The libaom library calls exit()
  * aomedia:3450 enable -Wshadow for C++ sources
  * aomedia:3449 Test Seg Faults After
    b459af3e345be402db052a143fcc5383d4b74cbd
  * aomedia:3416 prune unused symbols / restrict symbol visibility
  * aomedia:3443 Jenkins failure:
    UninstantiatedParameterizedTestSuite&lt;EstimateNoiseTest&gt;
  * aomedia:3434 realtime failures with CONFIG_BITSTREAM_DEBUG=1
  * aomedia:3433 DeltaqModeTest crash w/row_mt=0
  * aomedia:3429 Encoder crash when turn on both ExternalResize and
    g_threads &gt; 2
  * aomedia:3438 Build failure with
    `-DSANITIZE=address -DBUILD_SHARED_LIBS=ON` when using clang.
  * aomedia:3435 Block artifacts when scrolling with AV1 in screen sharing
    scenarios
  * aomedia:3170 vmaf tune presets produce extreme glitches in one scene
  * aomedia:3401 Building shared libaom with MSVC results in a race condition
    with the export library
  * aomedia:3420 Floating point exception in av1_tpl_get_frame_importance()
  * aomedia:3424 heap-buffer-overflow in ScaleFilterCols_16_C() (SIGABRT)
  * aomedia:3417 examples/svc_encoder_rtc.c is using internal macros and
    functions
  * aomedia:3372 SEGV in assign_frame_buffer_p av1_common_int.h
  * aomedia:3130 'cpu-features.h' file not found on Android NDK 22
  * aomedia:3415 Encoder/decoder mismatch for svc_encoder_rtc running
    1 SL 3 TL
  * aomedia:3412 Lossless Mode Fails Loopback Bit Test
  * aomedia:3409 The use of AV1_VAR_OFFS in av1/encoder/var_based_part.c is
    incorrect for high bit depths
  * aomedia:3403 test_libaom fails with error message
    "feenableexcept() failed" on Linux arm
  * aomedia:3370 Random color block at fast motion area
  * aomedia:3393 Assertion failure in av1_convolve_2d_sr_c()
  * aomedia:3392 Strong artifacting for high bit-depth real-time
  * aomedia:3376 aomenc --threads=10 --deltaq-mode=3 crashes after
    "Allintra: multi-threading of calculating differential contrast"
  * aomedia:3380 Crashes and ASan and TSan errors in deltaq-mode=3
    multithreading code
  * chromium:1410766 heap-buffer-overflow in aom_yv12_copy_v_c
  * Cannot set level via AV1E_SET_TARGET_SEQ_LEVEL_IDX
  * Encoding failure due to the use of loop restoration with unintended use of
    lossless mode.
  * Signed integer overflow in scan_past_frames
  * Signed integer overflow in update_a_sep_sym
  * Flickering in AV1 1440p/2160p HDR transcodes
  * Fixed artifacts with screen share at encoder speed 10
  * Fixed prediction setup for IDTX
- Use system libraries instead of vendored ones
  * system-gtest.patch
  * system-yuv.patch
- Enable debuginfo also on modules written in assembly
- Enable building PowerPC-specific optimizations
- Enable Neon optimized code on ARM and fix runtime CPU detection
- Fix missing images in documentation</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693915200">- Split docs to multibuild to avoid dependency cycle</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701777600">- Update to version 3.7.1:
  * Bug Fixes:
  - aomedia:3349: heap overflow when increasing resolution
  - aomedia:3478: GCC 12.2.0 emits a -Wstringop-overflow warning
    on aom/av1/encoder/motion_search_facade.c
  - aomedia:3489: Detect encoder and image high bit depth
    mismatch
  - aomedia:3491: heap-buffer-overflow on frame size change
  - b/303023614:  Segfault at encoding time for high bit depth
    images
- Switch buildtime compression to zst.</changelog>
  <changelog author="pgajdos@suse.com" date="1718020800">- security update
- added patches
  fix CVE-2024-5171 [bsc#1226020], heap buffer overflow in img_alloc_helper() caused by integer overflow
  + libaom-CVE-2024-5171.patch</changelog>
</package>
<package pkgid="7f481230165fc83a77c68696c9582eb52009f9a0bf7c165becacb71a043b285a" name="aom-tools" arch="ppc64le">
  <version epoch="0" ver="3.7.1" rel="150600.3.3.1"/>
  <changelog author="elimat@opensuse.org" date="1614600000">- Update to version 2.0.2:
  * Prepare for the libaom v2.0.2 release
  * Call av1_setup_frame_size() when dropping a frame
  * Avoid memset in filter_intra_predictor module
  * Fix a typo bug in apply_temporal_filter_planewise
  * Modify the assertion in temporal filter intrinsics
  * Fix unit test ThreadTestLarge.EncoderResultTest/49
  * Add -Wimplicit-function-declaration as C flag only
  * Update CHANGELOG for libaom v2.0.1
  * Set allow_screen_content_tools to 0 in rt mode
  * chroma_check: don't access UV planes if monochrome</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620648000">- Update to version 3.1.0 (bsc#1185843):
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.1.0
  This release adds an "all intra" mode to the encoder, which significantly
  speeds up the encoding of AVIF still images at speed 6.
  - Upgrading:
    All intra mode for encoding AVIF still images and AV1 all intra videos:
    AOM_USAGE_ALL_INTRA (2) can be passed as the 'usage' argument to
    aom_codec_enc_config_default().
    New encoder control IDs added:
  - AV1E_SET_ENABLE_DIAGONAL_INTRA: Enable diagonal (D45 to D203) intra
    prediction modes (0: false, 1: true (default)). Also available as
    "enable-diagonal-intra" for the aom_codec_set_option() function.
    New aom_tune_metric enum value: AOM_TUNE_BUTTERAUGLI. The new aomenc option
  - -tune=butteraugli was added to optimize the encoder’s perceptual quality by
    optimizing the Butteraugli metric. Install libjxl (JPEG XL) and then pass
  - DCONFIG_TUNE_BUTTERAUGLI=1 to the cmake command to enable it.
- Includes 3.0
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.0.0
  This release includes compression efficiency improvement, speed improvement
  for realtime mode, as well as some new APIs.
  - Upgrading:
    Support for PSNR calculation based on stream bit-depth.
    New encoder control IDs added:
  - AV1E_SET_ENABLE_RECT_TX
  - AV1E_SET_VBR_CORPUS_COMPLEXITY_LAP
  - AV1E_GET_BASELINE_GF_INTERVAL
  - AV1E_SET_ENABLE_DNL_DENOISING
    New decoder control IDs added:
  - AOMD_GET_FWD_KF_PRESENT
  - AOMD_GET_FRAME_FLAGS
  - AOMD_GET_ALTREF_PRESENT
  - AOMD_GET_TILE_INFO
  - AOMD_GET_SCREEN_CONTENT_TOOLS_INFO
  - AOMD_GET_STILL_PICTURE
  - AOMD_GET_SB_SIZE
  - AOMD_GET_SHOW_EXISTING_FRAME_FLAG
  - AOMD_GET_S_FRAME_INFO
    New aom_tune_content enum value: AOM_CONTENT_FILM
    New aom_tune_metric enum value: AOM_TUNE_VMAF_NEG_MAX_GAIN
    Coefficient and mode update can be turned off via
    AV1E_SET_{COEFF/MODE}_COST_UPD_FREQ.
    New key &amp; value API added, available with aom_codec_set_option() function.
    Scaling API expanded to include 1/4, 3/4 and 1/8.
  - Enhancements:
    Better multithreading performance with realtime mode.
    New speed 9 setting for faster realtime encoding.
    Smaller binary size with low bitdepth and realtime only build.
    Temporal denoiser and its optimizations on x86 and Neon.
    Optimizations for scaling.
    Faster encoding with speed settings 2 to 6 for good encoding mode.
    Improved documentation throughout the library, with function level
    documentation, tree view and support for the dot tool.
  - Bug fixes:
    Aside from those mentioned in v2.0.1 and v2.0.2, this release includes the
    following bug fixes:
    Issue 2940: Segfault when encoding with --use-16bit-internal and --limit &gt; 1
    Issue 2941: Decoder mismatch with --rt --bit-depth=10 and --cpu-used=8
    Issue 2895: mingw-w64 i686 gcc fails to build
    Issue 2874: Separate ssse3 functions from sse2 file.</changelog>
  <changelog author="rpm@fthiessen.de" date="1625227200">- Update to version 3.1.1
  * Fix vmaf model initialization error when not set to tune=vmaf
  * Fix consistent crash on near-static screen content, keyframe
    related
  * Fix tune=butteraugli mode
- Disable NEON on arm where not available.</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- Update to version 3.1.2:
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.2
  * Avoid chroma resampling for 420mpeg2 input
  * Check array has two elements before using index 1
  * Fix DecodeScalabilityTest failure in realtime only
  * Store temporal_id and spatial_id of decoded frame
  * exports.cmake: use APPLE and WIN32 and use def for mingw-w64</changelog>
  <changelog author="pgajdos@suse.com" date="1629892801">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1633694400">- Update to version 3.1.3:
  * Update CHANGELOG for v3.1.3-rc2
  * Detect chroma subsampling more directly
  * Detect chroma subsampling more directly
  * image2yuvconfig() should calculate uv_crop_width
  * aom/aom_encoder.h: remove configure option reference
  * aom_encoder.h: fix rc_overshoot_pct range
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.3
  * aom_install: don't exclude msvc from install
  * aom_install: use relpath for install
  * aom_install: Install lib dlls to bindir</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634126400">- fix service data</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1634299200">- Update to version 3.2.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, as well
    as some new features.
  * New Features:
    + Introduced speeds 7, 8, and 9 for all intra mode.
    + Introduced speed 10 for real time mode.
    + Introduced an API that allows external partition decisions.
    + SVC: added support for compound prediction.
    + SVC: added support for fixed SVC modes.
  * Compression Efficiency Improvements:
    + Intra-mode search improvement.
    + Improved real time (RT) mode BDrate savings by ~5% (RT speed
    5) and ~12% (RT speed 6). The improvement was measured on the
    video conference set.
    + Improved real time mode for nonrd path (speed 7, 8, 9):
    BDrate gains of ~3-5%.
    + Rate control and RD adjustments based on ML research in VP9.
    Gains of ~0.5-1.0% for HD.
  * Perceptual Quality Improvements:
    + Added a new mode --deltaq-mode=3 to improve perceptual
    quality based on a differential contrast model for still
    images.
    + Added a new mode –deltaq-mode=4 to improve perceptual quality
    based on user rated cq_level data set for still images.
    + Weighting of some intra mode and partition size choices to
    better manage and retain texture.
  * Speedup and Memory Optimizations:
    + Further improved 2-pass good quality encoder speed:
    . Speed 2 speedup: 18%
    . Speed 3 speedup: 22%
    . Speed 4 speedup: 37%
    . Speed 5 speedup: 30%
    . Speed 6 speedup: 20%
    + Optimized the real time encoder (measured on the video
    conference set):
    . RT speed 5 speedup: 110%
    . RT speed 6 speedup: 77%
  * Bug Fixes
    + Issue 3069: Fix one-pass mode keyframe placement off-by-one
    error.
    + Issue 3156: Fix a bug in av1_quantize_lp AVX2 optimization.
- Drop libaom-CVE-2021-30474.patch: Fixed upstream.
- Drop libaom-CVE-2021-30475.patch: Fixed upstream.
- Remove changesgenerate option from _service file, use data from
  CHANGELOG to fill .changes instead as it it much nicer and human
  readable than just a list of commit messages.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645185600">- Update to version 3.3.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, some
    new features, and several bug fixes.
  * New Features
  - AV1 RT: Introducing CDEF search level 5
  - Changed real time speed 4 to behave the same as real time
    speed 5
  - Add --deltaq-strength
  - rtc: Allow scene-change and overshoot detection for svc
  - rtc: Intra-only frame for svc
  - AV1 RT: Option 2 for codec control AV1E_SET_ENABLE_CDEF to
    disable CDEF on non-ref frames
  - New codec controls AV1E_SET_LOOPFILTER_CONTROL and
    AOME_GET_LOOPFILTER_LEVEL
  - Improvements to three pass encoding
  * Compression Efficiency Improvements: Overall compression gains:
    0.6%
  * Perceptual Quality Improvements
  - Improves the perceptual quality of high QP encoding for
    delta-q mode 4
  - Auto select noise synthesis level for all intra
  * Speedup and Memory Optimizations
  - Added many SSE2 optimizations.
  - Good quality 2-pass encoder speedups:
    o Speed 2: 9%
    o Speed 3: 12.5%
    o Speed 4: 8%
    o Speed 5: 3%
    o Speed 6: 4%
  - Real time mode encoder speedups:
    o Speed 5: 2.6% BDRate gain, 4% speedup
    o Speed 6: 3.5% BDRate gain, 4% speedup
    o Speed 9: 1% BDRate gain, 3% speedup
    o Speed 10: 3% BDRate gain, neutral speedup
  - All intra encoding speedups (AVIF):
    o Single thread - speed 6: 8%
    o Single thread - speed 9: 15%
    o Multi thread(8) - speed 6: 14%
    o Multi thread(8) - speed 9: 34%
  * Bug Fixes
  - Issue 3163: Segmentation fault when using
  - -enable-keyframe-filtering=2
  - Issue 2436: Integer overflow in av1_warp_affine_c()
  - Issue 3226: armv7 build failure due to gcc-11
  - Issue 3195: Bug report on libaom (AddressSanitizer:
    heap-buffer-overflow)
  - Issue 3191: Bug report on libaom (AddressSanitizer: SEGV on
    unknown address)
- Drop libaom-devel Requires from libaom-devel-doc sub-package: We
  do not need the devel package to be able to read the devel
  documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1662292800">- Update to version 3.4.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. There are no ABI or API breaking changes in
    this release.
  * New Features:
  - New --dist-metric flag with "qm-psnr" value to use
    quantization matrices in the distortion computation for RD
    search. The default value is "psnr".
  - New command line option "--auto-intra-tools-off=1" to make
    all-intra encoding faster for high bit rate under
    "--deltaq-mode=3" mode.
  - New rate control library aom_av1_rc for real-time hardware
    encoders. Supports CBR for both one spatial layer and SVC.
  - New image format AOM_IMG_FMT_NV12 can be used as input to the
    encoder. The presence of AOM_IMG_FMT_NV12 can be detected at
    compile time by checking if the macro AOM_HAVE_IMG_FMT_NV12
    is defined.
  - New codec controls for the encoder:
    o AV1E_SET_AUTO_INTRA_TOOLS_OFF. Only in effect if
  - -deltaq-mode=3.
    o AV1E_SET_RTC_EXTERNAL_RC
    o AV1E_SET_FP_MT. Only supported if libaom is built with
  - DCONFIG_FRAME_PARALLEL_ENCODE=1.
    o AV1E_GET_TARGET_SEQ_LEVEL_IDX
  - New key-value pairs for the key-value API:
    o --auto-intra-tools-off=0 (default) or 1. Only in effect if
  - -deltaq-mode=3.
    o --strict-level-conformance=0 (default) or 1
    o --fp-mt=0 (default) or 1. Only supported if libaom is built
    with -DCONFIG_FRAME_PARALLEL_ENCODE=1.
  - New aomenc options (not supported by the key-value API):
    o --nv12
  * Compression Efficiency Improvements:
  - Correctly calculate SSE for high bitdepth in skip mode, 0.2%
    to 0.6% coding gain.
  - RTC at speed 9/10: BD-rate gain of ~4/5%
  - RTC screen content coding: many improvements for real-time
    screen at speed 10 (quality, speedup, and rate control), up
    to high resolutions (1080p).
  - RTC-SVC: fixes to make intra-only frames work for spatial
    layers.
  - RTC-SVC: quality improvements for temporal layers.
  - AV1 RT: A new passive rate control strategy for screen
    content, an average of 7.5% coding gain, with some clips of
    20+%. The feature is turned off by default due to higher bit
    rate variation.
  * Perceptual Quality Improvements:
  - RTC: Visual quality improvements for high speeds (9/10)
  - Improvements in coding quality for all intra mode
  * Speedup and Memory Optimizations:
  - ~10% speedup in good quality mode encoding.
  - ~7% heap memory reduction in good quality encoding mode for
    speed 5 and 6.
  - Ongoing improvements to intra-frame encoding performance on
    Arm
  - Faster encoding speed for "--deltaq-mode=3" mode.
  - ~10% speedup for speed 5/6, ~15% speedup for speed 7/8, and
    ~10% speedup for speed 9/10 in real time encoding mode
  - ~20% heap memory reduction in still-picture encoding mode for
    360p-720p resolutions with multiple threads
  - ~13% speedup for speed 6 and ~12% speedup for speed 9 in
    still-picture encoding mode.
  - Optimizations to improve multi-thread efficiency for
    still-picture encoding mode.
  * Bug Fixes:
  - b/204460717: README.md: replace master with main
  - b/210677928: libaom disable_order is surprising for
    max_reference_frames=3
  - b/222461449: -DCONFIG_TUNE_BUTTERAUGLI=1 broken
  - b/227207606: write_greyscale writes incorrect chroma in
    highbd mode
  - b/229955363: Integer-overflow in linsolve_wiener
  - https://crbug.com/aomedia/2032
  - https://crbug.com/aomedia/2397
  - https://crbug.com/aomedia/2563
  - https://crbug.com/aomedia/2815
  - https://crbug.com/aomedia/3009
  - https://crbug.com/aomedia/3018
  - https://crbug.com/aomedia/3045
  - https://crbug.com/aomedia/3101
  - https://crbug.com/aomedia/3130
  - https://crbug.com/aomedia/3173
  - https://crbug.com/aomedia/3184
  - https://crbug.com/aomedia/3187
  - https://crbug.com/aomedia/3190
  - https://crbug.com/aomedia/3195
  - https://crbug.com/aomedia/3197
  - https://crbug.com/aomedia/3201
  - https://crbug.com/aomedia/3202
  - https://crbug.com/aomedia/3204
  - https://crbug.com/aomedia/3205
  - https://crbug.com/aomedia/3207
  - https://crbug.com/aomedia/3208
  - https://crbug.com/aomedia/3209
  - https://crbug.com/aomedia/3213
  - https://crbug.com/aomedia/3214
  - https://crbug.com/aomedia/3219
  - https://crbug.com/aomedia/3222
  - https://crbug.com/aomedia/3223
  - https://crbug.com/aomedia/3225
  - https://crbug.com/aomedia/3226
  - https://crbug.com/aomedia/3228
  - https://crbug.com/aomedia/3232
  - https://crbug.com/aomedia/3236
  - https://crbug.com/aomedia/3237
  - https://crbug.com/aomedia/3238
  - https://crbug.com/aomedia/3240
  - https://crbug.com/aomedia/3243
  - https://crbug.com/aomedia/3244
  - https://crbug.com/aomedia/3246
  - https://crbug.com/aomedia/3248
  - https://crbug.com/aomedia/3250
  - https://crbug.com/aomedia/3251
  - https://crbug.com/aomedia/3252
  - https://crbug.com/aomedia/3255
  - https://crbug.com/aomedia/3257
  - https://crbug.com/aomedia/3259
  - https://crbug.com/aomedia/3260
  - https://crbug.com/aomedia/3267
  - https://crbug.com/aomedia/3268
  - https://crbug.com/aomedia/3269
  - https://crbug.com/aomedia/3276
  - https://crbug.com/aomedia/3278
  - https://crbug.com/chromium/1290068
  - https://crbug.com/chromium/1303237
  - https://crbug.com/chromium/1304990
  - https://crbug.com/chromium/1321141
  - https://crbug.com/chromium/1321388
  - https://crbug.com/oss-fuzz/44846
  - https://crbug.com/oss-fuzz/44856
  - https://crbug.com/oss-fuzz/44862
  - https://crbug.com/oss-fuzz/44904
  - https://crbug.com/oss-fuzz/45056</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1663848000">- Update to version 3.5.0:
  * This release is ABI compatible with the last one, including
    speedup and memory optimizations, and new APIs and features.
  * New Features
  - Support for frame parallel encode for larger number of
    threads. --fp-mt flag is available for all build
    configurations.
  - New codec control AV1E_GET_NUM_OPERATING_POINTS
  * Speedup and Memory Optimizations
  - Speed-up multithreaded encoding for good quality mode for
    larger number of threads through frame parallel encoding:
    . 30-34% encode time reduction for 1080p, 16 threads, 1x1
    tile configuration (tile_rows x tile_columns)
    . 18-28% encode time reduction for 1080p, 16 threads, 2x4
    tile configuration
    . 18-20% encode time reduction for 2160p, 32 threads, 2x4
    tile configuration
  - 16-20% speed-up for speed=6 to 8 in still-picture encoding
    mode
  - 5-6% heap memory reduction for speed=6 to 10 in real-time
    encoding mode
  - Improvements to the speed for speed=7, 8 in real-time
    encoding mode
  - Improvements to the speed for speed=9, 10 in real-time screen
    encoding mode
  - Optimizations to improve multi-thread efficiency in real-time
    encoding mode
  - 10-15% speed up for SVC with temporal layers
  - SIMD optimizations:
    . Improve av1_quantize_fp_32x32_neon() 1.05x to 1.24x faster
    . Add aom_highbd_quantize_b{,_32x32,_64x64}_adaptive_neon()
    3.15x to 5.6x faster than "C"
    . Improve av1_quantize_fp_64x64_neon() 1.17x to 1.66x faster
    . Add aom_quantize_b_avx2() 1.4x to 1.7x faster than
    aom_quantize_b_avx()
    . Add aom_quantize_b_32x32_avx2() 1.4x to 2.3x faster than
    aom_quantize_b_32x32_avx()
    . Add aom_quantize_b_64x64_avx2() 2.0x to 2.4x faster than
    aom_quantize_b_64x64_ssse3()
    . Add aom_highbd_quantize_b_32x32_avx2() 9.0x to 10.5x faster
    than aom_highbd_quantize_b_32x32_c()
    . Add aom_highbd_quantize_b_64x64_avx2() 7.3x to 9.7x faster
    than aom_highbd_quantize_b_64x64_c()
    . Improve aom_highbd_quantize_b_avx2() 1.07x to 1.20x faster
    . Improve av1_quantize_fp_avx2() 1.13x to 1.49x faster
    . Improve av1_quantize_fp_32x32_avx2() 1.07x to 1.54x faster
    . Improve av1_quantize_fp_64x64_avx2()  1.03x to 1.25x faster
    . Improve av1_quantize_lp_avx2() 1.07x to 1.16x faster
  * Bug fixes including but not limited to
  - aomedia:3206 Assert that skip_width &gt; 0 for deconvolve
    function
  - aomedia:3278 row_mt enc: Delay top-right sync when intraBC is
    enabled
  - aomedia:3282 blend_a64_*_neon: fix bus error in armv7
  - aomedia:3283 FRAME_PARALLEL: Propagate border size to all
    cpis
  - aomedia:3283 RESIZE_MODE: Fix incorrect strides being used
    for motion search
  - aomedia:3286 rtc-svc: Fix to dynamic_enable spatial layers
  - aomedia:3289 rtc-screen: Fix to skipping inter-mode test in
    nonrd
  - aomedia:3289 rtc-screen: Fix for skip newmv on flat blocks
  - aomedia:3299 Fix build failure with CONFIG_TUNE_VMAF=1
  - aomedia:3296 Fix the conflict --enable-tx-size-search=0 with
    nonrd mode --enable-tx-size-search will be ignored in non-rd
    pick mode
  - aomedia:3304 Fix off-by-one error of max w/h in
    validate_config
  - aomedia:3306 Do not use pthread_setname_np on GNU/Hurd
  - aomedia:3325 row-multithreading produces invalid bitstream in
    some cases
  - chromium:1346938, chromium:1338114
  - compiler_flags.cmake: fix flag detection w/cmake 3.17-3.18.2
  - tools/*.py: update to python3
  - aom_configure.cmake: detect PIE and set CONFIG_PIC
  - test/simd_cmp_impl: use explicit types w/CompareSimd*
  - rtc: Fix to disable segm for aq-mode=3
  - rtc: Fix to color_sensitivity in variance partition
  - rtc-screen: Fix bsize in model rd computation for intra
    chroma
  - Fixes to ensure the correct behavior of the encoder
    algorithms (like segmentation, computation of statistics,
    etc.)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1675857600">- Update to version 3.6.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. This release is ABI compatible with the last
    release.
  * New Features:
  - New values 20-27 (corresponding to levels 7.0-7.3 and
    8.0-8.3) for the encoder control
    AV1E_SET_TARGET_SEQ_LEVEL_IDX (note that the proposal to add
    the new levels are still in draft status). The original
    special value 24 (keep level stats only for level monitoring)
    is renumbered as 32.
  - New encoder control AV1E_SET_SKIP_POSTPROC_FILTERING to skip
    the application of post-processing filters on reconstructed
    frame in all intra mode.
  - New encoder option "kf-max-pyr-height": Maximum height of
    pyramid structure used for the GOP starting with a key frame
    (-1 to 5).
  - Make SVC work for screen content.
  - Rate control improvements to reduce frame-size spikes for
    screen content coding.
  - RISC-V architecture support with gcc toolchain.
  * Compression Efficiency Improvements:
  - Peak compression efficiency in VOD setting is improved by 1%.
  - 0.7% - 2.2% RTC encoding BDrate gains for real time speed 8
    to 10.
  - 15% RTC encoding BDrate gains for screen content speed 10.
  * Perceptual Quality Improvements:
  - Resolved a visual quality issue that was reported for high
    resolution clips (2K) for speed 4 and above in VOD use case.
  - Visual quality improvements to screen content coding.
  - Quality improvements to temporal layer RTC coding.
  * Speedup and Memory Optimizations:
  - RTC single-thread encoder speedup:
    . ~6% instruction count reduction for speed 5 and 6.
    . ~15% instruction count reduction for speed 7.
    . ~10% instruction count reduction for speed 8 to 10 (&gt;=360p
    resolutions).
  - RTC multi-thread encoder speedup (beyond single-thread
    speedup):
    . 5-8% encode time reduction for speed 7 to 10.
  - RTC screen-content encoder speedup:
    . 11% instruction count reduction for speed 9 and 10 (&gt;=720p
    resolutions).
  - ~5% reduction in heap memory requirements for RTC, speed 6 to
    10.
  * AVIF:
    . 4-5% speedup for speed 9 in still-picture encoding mode.
    . 3-4% heap memory reduction in still-picture encoding mode
    for 360p-720p resolutions with multiple threads.
  * Bug Fixes:
  - Added a workaround for an AV1 specification bug which makes
    TRANSLATION type global motion models unusable.
  - Fixed AddressSanitizer global-buffer-overflow errors in
    av1/encoder/arm/neon/av1_fwd_txfm2d_neon.c.
  - Fixed AddressSanitizer heap-buffer-overflow error in
    av1_wiener_convolve_add_src_neon().
  - chromium:1393384 Avoid scene detection on spatial resize.
  - aomedia:3308 Remove color artifacts under high motion.
  - aomedia:3310 Avoid out of memory failures with Visual Studio
    2017, 2019, and 2022 for Win32 x86 builds.
  - aomedia:3346 Make SVC work properly for screen content.
  - aomedia:3348 Fix a bug where an uninitialized search_site is
    used.
  - aomedia:3365 Work around what seems like a Visual Studio 2022
    compiler optimization bug.
  - aomedia:3369 Incorrect PSNR values reported by libaom for
    12-bit encode.
- Modernize spec, use cmake_build and ldconfig_scriptlets macros.</changelog>
  <changelog author="fcrozat@suse.com" date="1681992000">- Fix license tag to BSD-2-Clause and AOMPL-1.0.</changelog>
  <changelog author="fcrozat@suse.com" date="1683028800">- Revert to BSD-2-Clause licence tag to only use SPDX valid
  license tag.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1683720000">- Update to version 3.6.1:
  * aomedia:2871: Guard the support of the 7.x and 8.x levels for
    AV1 under the CONFIG_CWG_C013 config flag, and only output the
    7.x and 8.x levels when explicitly requested.
  * aomedia:3382: Choose sb_size by ppi instead of svc.
  * aomedia:3384: Fix fullpel search limits.
  * aomedia:3388: Replace left shift of xq_active by
    multiplication.
  * aomedia:3389: Fix MV clamping in av1_mv_pred.
  * aomedia:3390: set_ld_layer_depth: cap max_layer_depth to
    MAX_ARF_LAYERS.
  * aomedia:3418: Fix MV clamping in av1_int_pro_motion_estimation.
  * aomedia:3429: Move lpf thread data init to
    lpf_pipeline_mt_init().
  * b:266719111: Fix undefined behavior in Arm Neon code.
  * b:269840681: nonrd_opt: align scan tables.
  * rtc: Fix is_key_frame setting in variance partition.
  * Build: Fix build with clang-cl and Visual Studio.</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693569600">- New upstream release 3.7.0
  - New Features
  * New codec controls:
  * AV1E_SET_QUANTIZER_ONE_PASS: Set quantizer for each frame.
  * AV1E_ENABLE_RATE_GUIDE_DELTAQ: enable the rate distribution guided delta
    quantization in all intra mode. The "enable-rate-guide-deltaq" option is
    added for this control.
  * AV1E_SET_RATE_DISTRIBUTION_INFO: set the input file for rate
    distribution used in all intra mode. The "rate-distribution-info" option
    is added for this control.
  * AV1E_GET_LUMA_CDEF_STRENGTH
  * AV1E_SET_BITRATE_ONE_PASS_CBR
  * AOM_SCALING_MODE is extended to include 2/3 and 1/3 scaling.
  * aom_tune_metric is extended to include AOM_TUNE_VMAF_SALIENCY_MAP.
    The "tune" option is extended to include "vmaf_saliency_map".
  * SVC example encoder svc_encoder_rtc is able to use the rate control
    library.
  * Loopfilter level and CDEF filter level is supported by RTC rate control
    library.
  * New speed (--cpu-used) 11, intended for RTC screen sharing, added for
    faster encoding with ~3% bdrate loss with 16% IC (instruction count)
    speedup compared to speed 10.
  - Compression Efficiency Improvements
  * Improved VoD encoding performance
  * 0.1-0.6% BDrate gains for encoding speeds 2 to 6
  * Rate control accuracy improvement in VBR mode
  * RTC encoding improvements
  * Screen content mode: 10-19% BDrate gains for speeds 6 - 10
  * Temporal layers video mode, for speed 10:
  * 2 temporal layers on low resolutions: 13-15% BDrate gain
  * 3 temporal layers on VGA/HD: 3-4% BDrate gain
  - Perceptual Quality Improvements
  * Fixed multiple block and color artifacts for RTC screen content by
  * Incorporating color into RD cost for IDTX
  * Reducing thresholds for palette mode in non RD mode
  * Allowing more palette mode testing
  * Improved color sensitivity for altref in non-RD mode.
  * Reduced video flickering for temporal layer encoding.
  - Speedup and Memory Optimizations
  * Speed up the VoD encoder
  * 2-5% for encoding speed 2 to 4
  * 9-15% for encoding speed 5 to 6
  * ARM
  * Standard bitdepth
  * speed 5: +31%
  * speed 4: +2%
  * speed 3: +9%
  * speed 2: +157%
  * High bitdepth
  * speed 5: +85%
  * RTC speedups
  * Screen content mode
  * 15% IC speedup for speeds 6-8
  * ARM: 7% for speed 9, 3% for speed 10
  * Temporal layers video mode
  * 7% speedup for 3 temporal layers on VGA/HD, for speed 10
  * Single layer video
  * x86: 2% IC speedup for speeds 7-10
  * ARM: 2-4% speedup across speeds 5-10
  - Bug Fixes
  * aomedia:3261 Assertion failed when encoding av1 with film grain and
    '--monochrome' flag
  * aomedia:3276 ensure all allocations are checked (partial fix)
  * aomedia:3451 The libaom library calls exit()
  * aomedia:3450 enable -Wshadow for C++ sources
  * aomedia:3449 Test Seg Faults After
    b459af3e345be402db052a143fcc5383d4b74cbd
  * aomedia:3416 prune unused symbols / restrict symbol visibility
  * aomedia:3443 Jenkins failure:
    UninstantiatedParameterizedTestSuite&lt;EstimateNoiseTest&gt;
  * aomedia:3434 realtime failures with CONFIG_BITSTREAM_DEBUG=1
  * aomedia:3433 DeltaqModeTest crash w/row_mt=0
  * aomedia:3429 Encoder crash when turn on both ExternalResize and
    g_threads &gt; 2
  * aomedia:3438 Build failure with
    `-DSANITIZE=address -DBUILD_SHARED_LIBS=ON` when using clang.
  * aomedia:3435 Block artifacts when scrolling with AV1 in screen sharing
    scenarios
  * aomedia:3170 vmaf tune presets produce extreme glitches in one scene
  * aomedia:3401 Building shared libaom with MSVC results in a race condition
    with the export library
  * aomedia:3420 Floating point exception in av1_tpl_get_frame_importance()
  * aomedia:3424 heap-buffer-overflow in ScaleFilterCols_16_C() (SIGABRT)
  * aomedia:3417 examples/svc_encoder_rtc.c is using internal macros and
    functions
  * aomedia:3372 SEGV in assign_frame_buffer_p av1_common_int.h
  * aomedia:3130 'cpu-features.h' file not found on Android NDK 22
  * aomedia:3415 Encoder/decoder mismatch for svc_encoder_rtc running
    1 SL 3 TL
  * aomedia:3412 Lossless Mode Fails Loopback Bit Test
  * aomedia:3409 The use of AV1_VAR_OFFS in av1/encoder/var_based_part.c is
    incorrect for high bit depths
  * aomedia:3403 test_libaom fails with error message
    "feenableexcept() failed" on Linux arm
  * aomedia:3370 Random color block at fast motion area
  * aomedia:3393 Assertion failure in av1_convolve_2d_sr_c()
  * aomedia:3392 Strong artifacting for high bit-depth real-time
  * aomedia:3376 aomenc --threads=10 --deltaq-mode=3 crashes after
    "Allintra: multi-threading of calculating differential contrast"
  * aomedia:3380 Crashes and ASan and TSan errors in deltaq-mode=3
    multithreading code
  * chromium:1410766 heap-buffer-overflow in aom_yv12_copy_v_c
  * Cannot set level via AV1E_SET_TARGET_SEQ_LEVEL_IDX
  * Encoding failure due to the use of loop restoration with unintended use of
    lossless mode.
  * Signed integer overflow in scan_past_frames
  * Signed integer overflow in update_a_sep_sym
  * Flickering in AV1 1440p/2160p HDR transcodes
  * Fixed artifacts with screen share at encoder speed 10
  * Fixed prediction setup for IDTX
- Use system libraries instead of vendored ones
  * system-gtest.patch
  * system-yuv.patch
- Enable debuginfo also on modules written in assembly
- Enable building PowerPC-specific optimizations
- Enable Neon optimized code on ARM and fix runtime CPU detection
- Fix missing images in documentation</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693915200">- Split docs to multibuild to avoid dependency cycle</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701777600">- Update to version 3.7.1:
  * Bug Fixes:
  - aomedia:3349: heap overflow when increasing resolution
  - aomedia:3478: GCC 12.2.0 emits a -Wstringop-overflow warning
    on aom/av1/encoder/motion_search_facade.c
  - aomedia:3489: Detect encoder and image high bit depth
    mismatch
  - aomedia:3491: heap-buffer-overflow on frame size change
  - b/303023614:  Segfault at encoding time for high bit depth
    images
- Switch buildtime compression to zst.</changelog>
  <changelog author="pgajdos@suse.com" date="1718020800">- security update
- added patches
  fix CVE-2024-5171 [bsc#1226020], heap buffer overflow in img_alloc_helper() caused by integer overflow
  + libaom-CVE-2024-5171.patch</changelog>
</package>
<package pkgid="638e4c73fdc5d4980a285accdb89d1d2682e31700e0a01be5fa3223fab971fb9" name="aom-tools" arch="s390x">
  <version epoch="0" ver="3.7.1" rel="150600.3.3.1"/>
  <changelog author="elimat@opensuse.org" date="1614600000">- Update to version 2.0.2:
  * Prepare for the libaom v2.0.2 release
  * Call av1_setup_frame_size() when dropping a frame
  * Avoid memset in filter_intra_predictor module
  * Fix a typo bug in apply_temporal_filter_planewise
  * Modify the assertion in temporal filter intrinsics
  * Fix unit test ThreadTestLarge.EncoderResultTest/49
  * Add -Wimplicit-function-declaration as C flag only
  * Update CHANGELOG for libaom v2.0.1
  * Set allow_screen_content_tools to 0 in rt mode
  * chroma_check: don't access UV planes if monochrome</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620648000">- Update to version 3.1.0 (bsc#1185843):
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.1.0
  This release adds an "all intra" mode to the encoder, which significantly
  speeds up the encoding of AVIF still images at speed 6.
  - Upgrading:
    All intra mode for encoding AVIF still images and AV1 all intra videos:
    AOM_USAGE_ALL_INTRA (2) can be passed as the 'usage' argument to
    aom_codec_enc_config_default().
    New encoder control IDs added:
  - AV1E_SET_ENABLE_DIAGONAL_INTRA: Enable diagonal (D45 to D203) intra
    prediction modes (0: false, 1: true (default)). Also available as
    "enable-diagonal-intra" for the aom_codec_set_option() function.
    New aom_tune_metric enum value: AOM_TUNE_BUTTERAUGLI. The new aomenc option
  - -tune=butteraugli was added to optimize the encoder’s perceptual quality by
    optimizing the Butteraugli metric. Install libjxl (JPEG XL) and then pass
  - DCONFIG_TUNE_BUTTERAUGLI=1 to the cmake command to enable it.
- Includes 3.0
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.0.0
  This release includes compression efficiency improvement, speed improvement
  for realtime mode, as well as some new APIs.
  - Upgrading:
    Support for PSNR calculation based on stream bit-depth.
    New encoder control IDs added:
  - AV1E_SET_ENABLE_RECT_TX
  - AV1E_SET_VBR_CORPUS_COMPLEXITY_LAP
  - AV1E_GET_BASELINE_GF_INTERVAL
  - AV1E_SET_ENABLE_DNL_DENOISING
    New decoder control IDs added:
  - AOMD_GET_FWD_KF_PRESENT
  - AOMD_GET_FRAME_FLAGS
  - AOMD_GET_ALTREF_PRESENT
  - AOMD_GET_TILE_INFO
  - AOMD_GET_SCREEN_CONTENT_TOOLS_INFO
  - AOMD_GET_STILL_PICTURE
  - AOMD_GET_SB_SIZE
  - AOMD_GET_SHOW_EXISTING_FRAME_FLAG
  - AOMD_GET_S_FRAME_INFO
    New aom_tune_content enum value: AOM_CONTENT_FILM
    New aom_tune_metric enum value: AOM_TUNE_VMAF_NEG_MAX_GAIN
    Coefficient and mode update can be turned off via
    AV1E_SET_{COEFF/MODE}_COST_UPD_FREQ.
    New key &amp; value API added, available with aom_codec_set_option() function.
    Scaling API expanded to include 1/4, 3/4 and 1/8.
  - Enhancements:
    Better multithreading performance with realtime mode.
    New speed 9 setting for faster realtime encoding.
    Smaller binary size with low bitdepth and realtime only build.
    Temporal denoiser and its optimizations on x86 and Neon.
    Optimizations for scaling.
    Faster encoding with speed settings 2 to 6 for good encoding mode.
    Improved documentation throughout the library, with function level
    documentation, tree view and support for the dot tool.
  - Bug fixes:
    Aside from those mentioned in v2.0.1 and v2.0.2, this release includes the
    following bug fixes:
    Issue 2940: Segfault when encoding with --use-16bit-internal and --limit &gt; 1
    Issue 2941: Decoder mismatch with --rt --bit-depth=10 and --cpu-used=8
    Issue 2895: mingw-w64 i686 gcc fails to build
    Issue 2874: Separate ssse3 functions from sse2 file.</changelog>
  <changelog author="rpm@fthiessen.de" date="1625227200">- Update to version 3.1.1
  * Fix vmaf model initialization error when not set to tune=vmaf
  * Fix consistent crash on near-static screen content, keyframe
    related
  * Fix tune=butteraugli mode
- Disable NEON on arm where not available.</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- Update to version 3.1.2:
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.2
  * Avoid chroma resampling for 420mpeg2 input
  * Check array has two elements before using index 1
  * Fix DecodeScalabilityTest failure in realtime only
  * Store temporal_id and spatial_id of decoded frame
  * exports.cmake: use APPLE and WIN32 and use def for mingw-w64</changelog>
  <changelog author="pgajdos@suse.com" date="1629892801">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1633694400">- Update to version 3.1.3:
  * Update CHANGELOG for v3.1.3-rc2
  * Detect chroma subsampling more directly
  * Detect chroma subsampling more directly
  * image2yuvconfig() should calculate uv_crop_width
  * aom/aom_encoder.h: remove configure option reference
  * aom_encoder.h: fix rc_overshoot_pct range
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.3
  * aom_install: don't exclude msvc from install
  * aom_install: use relpath for install
  * aom_install: Install lib dlls to bindir</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634126400">- fix service data</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1634299200">- Update to version 3.2.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, as well
    as some new features.
  * New Features:
    + Introduced speeds 7, 8, and 9 for all intra mode.
    + Introduced speed 10 for real time mode.
    + Introduced an API that allows external partition decisions.
    + SVC: added support for compound prediction.
    + SVC: added support for fixed SVC modes.
  * Compression Efficiency Improvements:
    + Intra-mode search improvement.
    + Improved real time (RT) mode BDrate savings by ~5% (RT speed
    5) and ~12% (RT speed 6). The improvement was measured on the
    video conference set.
    + Improved real time mode for nonrd path (speed 7, 8, 9):
    BDrate gains of ~3-5%.
    + Rate control and RD adjustments based on ML research in VP9.
    Gains of ~0.5-1.0% for HD.
  * Perceptual Quality Improvements:
    + Added a new mode --deltaq-mode=3 to improve perceptual
    quality based on a differential contrast model for still
    images.
    + Added a new mode –deltaq-mode=4 to improve perceptual quality
    based on user rated cq_level data set for still images.
    + Weighting of some intra mode and partition size choices to
    better manage and retain texture.
  * Speedup and Memory Optimizations:
    + Further improved 2-pass good quality encoder speed:
    . Speed 2 speedup: 18%
    . Speed 3 speedup: 22%
    . Speed 4 speedup: 37%
    . Speed 5 speedup: 30%
    . Speed 6 speedup: 20%
    + Optimized the real time encoder (measured on the video
    conference set):
    . RT speed 5 speedup: 110%
    . RT speed 6 speedup: 77%
  * Bug Fixes
    + Issue 3069: Fix one-pass mode keyframe placement off-by-one
    error.
    + Issue 3156: Fix a bug in av1_quantize_lp AVX2 optimization.
- Drop libaom-CVE-2021-30474.patch: Fixed upstream.
- Drop libaom-CVE-2021-30475.patch: Fixed upstream.
- Remove changesgenerate option from _service file, use data from
  CHANGELOG to fill .changes instead as it it much nicer and human
  readable than just a list of commit messages.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645185600">- Update to version 3.3.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, some
    new features, and several bug fixes.
  * New Features
  - AV1 RT: Introducing CDEF search level 5
  - Changed real time speed 4 to behave the same as real time
    speed 5
  - Add --deltaq-strength
  - rtc: Allow scene-change and overshoot detection for svc
  - rtc: Intra-only frame for svc
  - AV1 RT: Option 2 for codec control AV1E_SET_ENABLE_CDEF to
    disable CDEF on non-ref frames
  - New codec controls AV1E_SET_LOOPFILTER_CONTROL and
    AOME_GET_LOOPFILTER_LEVEL
  - Improvements to three pass encoding
  * Compression Efficiency Improvements: Overall compression gains:
    0.6%
  * Perceptual Quality Improvements
  - Improves the perceptual quality of high QP encoding for
    delta-q mode 4
  - Auto select noise synthesis level for all intra
  * Speedup and Memory Optimizations
  - Added many SSE2 optimizations.
  - Good quality 2-pass encoder speedups:
    o Speed 2: 9%
    o Speed 3: 12.5%
    o Speed 4: 8%
    o Speed 5: 3%
    o Speed 6: 4%
  - Real time mode encoder speedups:
    o Speed 5: 2.6% BDRate gain, 4% speedup
    o Speed 6: 3.5% BDRate gain, 4% speedup
    o Speed 9: 1% BDRate gain, 3% speedup
    o Speed 10: 3% BDRate gain, neutral speedup
  - All intra encoding speedups (AVIF):
    o Single thread - speed 6: 8%
    o Single thread - speed 9: 15%
    o Multi thread(8) - speed 6: 14%
    o Multi thread(8) - speed 9: 34%
  * Bug Fixes
  - Issue 3163: Segmentation fault when using
  - -enable-keyframe-filtering=2
  - Issue 2436: Integer overflow in av1_warp_affine_c()
  - Issue 3226: armv7 build failure due to gcc-11
  - Issue 3195: Bug report on libaom (AddressSanitizer:
    heap-buffer-overflow)
  - Issue 3191: Bug report on libaom (AddressSanitizer: SEGV on
    unknown address)
- Drop libaom-devel Requires from libaom-devel-doc sub-package: We
  do not need the devel package to be able to read the devel
  documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1662292800">- Update to version 3.4.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. There are no ABI or API breaking changes in
    this release.
  * New Features:
  - New --dist-metric flag with "qm-psnr" value to use
    quantization matrices in the distortion computation for RD
    search. The default value is "psnr".
  - New command line option "--auto-intra-tools-off=1" to make
    all-intra encoding faster for high bit rate under
    "--deltaq-mode=3" mode.
  - New rate control library aom_av1_rc for real-time hardware
    encoders. Supports CBR for both one spatial layer and SVC.
  - New image format AOM_IMG_FMT_NV12 can be used as input to the
    encoder. The presence of AOM_IMG_FMT_NV12 can be detected at
    compile time by checking if the macro AOM_HAVE_IMG_FMT_NV12
    is defined.
  - New codec controls for the encoder:
    o AV1E_SET_AUTO_INTRA_TOOLS_OFF. Only in effect if
  - -deltaq-mode=3.
    o AV1E_SET_RTC_EXTERNAL_RC
    o AV1E_SET_FP_MT. Only supported if libaom is built with
  - DCONFIG_FRAME_PARALLEL_ENCODE=1.
    o AV1E_GET_TARGET_SEQ_LEVEL_IDX
  - New key-value pairs for the key-value API:
    o --auto-intra-tools-off=0 (default) or 1. Only in effect if
  - -deltaq-mode=3.
    o --strict-level-conformance=0 (default) or 1
    o --fp-mt=0 (default) or 1. Only supported if libaom is built
    with -DCONFIG_FRAME_PARALLEL_ENCODE=1.
  - New aomenc options (not supported by the key-value API):
    o --nv12
  * Compression Efficiency Improvements:
  - Correctly calculate SSE for high bitdepth in skip mode, 0.2%
    to 0.6% coding gain.
  - RTC at speed 9/10: BD-rate gain of ~4/5%
  - RTC screen content coding: many improvements for real-time
    screen at speed 10 (quality, speedup, and rate control), up
    to high resolutions (1080p).
  - RTC-SVC: fixes to make intra-only frames work for spatial
    layers.
  - RTC-SVC: quality improvements for temporal layers.
  - AV1 RT: A new passive rate control strategy for screen
    content, an average of 7.5% coding gain, with some clips of
    20+%. The feature is turned off by default due to higher bit
    rate variation.
  * Perceptual Quality Improvements:
  - RTC: Visual quality improvements for high speeds (9/10)
  - Improvements in coding quality for all intra mode
  * Speedup and Memory Optimizations:
  - ~10% speedup in good quality mode encoding.
  - ~7% heap memory reduction in good quality encoding mode for
    speed 5 and 6.
  - Ongoing improvements to intra-frame encoding performance on
    Arm
  - Faster encoding speed for "--deltaq-mode=3" mode.
  - ~10% speedup for speed 5/6, ~15% speedup for speed 7/8, and
    ~10% speedup for speed 9/10 in real time encoding mode
  - ~20% heap memory reduction in still-picture encoding mode for
    360p-720p resolutions with multiple threads
  - ~13% speedup for speed 6 and ~12% speedup for speed 9 in
    still-picture encoding mode.
  - Optimizations to improve multi-thread efficiency for
    still-picture encoding mode.
  * Bug Fixes:
  - b/204460717: README.md: replace master with main
  - b/210677928: libaom disable_order is surprising for
    max_reference_frames=3
  - b/222461449: -DCONFIG_TUNE_BUTTERAUGLI=1 broken
  - b/227207606: write_greyscale writes incorrect chroma in
    highbd mode
  - b/229955363: Integer-overflow in linsolve_wiener
  - https://crbug.com/aomedia/2032
  - https://crbug.com/aomedia/2397
  - https://crbug.com/aomedia/2563
  - https://crbug.com/aomedia/2815
  - https://crbug.com/aomedia/3009
  - https://crbug.com/aomedia/3018
  - https://crbug.com/aomedia/3045
  - https://crbug.com/aomedia/3101
  - https://crbug.com/aomedia/3130
  - https://crbug.com/aomedia/3173
  - https://crbug.com/aomedia/3184
  - https://crbug.com/aomedia/3187
  - https://crbug.com/aomedia/3190
  - https://crbug.com/aomedia/3195
  - https://crbug.com/aomedia/3197
  - https://crbug.com/aomedia/3201
  - https://crbug.com/aomedia/3202
  - https://crbug.com/aomedia/3204
  - https://crbug.com/aomedia/3205
  - https://crbug.com/aomedia/3207
  - https://crbug.com/aomedia/3208
  - https://crbug.com/aomedia/3209
  - https://crbug.com/aomedia/3213
  - https://crbug.com/aomedia/3214
  - https://crbug.com/aomedia/3219
  - https://crbug.com/aomedia/3222
  - https://crbug.com/aomedia/3223
  - https://crbug.com/aomedia/3225
  - https://crbug.com/aomedia/3226
  - https://crbug.com/aomedia/3228
  - https://crbug.com/aomedia/3232
  - https://crbug.com/aomedia/3236
  - https://crbug.com/aomedia/3237
  - https://crbug.com/aomedia/3238
  - https://crbug.com/aomedia/3240
  - https://crbug.com/aomedia/3243
  - https://crbug.com/aomedia/3244
  - https://crbug.com/aomedia/3246
  - https://crbug.com/aomedia/3248
  - https://crbug.com/aomedia/3250
  - https://crbug.com/aomedia/3251
  - https://crbug.com/aomedia/3252
  - https://crbug.com/aomedia/3255
  - https://crbug.com/aomedia/3257
  - https://crbug.com/aomedia/3259
  - https://crbug.com/aomedia/3260
  - https://crbug.com/aomedia/3267
  - https://crbug.com/aomedia/3268
  - https://crbug.com/aomedia/3269
  - https://crbug.com/aomedia/3276
  - https://crbug.com/aomedia/3278
  - https://crbug.com/chromium/1290068
  - https://crbug.com/chromium/1303237
  - https://crbug.com/chromium/1304990
  - https://crbug.com/chromium/1321141
  - https://crbug.com/chromium/1321388
  - https://crbug.com/oss-fuzz/44846
  - https://crbug.com/oss-fuzz/44856
  - https://crbug.com/oss-fuzz/44862
  - https://crbug.com/oss-fuzz/44904
  - https://crbug.com/oss-fuzz/45056</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1663848000">- Update to version 3.5.0:
  * This release is ABI compatible with the last one, including
    speedup and memory optimizations, and new APIs and features.
  * New Features
  - Support for frame parallel encode for larger number of
    threads. --fp-mt flag is available for all build
    configurations.
  - New codec control AV1E_GET_NUM_OPERATING_POINTS
  * Speedup and Memory Optimizations
  - Speed-up multithreaded encoding for good quality mode for
    larger number of threads through frame parallel encoding:
    . 30-34% encode time reduction for 1080p, 16 threads, 1x1
    tile configuration (tile_rows x tile_columns)
    . 18-28% encode time reduction for 1080p, 16 threads, 2x4
    tile configuration
    . 18-20% encode time reduction for 2160p, 32 threads, 2x4
    tile configuration
  - 16-20% speed-up for speed=6 to 8 in still-picture encoding
    mode
  - 5-6% heap memory reduction for speed=6 to 10 in real-time
    encoding mode
  - Improvements to the speed for speed=7, 8 in real-time
    encoding mode
  - Improvements to the speed for speed=9, 10 in real-time screen
    encoding mode
  - Optimizations to improve multi-thread efficiency in real-time
    encoding mode
  - 10-15% speed up for SVC with temporal layers
  - SIMD optimizations:
    . Improve av1_quantize_fp_32x32_neon() 1.05x to 1.24x faster
    . Add aom_highbd_quantize_b{,_32x32,_64x64}_adaptive_neon()
    3.15x to 5.6x faster than "C"
    . Improve av1_quantize_fp_64x64_neon() 1.17x to 1.66x faster
    . Add aom_quantize_b_avx2() 1.4x to 1.7x faster than
    aom_quantize_b_avx()
    . Add aom_quantize_b_32x32_avx2() 1.4x to 2.3x faster than
    aom_quantize_b_32x32_avx()
    . Add aom_quantize_b_64x64_avx2() 2.0x to 2.4x faster than
    aom_quantize_b_64x64_ssse3()
    . Add aom_highbd_quantize_b_32x32_avx2() 9.0x to 10.5x faster
    than aom_highbd_quantize_b_32x32_c()
    . Add aom_highbd_quantize_b_64x64_avx2() 7.3x to 9.7x faster
    than aom_highbd_quantize_b_64x64_c()
    . Improve aom_highbd_quantize_b_avx2() 1.07x to 1.20x faster
    . Improve av1_quantize_fp_avx2() 1.13x to 1.49x faster
    . Improve av1_quantize_fp_32x32_avx2() 1.07x to 1.54x faster
    . Improve av1_quantize_fp_64x64_avx2()  1.03x to 1.25x faster
    . Improve av1_quantize_lp_avx2() 1.07x to 1.16x faster
  * Bug fixes including but not limited to
  - aomedia:3206 Assert that skip_width &gt; 0 for deconvolve
    function
  - aomedia:3278 row_mt enc: Delay top-right sync when intraBC is
    enabled
  - aomedia:3282 blend_a64_*_neon: fix bus error in armv7
  - aomedia:3283 FRAME_PARALLEL: Propagate border size to all
    cpis
  - aomedia:3283 RESIZE_MODE: Fix incorrect strides being used
    for motion search
  - aomedia:3286 rtc-svc: Fix to dynamic_enable spatial layers
  - aomedia:3289 rtc-screen: Fix to skipping inter-mode test in
    nonrd
  - aomedia:3289 rtc-screen: Fix for skip newmv on flat blocks
  - aomedia:3299 Fix build failure with CONFIG_TUNE_VMAF=1
  - aomedia:3296 Fix the conflict --enable-tx-size-search=0 with
    nonrd mode --enable-tx-size-search will be ignored in non-rd
    pick mode
  - aomedia:3304 Fix off-by-one error of max w/h in
    validate_config
  - aomedia:3306 Do not use pthread_setname_np on GNU/Hurd
  - aomedia:3325 row-multithreading produces invalid bitstream in
    some cases
  - chromium:1346938, chromium:1338114
  - compiler_flags.cmake: fix flag detection w/cmake 3.17-3.18.2
  - tools/*.py: update to python3
  - aom_configure.cmake: detect PIE and set CONFIG_PIC
  - test/simd_cmp_impl: use explicit types w/CompareSimd*
  - rtc: Fix to disable segm for aq-mode=3
  - rtc: Fix to color_sensitivity in variance partition
  - rtc-screen: Fix bsize in model rd computation for intra
    chroma
  - Fixes to ensure the correct behavior of the encoder
    algorithms (like segmentation, computation of statistics,
    etc.)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1675857600">- Update to version 3.6.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. This release is ABI compatible with the last
    release.
  * New Features:
  - New values 20-27 (corresponding to levels 7.0-7.3 and
    8.0-8.3) for the encoder control
    AV1E_SET_TARGET_SEQ_LEVEL_IDX (note that the proposal to add
    the new levels are still in draft status). The original
    special value 24 (keep level stats only for level monitoring)
    is renumbered as 32.
  - New encoder control AV1E_SET_SKIP_POSTPROC_FILTERING to skip
    the application of post-processing filters on reconstructed
    frame in all intra mode.
  - New encoder option "kf-max-pyr-height": Maximum height of
    pyramid structure used for the GOP starting with a key frame
    (-1 to 5).
  - Make SVC work for screen content.
  - Rate control improvements to reduce frame-size spikes for
    screen content coding.
  - RISC-V architecture support with gcc toolchain.
  * Compression Efficiency Improvements:
  - Peak compression efficiency in VOD setting is improved by 1%.
  - 0.7% - 2.2% RTC encoding BDrate gains for real time speed 8
    to 10.
  - 15% RTC encoding BDrate gains for screen content speed 10.
  * Perceptual Quality Improvements:
  - Resolved a visual quality issue that was reported for high
    resolution clips (2K) for speed 4 and above in VOD use case.
  - Visual quality improvements to screen content coding.
  - Quality improvements to temporal layer RTC coding.
  * Speedup and Memory Optimizations:
  - RTC single-thread encoder speedup:
    . ~6% instruction count reduction for speed 5 and 6.
    . ~15% instruction count reduction for speed 7.
    . ~10% instruction count reduction for speed 8 to 10 (&gt;=360p
    resolutions).
  - RTC multi-thread encoder speedup (beyond single-thread
    speedup):
    . 5-8% encode time reduction for speed 7 to 10.
  - RTC screen-content encoder speedup:
    . 11% instruction count reduction for speed 9 and 10 (&gt;=720p
    resolutions).
  - ~5% reduction in heap memory requirements for RTC, speed 6 to
    10.
  * AVIF:
    . 4-5% speedup for speed 9 in still-picture encoding mode.
    . 3-4% heap memory reduction in still-picture encoding mode
    for 360p-720p resolutions with multiple threads.
  * Bug Fixes:
  - Added a workaround for an AV1 specification bug which makes
    TRANSLATION type global motion models unusable.
  - Fixed AddressSanitizer global-buffer-overflow errors in
    av1/encoder/arm/neon/av1_fwd_txfm2d_neon.c.
  - Fixed AddressSanitizer heap-buffer-overflow error in
    av1_wiener_convolve_add_src_neon().
  - chromium:1393384 Avoid scene detection on spatial resize.
  - aomedia:3308 Remove color artifacts under high motion.
  - aomedia:3310 Avoid out of memory failures with Visual Studio
    2017, 2019, and 2022 for Win32 x86 builds.
  - aomedia:3346 Make SVC work properly for screen content.
  - aomedia:3348 Fix a bug where an uninitialized search_site is
    used.
  - aomedia:3365 Work around what seems like a Visual Studio 2022
    compiler optimization bug.
  - aomedia:3369 Incorrect PSNR values reported by libaom for
    12-bit encode.
- Modernize spec, use cmake_build and ldconfig_scriptlets macros.</changelog>
  <changelog author="fcrozat@suse.com" date="1681992000">- Fix license tag to BSD-2-Clause and AOMPL-1.0.</changelog>
  <changelog author="fcrozat@suse.com" date="1683028800">- Revert to BSD-2-Clause licence tag to only use SPDX valid
  license tag.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1683720000">- Update to version 3.6.1:
  * aomedia:2871: Guard the support of the 7.x and 8.x levels for
    AV1 under the CONFIG_CWG_C013 config flag, and only output the
    7.x and 8.x levels when explicitly requested.
  * aomedia:3382: Choose sb_size by ppi instead of svc.
  * aomedia:3384: Fix fullpel search limits.
  * aomedia:3388: Replace left shift of xq_active by
    multiplication.
  * aomedia:3389: Fix MV clamping in av1_mv_pred.
  * aomedia:3390: set_ld_layer_depth: cap max_layer_depth to
    MAX_ARF_LAYERS.
  * aomedia:3418: Fix MV clamping in av1_int_pro_motion_estimation.
  * aomedia:3429: Move lpf thread data init to
    lpf_pipeline_mt_init().
  * b:266719111: Fix undefined behavior in Arm Neon code.
  * b:269840681: nonrd_opt: align scan tables.
  * rtc: Fix is_key_frame setting in variance partition.
  * Build: Fix build with clang-cl and Visual Studio.</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693569600">- New upstream release 3.7.0
  - New Features
  * New codec controls:
  * AV1E_SET_QUANTIZER_ONE_PASS: Set quantizer for each frame.
  * AV1E_ENABLE_RATE_GUIDE_DELTAQ: enable the rate distribution guided delta
    quantization in all intra mode. The "enable-rate-guide-deltaq" option is
    added for this control.
  * AV1E_SET_RATE_DISTRIBUTION_INFO: set the input file for rate
    distribution used in all intra mode. The "rate-distribution-info" option
    is added for this control.
  * AV1E_GET_LUMA_CDEF_STRENGTH
  * AV1E_SET_BITRATE_ONE_PASS_CBR
  * AOM_SCALING_MODE is extended to include 2/3 and 1/3 scaling.
  * aom_tune_metric is extended to include AOM_TUNE_VMAF_SALIENCY_MAP.
    The "tune" option is extended to include "vmaf_saliency_map".
  * SVC example encoder svc_encoder_rtc is able to use the rate control
    library.
  * Loopfilter level and CDEF filter level is supported by RTC rate control
    library.
  * New speed (--cpu-used) 11, intended for RTC screen sharing, added for
    faster encoding with ~3% bdrate loss with 16% IC (instruction count)
    speedup compared to speed 10.
  - Compression Efficiency Improvements
  * Improved VoD encoding performance
  * 0.1-0.6% BDrate gains for encoding speeds 2 to 6
  * Rate control accuracy improvement in VBR mode
  * RTC encoding improvements
  * Screen content mode: 10-19% BDrate gains for speeds 6 - 10
  * Temporal layers video mode, for speed 10:
  * 2 temporal layers on low resolutions: 13-15% BDrate gain
  * 3 temporal layers on VGA/HD: 3-4% BDrate gain
  - Perceptual Quality Improvements
  * Fixed multiple block and color artifacts for RTC screen content by
  * Incorporating color into RD cost for IDTX
  * Reducing thresholds for palette mode in non RD mode
  * Allowing more palette mode testing
  * Improved color sensitivity for altref in non-RD mode.
  * Reduced video flickering for temporal layer encoding.
  - Speedup and Memory Optimizations
  * Speed up the VoD encoder
  * 2-5% for encoding speed 2 to 4
  * 9-15% for encoding speed 5 to 6
  * ARM
  * Standard bitdepth
  * speed 5: +31%
  * speed 4: +2%
  * speed 3: +9%
  * speed 2: +157%
  * High bitdepth
  * speed 5: +85%
  * RTC speedups
  * Screen content mode
  * 15% IC speedup for speeds 6-8
  * ARM: 7% for speed 9, 3% for speed 10
  * Temporal layers video mode
  * 7% speedup for 3 temporal layers on VGA/HD, for speed 10
  * Single layer video
  * x86: 2% IC speedup for speeds 7-10
  * ARM: 2-4% speedup across speeds 5-10
  - Bug Fixes
  * aomedia:3261 Assertion failed when encoding av1 with film grain and
    '--monochrome' flag
  * aomedia:3276 ensure all allocations are checked (partial fix)
  * aomedia:3451 The libaom library calls exit()
  * aomedia:3450 enable -Wshadow for C++ sources
  * aomedia:3449 Test Seg Faults After
    b459af3e345be402db052a143fcc5383d4b74cbd
  * aomedia:3416 prune unused symbols / restrict symbol visibility
  * aomedia:3443 Jenkins failure:
    UninstantiatedParameterizedTestSuite&lt;EstimateNoiseTest&gt;
  * aomedia:3434 realtime failures with CONFIG_BITSTREAM_DEBUG=1
  * aomedia:3433 DeltaqModeTest crash w/row_mt=0
  * aomedia:3429 Encoder crash when turn on both ExternalResize and
    g_threads &gt; 2
  * aomedia:3438 Build failure with
    `-DSANITIZE=address -DBUILD_SHARED_LIBS=ON` when using clang.
  * aomedia:3435 Block artifacts when scrolling with AV1 in screen sharing
    scenarios
  * aomedia:3170 vmaf tune presets produce extreme glitches in one scene
  * aomedia:3401 Building shared libaom with MSVC results in a race condition
    with the export library
  * aomedia:3420 Floating point exception in av1_tpl_get_frame_importance()
  * aomedia:3424 heap-buffer-overflow in ScaleFilterCols_16_C() (SIGABRT)
  * aomedia:3417 examples/svc_encoder_rtc.c is using internal macros and
    functions
  * aomedia:3372 SEGV in assign_frame_buffer_p av1_common_int.h
  * aomedia:3130 'cpu-features.h' file not found on Android NDK 22
  * aomedia:3415 Encoder/decoder mismatch for svc_encoder_rtc running
    1 SL 3 TL
  * aomedia:3412 Lossless Mode Fails Loopback Bit Test
  * aomedia:3409 The use of AV1_VAR_OFFS in av1/encoder/var_based_part.c is
    incorrect for high bit depths
  * aomedia:3403 test_libaom fails with error message
    "feenableexcept() failed" on Linux arm
  * aomedia:3370 Random color block at fast motion area
  * aomedia:3393 Assertion failure in av1_convolve_2d_sr_c()
  * aomedia:3392 Strong artifacting for high bit-depth real-time
  * aomedia:3376 aomenc --threads=10 --deltaq-mode=3 crashes after
    "Allintra: multi-threading of calculating differential contrast"
  * aomedia:3380 Crashes and ASan and TSan errors in deltaq-mode=3
    multithreading code
  * chromium:1410766 heap-buffer-overflow in aom_yv12_copy_v_c
  * Cannot set level via AV1E_SET_TARGET_SEQ_LEVEL_IDX
  * Encoding failure due to the use of loop restoration with unintended use of
    lossless mode.
  * Signed integer overflow in scan_past_frames
  * Signed integer overflow in update_a_sep_sym
  * Flickering in AV1 1440p/2160p HDR transcodes
  * Fixed artifacts with screen share at encoder speed 10
  * Fixed prediction setup for IDTX
- Use system libraries instead of vendored ones
  * system-gtest.patch
  * system-yuv.patch
- Enable debuginfo also on modules written in assembly
- Enable building PowerPC-specific optimizations
- Enable Neon optimized code on ARM and fix runtime CPU detection
- Fix missing images in documentation</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693915200">- Split docs to multibuild to avoid dependency cycle</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701777600">- Update to version 3.7.1:
  * Bug Fixes:
  - aomedia:3349: heap overflow when increasing resolution
  - aomedia:3478: GCC 12.2.0 emits a -Wstringop-overflow warning
    on aom/av1/encoder/motion_search_facade.c
  - aomedia:3489: Detect encoder and image high bit depth
    mismatch
  - aomedia:3491: heap-buffer-overflow on frame size change
  - b/303023614:  Segfault at encoding time for high bit depth
    images
- Switch buildtime compression to zst.</changelog>
  <changelog author="pgajdos@suse.com" date="1718020800">- security update
- added patches
  fix CVE-2024-5171 [bsc#1226020], heap buffer overflow in img_alloc_helper() caused by integer overflow
  + libaom-CVE-2024-5171.patch</changelog>
</package>
<package pkgid="3df6b07cf2a833fdcdac2fe0c4bf3953e2c9bdc2b2933a9300882758d6bec87b" name="aom-tools" arch="x86_64">
  <version epoch="0" ver="3.7.1" rel="150600.3.3.1"/>
  <changelog author="elimat@opensuse.org" date="1614600000">- Update to version 2.0.2:
  * Prepare for the libaom v2.0.2 release
  * Call av1_setup_frame_size() when dropping a frame
  * Avoid memset in filter_intra_predictor module
  * Fix a typo bug in apply_temporal_filter_planewise
  * Modify the assertion in temporal filter intrinsics
  * Fix unit test ThreadTestLarge.EncoderResultTest/49
  * Add -Wimplicit-function-declaration as C flag only
  * Update CHANGELOG for libaom v2.0.1
  * Set allow_screen_content_tools to 0 in rt mode
  * chroma_check: don't access UV planes if monochrome</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620648000">- Update to version 3.1.0 (bsc#1185843):
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.1.0
  This release adds an "all intra" mode to the encoder, which significantly
  speeds up the encoding of AVIF still images at speed 6.
  - Upgrading:
    All intra mode for encoding AVIF still images and AV1 all intra videos:
    AOM_USAGE_ALL_INTRA (2) can be passed as the 'usage' argument to
    aom_codec_enc_config_default().
    New encoder control IDs added:
  - AV1E_SET_ENABLE_DIAGONAL_INTRA: Enable diagonal (D45 to D203) intra
    prediction modes (0: false, 1: true (default)). Also available as
    "enable-diagonal-intra" for the aom_codec_set_option() function.
    New aom_tune_metric enum value: AOM_TUNE_BUTTERAUGLI. The new aomenc option
  - -tune=butteraugli was added to optimize the encoder’s perceptual quality by
    optimizing the Butteraugli metric. Install libjxl (JPEG XL) and then pass
  - DCONFIG_TUNE_BUTTERAUGLI=1 to the cmake command to enable it.
- Includes 3.0
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.0.0
  This release includes compression efficiency improvement, speed improvement
  for realtime mode, as well as some new APIs.
  - Upgrading:
    Support for PSNR calculation based on stream bit-depth.
    New encoder control IDs added:
  - AV1E_SET_ENABLE_RECT_TX
  - AV1E_SET_VBR_CORPUS_COMPLEXITY_LAP
  - AV1E_GET_BASELINE_GF_INTERVAL
  - AV1E_SET_ENABLE_DNL_DENOISING
    New decoder control IDs added:
  - AOMD_GET_FWD_KF_PRESENT
  - AOMD_GET_FRAME_FLAGS
  - AOMD_GET_ALTREF_PRESENT
  - AOMD_GET_TILE_INFO
  - AOMD_GET_SCREEN_CONTENT_TOOLS_INFO
  - AOMD_GET_STILL_PICTURE
  - AOMD_GET_SB_SIZE
  - AOMD_GET_SHOW_EXISTING_FRAME_FLAG
  - AOMD_GET_S_FRAME_INFO
    New aom_tune_content enum value: AOM_CONTENT_FILM
    New aom_tune_metric enum value: AOM_TUNE_VMAF_NEG_MAX_GAIN
    Coefficient and mode update can be turned off via
    AV1E_SET_{COEFF/MODE}_COST_UPD_FREQ.
    New key &amp; value API added, available with aom_codec_set_option() function.
    Scaling API expanded to include 1/4, 3/4 and 1/8.
  - Enhancements:
    Better multithreading performance with realtime mode.
    New speed 9 setting for faster realtime encoding.
    Smaller binary size with low bitdepth and realtime only build.
    Temporal denoiser and its optimizations on x86 and Neon.
    Optimizations for scaling.
    Faster encoding with speed settings 2 to 6 for good encoding mode.
    Improved documentation throughout the library, with function level
    documentation, tree view and support for the dot tool.
  - Bug fixes:
    Aside from those mentioned in v2.0.1 and v2.0.2, this release includes the
    following bug fixes:
    Issue 2940: Segfault when encoding with --use-16bit-internal and --limit &gt; 1
    Issue 2941: Decoder mismatch with --rt --bit-depth=10 and --cpu-used=8
    Issue 2895: mingw-w64 i686 gcc fails to build
    Issue 2874: Separate ssse3 functions from sse2 file.</changelog>
  <changelog author="rpm@fthiessen.de" date="1625227200">- Update to version 3.1.1
  * Fix vmaf model initialization error when not set to tune=vmaf
  * Fix consistent crash on near-static screen content, keyframe
    related
  * Fix tune=butteraugli mode
- Disable NEON on arm where not available.</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- Update to version 3.1.2:
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.2
  * Avoid chroma resampling for 420mpeg2 input
  * Check array has two elements before using index 1
  * Fix DecodeScalabilityTest failure in realtime only
  * Store temporal_id and spatial_id of decoded frame
  * exports.cmake: use APPLE and WIN32 and use def for mingw-w64</changelog>
  <changelog author="pgajdos@suse.com" date="1629892801">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1633694400">- Update to version 3.1.3:
  * Update CHANGELOG for v3.1.3-rc2
  * Detect chroma subsampling more directly
  * Detect chroma subsampling more directly
  * image2yuvconfig() should calculate uv_crop_width
  * aom/aom_encoder.h: remove configure option reference
  * aom_encoder.h: fix rc_overshoot_pct range
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.3
  * aom_install: don't exclude msvc from install
  * aom_install: use relpath for install
  * aom_install: Install lib dlls to bindir</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634126400">- fix service data</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1634299200">- Update to version 3.2.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, as well
    as some new features.
  * New Features:
    + Introduced speeds 7, 8, and 9 for all intra mode.
    + Introduced speed 10 for real time mode.
    + Introduced an API that allows external partition decisions.
    + SVC: added support for compound prediction.
    + SVC: added support for fixed SVC modes.
  * Compression Efficiency Improvements:
    + Intra-mode search improvement.
    + Improved real time (RT) mode BDrate savings by ~5% (RT speed
    5) and ~12% (RT speed 6). The improvement was measured on the
    video conference set.
    + Improved real time mode for nonrd path (speed 7, 8, 9):
    BDrate gains of ~3-5%.
    + Rate control and RD adjustments based on ML research in VP9.
    Gains of ~0.5-1.0% for HD.
  * Perceptual Quality Improvements:
    + Added a new mode --deltaq-mode=3 to improve perceptual
    quality based on a differential contrast model for still
    images.
    + Added a new mode –deltaq-mode=4 to improve perceptual quality
    based on user rated cq_level data set for still images.
    + Weighting of some intra mode and partition size choices to
    better manage and retain texture.
  * Speedup and Memory Optimizations:
    + Further improved 2-pass good quality encoder speed:
    . Speed 2 speedup: 18%
    . Speed 3 speedup: 22%
    . Speed 4 speedup: 37%
    . Speed 5 speedup: 30%
    . Speed 6 speedup: 20%
    + Optimized the real time encoder (measured on the video
    conference set):
    . RT speed 5 speedup: 110%
    . RT speed 6 speedup: 77%
  * Bug Fixes
    + Issue 3069: Fix one-pass mode keyframe placement off-by-one
    error.
    + Issue 3156: Fix a bug in av1_quantize_lp AVX2 optimization.
- Drop libaom-CVE-2021-30474.patch: Fixed upstream.
- Drop libaom-CVE-2021-30475.patch: Fixed upstream.
- Remove changesgenerate option from _service file, use data from
  CHANGELOG to fill .changes instead as it it much nicer and human
  readable than just a list of commit messages.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645185600">- Update to version 3.3.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, some
    new features, and several bug fixes.
  * New Features
  - AV1 RT: Introducing CDEF search level 5
  - Changed real time speed 4 to behave the same as real time
    speed 5
  - Add --deltaq-strength
  - rtc: Allow scene-change and overshoot detection for svc
  - rtc: Intra-only frame for svc
  - AV1 RT: Option 2 for codec control AV1E_SET_ENABLE_CDEF to
    disable CDEF on non-ref frames
  - New codec controls AV1E_SET_LOOPFILTER_CONTROL and
    AOME_GET_LOOPFILTER_LEVEL
  - Improvements to three pass encoding
  * Compression Efficiency Improvements: Overall compression gains:
    0.6%
  * Perceptual Quality Improvements
  - Improves the perceptual quality of high QP encoding for
    delta-q mode 4
  - Auto select noise synthesis level for all intra
  * Speedup and Memory Optimizations
  - Added many SSE2 optimizations.
  - Good quality 2-pass encoder speedups:
    o Speed 2: 9%
    o Speed 3: 12.5%
    o Speed 4: 8%
    o Speed 5: 3%
    o Speed 6: 4%
  - Real time mode encoder speedups:
    o Speed 5: 2.6% BDRate gain, 4% speedup
    o Speed 6: 3.5% BDRate gain, 4% speedup
    o Speed 9: 1% BDRate gain, 3% speedup
    o Speed 10: 3% BDRate gain, neutral speedup
  - All intra encoding speedups (AVIF):
    o Single thread - speed 6: 8%
    o Single thread - speed 9: 15%
    o Multi thread(8) - speed 6: 14%
    o Multi thread(8) - speed 9: 34%
  * Bug Fixes
  - Issue 3163: Segmentation fault when using
  - -enable-keyframe-filtering=2
  - Issue 2436: Integer overflow in av1_warp_affine_c()
  - Issue 3226: armv7 build failure due to gcc-11
  - Issue 3195: Bug report on libaom (AddressSanitizer:
    heap-buffer-overflow)
  - Issue 3191: Bug report on libaom (AddressSanitizer: SEGV on
    unknown address)
- Drop libaom-devel Requires from libaom-devel-doc sub-package: We
  do not need the devel package to be able to read the devel
  documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1662292800">- Update to version 3.4.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. There are no ABI or API breaking changes in
    this release.
  * New Features:
  - New --dist-metric flag with "qm-psnr" value to use
    quantization matrices in the distortion computation for RD
    search. The default value is "psnr".
  - New command line option "--auto-intra-tools-off=1" to make
    all-intra encoding faster for high bit rate under
    "--deltaq-mode=3" mode.
  - New rate control library aom_av1_rc for real-time hardware
    encoders. Supports CBR for both one spatial layer and SVC.
  - New image format AOM_IMG_FMT_NV12 can be used as input to the
    encoder. The presence of AOM_IMG_FMT_NV12 can be detected at
    compile time by checking if the macro AOM_HAVE_IMG_FMT_NV12
    is defined.
  - New codec controls for the encoder:
    o AV1E_SET_AUTO_INTRA_TOOLS_OFF. Only in effect if
  - -deltaq-mode=3.
    o AV1E_SET_RTC_EXTERNAL_RC
    o AV1E_SET_FP_MT. Only supported if libaom is built with
  - DCONFIG_FRAME_PARALLEL_ENCODE=1.
    o AV1E_GET_TARGET_SEQ_LEVEL_IDX
  - New key-value pairs for the key-value API:
    o --auto-intra-tools-off=0 (default) or 1. Only in effect if
  - -deltaq-mode=3.
    o --strict-level-conformance=0 (default) or 1
    o --fp-mt=0 (default) or 1. Only supported if libaom is built
    with -DCONFIG_FRAME_PARALLEL_ENCODE=1.
  - New aomenc options (not supported by the key-value API):
    o --nv12
  * Compression Efficiency Improvements:
  - Correctly calculate SSE for high bitdepth in skip mode, 0.2%
    to 0.6% coding gain.
  - RTC at speed 9/10: BD-rate gain of ~4/5%
  - RTC screen content coding: many improvements for real-time
    screen at speed 10 (quality, speedup, and rate control), up
    to high resolutions (1080p).
  - RTC-SVC: fixes to make intra-only frames work for spatial
    layers.
  - RTC-SVC: quality improvements for temporal layers.
  - AV1 RT: A new passive rate control strategy for screen
    content, an average of 7.5% coding gain, with some clips of
    20+%. The feature is turned off by default due to higher bit
    rate variation.
  * Perceptual Quality Improvements:
  - RTC: Visual quality improvements for high speeds (9/10)
  - Improvements in coding quality for all intra mode
  * Speedup and Memory Optimizations:
  - ~10% speedup in good quality mode encoding.
  - ~7% heap memory reduction in good quality encoding mode for
    speed 5 and 6.
  - Ongoing improvements to intra-frame encoding performance on
    Arm
  - Faster encoding speed for "--deltaq-mode=3" mode.
  - ~10% speedup for speed 5/6, ~15% speedup for speed 7/8, and
    ~10% speedup for speed 9/10 in real time encoding mode
  - ~20% heap memory reduction in still-picture encoding mode for
    360p-720p resolutions with multiple threads
  - ~13% speedup for speed 6 and ~12% speedup for speed 9 in
    still-picture encoding mode.
  - Optimizations to improve multi-thread efficiency for
    still-picture encoding mode.
  * Bug Fixes:
  - b/204460717: README.md: replace master with main
  - b/210677928: libaom disable_order is surprising for
    max_reference_frames=3
  - b/222461449: -DCONFIG_TUNE_BUTTERAUGLI=1 broken
  - b/227207606: write_greyscale writes incorrect chroma in
    highbd mode
  - b/229955363: Integer-overflow in linsolve_wiener
  - https://crbug.com/aomedia/2032
  - https://crbug.com/aomedia/2397
  - https://crbug.com/aomedia/2563
  - https://crbug.com/aomedia/2815
  - https://crbug.com/aomedia/3009
  - https://crbug.com/aomedia/3018
  - https://crbug.com/aomedia/3045
  - https://crbug.com/aomedia/3101
  - https://crbug.com/aomedia/3130
  - https://crbug.com/aomedia/3173
  - https://crbug.com/aomedia/3184
  - https://crbug.com/aomedia/3187
  - https://crbug.com/aomedia/3190
  - https://crbug.com/aomedia/3195
  - https://crbug.com/aomedia/3197
  - https://crbug.com/aomedia/3201
  - https://crbug.com/aomedia/3202
  - https://crbug.com/aomedia/3204
  - https://crbug.com/aomedia/3205
  - https://crbug.com/aomedia/3207
  - https://crbug.com/aomedia/3208
  - https://crbug.com/aomedia/3209
  - https://crbug.com/aomedia/3213
  - https://crbug.com/aomedia/3214
  - https://crbug.com/aomedia/3219
  - https://crbug.com/aomedia/3222
  - https://crbug.com/aomedia/3223
  - https://crbug.com/aomedia/3225
  - https://crbug.com/aomedia/3226
  - https://crbug.com/aomedia/3228
  - https://crbug.com/aomedia/3232
  - https://crbug.com/aomedia/3236
  - https://crbug.com/aomedia/3237
  - https://crbug.com/aomedia/3238
  - https://crbug.com/aomedia/3240
  - https://crbug.com/aomedia/3243
  - https://crbug.com/aomedia/3244
  - https://crbug.com/aomedia/3246
  - https://crbug.com/aomedia/3248
  - https://crbug.com/aomedia/3250
  - https://crbug.com/aomedia/3251
  - https://crbug.com/aomedia/3252
  - https://crbug.com/aomedia/3255
  - https://crbug.com/aomedia/3257
  - https://crbug.com/aomedia/3259
  - https://crbug.com/aomedia/3260
  - https://crbug.com/aomedia/3267
  - https://crbug.com/aomedia/3268
  - https://crbug.com/aomedia/3269
  - https://crbug.com/aomedia/3276
  - https://crbug.com/aomedia/3278
  - https://crbug.com/chromium/1290068
  - https://crbug.com/chromium/1303237
  - https://crbug.com/chromium/1304990
  - https://crbug.com/chromium/1321141
  - https://crbug.com/chromium/1321388
  - https://crbug.com/oss-fuzz/44846
  - https://crbug.com/oss-fuzz/44856
  - https://crbug.com/oss-fuzz/44862
  - https://crbug.com/oss-fuzz/44904
  - https://crbug.com/oss-fuzz/45056</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1663848000">- Update to version 3.5.0:
  * This release is ABI compatible with the last one, including
    speedup and memory optimizations, and new APIs and features.
  * New Features
  - Support for frame parallel encode for larger number of
    threads. --fp-mt flag is available for all build
    configurations.
  - New codec control AV1E_GET_NUM_OPERATING_POINTS
  * Speedup and Memory Optimizations
  - Speed-up multithreaded encoding for good quality mode for
    larger number of threads through frame parallel encoding:
    . 30-34% encode time reduction for 1080p, 16 threads, 1x1
    tile configuration (tile_rows x tile_columns)
    . 18-28% encode time reduction for 1080p, 16 threads, 2x4
    tile configuration
    . 18-20% encode time reduction for 2160p, 32 threads, 2x4
    tile configuration
  - 16-20% speed-up for speed=6 to 8 in still-picture encoding
    mode
  - 5-6% heap memory reduction for speed=6 to 10 in real-time
    encoding mode
  - Improvements to the speed for speed=7, 8 in real-time
    encoding mode
  - Improvements to the speed for speed=9, 10 in real-time screen
    encoding mode
  - Optimizations to improve multi-thread efficiency in real-time
    encoding mode
  - 10-15% speed up for SVC with temporal layers
  - SIMD optimizations:
    . Improve av1_quantize_fp_32x32_neon() 1.05x to 1.24x faster
    . Add aom_highbd_quantize_b{,_32x32,_64x64}_adaptive_neon()
    3.15x to 5.6x faster than "C"
    . Improve av1_quantize_fp_64x64_neon() 1.17x to 1.66x faster
    . Add aom_quantize_b_avx2() 1.4x to 1.7x faster than
    aom_quantize_b_avx()
    . Add aom_quantize_b_32x32_avx2() 1.4x to 2.3x faster than
    aom_quantize_b_32x32_avx()
    . Add aom_quantize_b_64x64_avx2() 2.0x to 2.4x faster than
    aom_quantize_b_64x64_ssse3()
    . Add aom_highbd_quantize_b_32x32_avx2() 9.0x to 10.5x faster
    than aom_highbd_quantize_b_32x32_c()
    . Add aom_highbd_quantize_b_64x64_avx2() 7.3x to 9.7x faster
    than aom_highbd_quantize_b_64x64_c()
    . Improve aom_highbd_quantize_b_avx2() 1.07x to 1.20x faster
    . Improve av1_quantize_fp_avx2() 1.13x to 1.49x faster
    . Improve av1_quantize_fp_32x32_avx2() 1.07x to 1.54x faster
    . Improve av1_quantize_fp_64x64_avx2()  1.03x to 1.25x faster
    . Improve av1_quantize_lp_avx2() 1.07x to 1.16x faster
  * Bug fixes including but not limited to
  - aomedia:3206 Assert that skip_width &gt; 0 for deconvolve
    function
  - aomedia:3278 row_mt enc: Delay top-right sync when intraBC is
    enabled
  - aomedia:3282 blend_a64_*_neon: fix bus error in armv7
  - aomedia:3283 FRAME_PARALLEL: Propagate border size to all
    cpis
  - aomedia:3283 RESIZE_MODE: Fix incorrect strides being used
    for motion search
  - aomedia:3286 rtc-svc: Fix to dynamic_enable spatial layers
  - aomedia:3289 rtc-screen: Fix to skipping inter-mode test in
    nonrd
  - aomedia:3289 rtc-screen: Fix for skip newmv on flat blocks
  - aomedia:3299 Fix build failure with CONFIG_TUNE_VMAF=1
  - aomedia:3296 Fix the conflict --enable-tx-size-search=0 with
    nonrd mode --enable-tx-size-search will be ignored in non-rd
    pick mode
  - aomedia:3304 Fix off-by-one error of max w/h in
    validate_config
  - aomedia:3306 Do not use pthread_setname_np on GNU/Hurd
  - aomedia:3325 row-multithreading produces invalid bitstream in
    some cases
  - chromium:1346938, chromium:1338114
  - compiler_flags.cmake: fix flag detection w/cmake 3.17-3.18.2
  - tools/*.py: update to python3
  - aom_configure.cmake: detect PIE and set CONFIG_PIC
  - test/simd_cmp_impl: use explicit types w/CompareSimd*
  - rtc: Fix to disable segm for aq-mode=3
  - rtc: Fix to color_sensitivity in variance partition
  - rtc-screen: Fix bsize in model rd computation for intra
    chroma
  - Fixes to ensure the correct behavior of the encoder
    algorithms (like segmentation, computation of statistics,
    etc.)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1675857600">- Update to version 3.6.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. This release is ABI compatible with the last
    release.
  * New Features:
  - New values 20-27 (corresponding to levels 7.0-7.3 and
    8.0-8.3) for the encoder control
    AV1E_SET_TARGET_SEQ_LEVEL_IDX (note that the proposal to add
    the new levels are still in draft status). The original
    special value 24 (keep level stats only for level monitoring)
    is renumbered as 32.
  - New encoder control AV1E_SET_SKIP_POSTPROC_FILTERING to skip
    the application of post-processing filters on reconstructed
    frame in all intra mode.
  - New encoder option "kf-max-pyr-height": Maximum height of
    pyramid structure used for the GOP starting with a key frame
    (-1 to 5).
  - Make SVC work for screen content.
  - Rate control improvements to reduce frame-size spikes for
    screen content coding.
  - RISC-V architecture support with gcc toolchain.
  * Compression Efficiency Improvements:
  - Peak compression efficiency in VOD setting is improved by 1%.
  - 0.7% - 2.2% RTC encoding BDrate gains for real time speed 8
    to 10.
  - 15% RTC encoding BDrate gains for screen content speed 10.
  * Perceptual Quality Improvements:
  - Resolved a visual quality issue that was reported for high
    resolution clips (2K) for speed 4 and above in VOD use case.
  - Visual quality improvements to screen content coding.
  - Quality improvements to temporal layer RTC coding.
  * Speedup and Memory Optimizations:
  - RTC single-thread encoder speedup:
    . ~6% instruction count reduction for speed 5 and 6.
    . ~15% instruction count reduction for speed 7.
    . ~10% instruction count reduction for speed 8 to 10 (&gt;=360p
    resolutions).
  - RTC multi-thread encoder speedup (beyond single-thread
    speedup):
    . 5-8% encode time reduction for speed 7 to 10.
  - RTC screen-content encoder speedup:
    . 11% instruction count reduction for speed 9 and 10 (&gt;=720p
    resolutions).
  - ~5% reduction in heap memory requirements for RTC, speed 6 to
    10.
  * AVIF:
    . 4-5% speedup for speed 9 in still-picture encoding mode.
    . 3-4% heap memory reduction in still-picture encoding mode
    for 360p-720p resolutions with multiple threads.
  * Bug Fixes:
  - Added a workaround for an AV1 specification bug which makes
    TRANSLATION type global motion models unusable.
  - Fixed AddressSanitizer global-buffer-overflow errors in
    av1/encoder/arm/neon/av1_fwd_txfm2d_neon.c.
  - Fixed AddressSanitizer heap-buffer-overflow error in
    av1_wiener_convolve_add_src_neon().
  - chromium:1393384 Avoid scene detection on spatial resize.
  - aomedia:3308 Remove color artifacts under high motion.
  - aomedia:3310 Avoid out of memory failures with Visual Studio
    2017, 2019, and 2022 for Win32 x86 builds.
  - aomedia:3346 Make SVC work properly for screen content.
  - aomedia:3348 Fix a bug where an uninitialized search_site is
    used.
  - aomedia:3365 Work around what seems like a Visual Studio 2022
    compiler optimization bug.
  - aomedia:3369 Incorrect PSNR values reported by libaom for
    12-bit encode.
- Modernize spec, use cmake_build and ldconfig_scriptlets macros.</changelog>
  <changelog author="fcrozat@suse.com" date="1681992000">- Fix license tag to BSD-2-Clause and AOMPL-1.0.</changelog>
  <changelog author="fcrozat@suse.com" date="1683028800">- Revert to BSD-2-Clause licence tag to only use SPDX valid
  license tag.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1683720000">- Update to version 3.6.1:
  * aomedia:2871: Guard the support of the 7.x and 8.x levels for
    AV1 under the CONFIG_CWG_C013 config flag, and only output the
    7.x and 8.x levels when explicitly requested.
  * aomedia:3382: Choose sb_size by ppi instead of svc.
  * aomedia:3384: Fix fullpel search limits.
  * aomedia:3388: Replace left shift of xq_active by
    multiplication.
  * aomedia:3389: Fix MV clamping in av1_mv_pred.
  * aomedia:3390: set_ld_layer_depth: cap max_layer_depth to
    MAX_ARF_LAYERS.
  * aomedia:3418: Fix MV clamping in av1_int_pro_motion_estimation.
  * aomedia:3429: Move lpf thread data init to
    lpf_pipeline_mt_init().
  * b:266719111: Fix undefined behavior in Arm Neon code.
  * b:269840681: nonrd_opt: align scan tables.
  * rtc: Fix is_key_frame setting in variance partition.
  * Build: Fix build with clang-cl and Visual Studio.</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693569600">- New upstream release 3.7.0
  - New Features
  * New codec controls:
  * AV1E_SET_QUANTIZER_ONE_PASS: Set quantizer for each frame.
  * AV1E_ENABLE_RATE_GUIDE_DELTAQ: enable the rate distribution guided delta
    quantization in all intra mode. The "enable-rate-guide-deltaq" option is
    added for this control.
  * AV1E_SET_RATE_DISTRIBUTION_INFO: set the input file for rate
    distribution used in all intra mode. The "rate-distribution-info" option
    is added for this control.
  * AV1E_GET_LUMA_CDEF_STRENGTH
  * AV1E_SET_BITRATE_ONE_PASS_CBR
  * AOM_SCALING_MODE is extended to include 2/3 and 1/3 scaling.
  * aom_tune_metric is extended to include AOM_TUNE_VMAF_SALIENCY_MAP.
    The "tune" option is extended to include "vmaf_saliency_map".
  * SVC example encoder svc_encoder_rtc is able to use the rate control
    library.
  * Loopfilter level and CDEF filter level is supported by RTC rate control
    library.
  * New speed (--cpu-used) 11, intended for RTC screen sharing, added for
    faster encoding with ~3% bdrate loss with 16% IC (instruction count)
    speedup compared to speed 10.
  - Compression Efficiency Improvements
  * Improved VoD encoding performance
  * 0.1-0.6% BDrate gains for encoding speeds 2 to 6
  * Rate control accuracy improvement in VBR mode
  * RTC encoding improvements
  * Screen content mode: 10-19% BDrate gains for speeds 6 - 10
  * Temporal layers video mode, for speed 10:
  * 2 temporal layers on low resolutions: 13-15% BDrate gain
  * 3 temporal layers on VGA/HD: 3-4% BDrate gain
  - Perceptual Quality Improvements
  * Fixed multiple block and color artifacts for RTC screen content by
  * Incorporating color into RD cost for IDTX
  * Reducing thresholds for palette mode in non RD mode
  * Allowing more palette mode testing
  * Improved color sensitivity for altref in non-RD mode.
  * Reduced video flickering for temporal layer encoding.
  - Speedup and Memory Optimizations
  * Speed up the VoD encoder
  * 2-5% for encoding speed 2 to 4
  * 9-15% for encoding speed 5 to 6
  * ARM
  * Standard bitdepth
  * speed 5: +31%
  * speed 4: +2%
  * speed 3: +9%
  * speed 2: +157%
  * High bitdepth
  * speed 5: +85%
  * RTC speedups
  * Screen content mode
  * 15% IC speedup for speeds 6-8
  * ARM: 7% for speed 9, 3% for speed 10
  * Temporal layers video mode
  * 7% speedup for 3 temporal layers on VGA/HD, for speed 10
  * Single layer video
  * x86: 2% IC speedup for speeds 7-10
  * ARM: 2-4% speedup across speeds 5-10
  - Bug Fixes
  * aomedia:3261 Assertion failed when encoding av1 with film grain and
    '--monochrome' flag
  * aomedia:3276 ensure all allocations are checked (partial fix)
  * aomedia:3451 The libaom library calls exit()
  * aomedia:3450 enable -Wshadow for C++ sources
  * aomedia:3449 Test Seg Faults After
    b459af3e345be402db052a143fcc5383d4b74cbd
  * aomedia:3416 prune unused symbols / restrict symbol visibility
  * aomedia:3443 Jenkins failure:
    UninstantiatedParameterizedTestSuite&lt;EstimateNoiseTest&gt;
  * aomedia:3434 realtime failures with CONFIG_BITSTREAM_DEBUG=1
  * aomedia:3433 DeltaqModeTest crash w/row_mt=0
  * aomedia:3429 Encoder crash when turn on both ExternalResize and
    g_threads &gt; 2
  * aomedia:3438 Build failure with
    `-DSANITIZE=address -DBUILD_SHARED_LIBS=ON` when using clang.
  * aomedia:3435 Block artifacts when scrolling with AV1 in screen sharing
    scenarios
  * aomedia:3170 vmaf tune presets produce extreme glitches in one scene
  * aomedia:3401 Building shared libaom with MSVC results in a race condition
    with the export library
  * aomedia:3420 Floating point exception in av1_tpl_get_frame_importance()
  * aomedia:3424 heap-buffer-overflow in ScaleFilterCols_16_C() (SIGABRT)
  * aomedia:3417 examples/svc_encoder_rtc.c is using internal macros and
    functions
  * aomedia:3372 SEGV in assign_frame_buffer_p av1_common_int.h
  * aomedia:3130 'cpu-features.h' file not found on Android NDK 22
  * aomedia:3415 Encoder/decoder mismatch for svc_encoder_rtc running
    1 SL 3 TL
  * aomedia:3412 Lossless Mode Fails Loopback Bit Test
  * aomedia:3409 The use of AV1_VAR_OFFS in av1/encoder/var_based_part.c is
    incorrect for high bit depths
  * aomedia:3403 test_libaom fails with error message
    "feenableexcept() failed" on Linux arm
  * aomedia:3370 Random color block at fast motion area
  * aomedia:3393 Assertion failure in av1_convolve_2d_sr_c()
  * aomedia:3392 Strong artifacting for high bit-depth real-time
  * aomedia:3376 aomenc --threads=10 --deltaq-mode=3 crashes after
    "Allintra: multi-threading of calculating differential contrast"
  * aomedia:3380 Crashes and ASan and TSan errors in deltaq-mode=3
    multithreading code
  * chromium:1410766 heap-buffer-overflow in aom_yv12_copy_v_c
  * Cannot set level via AV1E_SET_TARGET_SEQ_LEVEL_IDX
  * Encoding failure due to the use of loop restoration with unintended use of
    lossless mode.
  * Signed integer overflow in scan_past_frames
  * Signed integer overflow in update_a_sep_sym
  * Flickering in AV1 1440p/2160p HDR transcodes
  * Fixed artifacts with screen share at encoder speed 10
  * Fixed prediction setup for IDTX
- Use system libraries instead of vendored ones
  * system-gtest.patch
  * system-yuv.patch
- Enable debuginfo also on modules written in assembly
- Enable building PowerPC-specific optimizations
- Enable Neon optimized code on ARM and fix runtime CPU detection
- Fix missing images in documentation</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693915200">- Split docs to multibuild to avoid dependency cycle</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701777600">- Update to version 3.7.1:
  * Bug Fixes:
  - aomedia:3349: heap overflow when increasing resolution
  - aomedia:3478: GCC 12.2.0 emits a -Wstringop-overflow warning
    on aom/av1/encoder/motion_search_facade.c
  - aomedia:3489: Detect encoder and image high bit depth
    mismatch
  - aomedia:3491: heap-buffer-overflow on frame size change
  - b/303023614:  Segfault at encoding time for high bit depth
    images
- Switch buildtime compression to zst.</changelog>
  <changelog author="pgajdos@suse.com" date="1718020800">- security update
- added patches
  fix CVE-2024-5171 [bsc#1226020], heap buffer overflow in img_alloc_helper() caused by integer overflow
  + libaom-CVE-2024-5171.patch</changelog>
</package>
<package pkgid="6dd13afe51365a7459f96b4467799640dac178a9422b74f05d07e2e0d6582211" name="apache-commons-lang3" arch="noarch">
  <version epoch="0" ver="3.16.0" rel="150200.3.9.2"/>
  <changelog author="p.drouand@gmail.com" date="1453636800">- Initial release (version 3.4)</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Specify java target and source level 1.6
- Force building with jdk &lt; 1.9, since jdk9's javadoc chocks on one
  class file (internal error)</changelog>
  <changelog author="fstrba@suse.com" date="1507550400">- Modified patch:
  * commons-lang3-3.4-javadoc.patch
    + Fix build with jdk9
- Allow building with jdk9 too
- Run fdupes on javadoc</changelog>
  <changelog author="tchvatal@suse.com" date="1525262400">- Format with spec-cleaner</changelog>
  <changelog author="fstrba@suse.com" date="1540209600">- Build commons-lang3-3.8.1 using modified build.xml and
  default.properties from 3.4.
- Removed patch:
  * commons-lang3-3.4-javadoc.patch
  - integrated in the build.xml
- Use source and target version 1.7, since the code contains
  diamond operator.</changelog>
  <changelog author="fstrba@suse.com" date="1549281600">- Clean-up the spec file and install less jar symlinks</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="fstrba@suse.com" date="1613476800">- Add OSGi manifest</changelog>
  <changelog author="rpm@fthiessen.de" date="1619179200">- Fixed SPEC file: Replaced broken URL
- Update to 3.9
  * Requires jdk &gt;= 1.8
  * Fixed issues with java 12
  * Add more SystemUtils.IS_JAVA_XX variants
  * Adding the Functions class
  * Add @FunctionalInterface to ThreadPredicate and ThreadGroupPredicate
  * Add isEmpty method to ObjectUtils
  * null-safe StringUtils.valueOf(char[]) to delegate to
    String.valueOf(char[]).
  * Add API org.apache.commons.lang3.SystemUtils.isJavaVersionAtMost(JavaVersion)
  * Consolidate the StringUtils equals and equalsIgnoreCase</changelog>
  <changelog author="david.anes@suse.com" date="1640347200">- Updated download URL.
- Update to 3.12.0:
  - New features:
  * Add BooleanUtils.booleanValues().
  * Add BooleanUtils.primitiveValues().
  * Add StringUtils.containsAnyIgnoreCase(CharSequence, CharSequence...).
  * Add StopWatch.getStopTime().
  * More test coverage for CharSequenceUtils.
  * Add fluent-style ArraySorter.
  * Add and use LocaleUtils.toLocale(Locale) to avoid NPEs.
  * Add FailableShortSupplier, handy for JDBC APIs.
  * Add JavaVersion.JAVA_17.
  * Add missing boolean[] join method.
  * Add StringUtils.substringBefore(String, int).
  * Add Range.INTEGER.
  * Add DurationUtils.
  * Introduce the use of @Nonnull, and @Nullable, and the Objects class as a helper tool.
  * Add and use true and false String constants.
  * Add and use ObjectUtils.requireNonEmpty().
  - Fixed Bugs:
  * Correct implementation of RandomUtils.nextLong(long, long).
  * Restore handling of collections for non-JSON ToStringStyle.
  * ContextedException Javadoc add missing semicolon.
  * Resolve JUnit pioneer transitive dependencies using JUnit BOM.
  * NumberUtilsTest - incorrect types in min/max tests.
  * Improve StringUtils.stripAccents conversion of remaining accents.
  * StringUtils.countMatches - clarify Javadoc.
  * Remove redundant argument from substring call.
  * BigDecimal is created when you pass it the min and max values.
  * ArrayUtils.contains() and indexOf() fail to handle Double.NaN.
  * ArrayUtils contains() and indexOf() fail to handle Float.NaN.
  * Fix potential NPE in TypeUtils.isAssignable(Type, ParameterizedType, Map, Type&gt;).
  * TypeUtils.isAssignable returns wrong result for GenericArrayType and ParameterizedType.
  * testGetAllFields and testGetFieldsWithAnnotation sometimes fail.
  * Fix Javadoc for SystemUtils.isJavaVersionAtMost().
  * Fix StringUtils.unwrap throws StringIndexOutOfBoundsException.
  * Fix formatting of isAnyBlank() and isAnyEmpty().
  * TypeUtils. containsTypeVariables does not support GenericArrayType.
  * Javadoc of some methods incorrectly refers to another method.
  * Refine StringUtils.lastIndexOfIgnoreCase.
  * Refine StringUtils.abbreviate.
  * Refine StringUtils.isNumericSpace.
  * Refine StringUtils.deleteWhitespace.
  * Correction in Javadoc of some methods.
  * Javadoc for RandomStringUtils.random() letters, numbers parameters is wrong.
  * Correct markup in Javadoc for unbalanced braces.
  * MethodUtils.invokeMethod NullPointerException in case of null in args list.
  * Fix 2 digit week year formatting.
  * Fix broken Javadoc links to commons-text.
  * Add and use ThreadUtils.sleep(Duration).
  * Add and use ThreadUtils.join(Thread, Duration).
  * Add ObjectUtils.wait(Duration).
  - Changes:
  * ArrayUtils.toPrimitive(Object) does not support boolean and other types.
  * Enable Dependabot.
  * Bump junit-jupiter from 5.6.2 to 5.7.0.
  * Bump spotbugs from 4.1.2 to 4.2.1.
  * Bump spotbugs-maven-plugin from 4.0.0 to 4.2.0.
  * Bump biz.aQute.bndlib from 5.1.1 to 5.3.0.
  * Bump junit-pioneer from 0.6.0 to 1.1.0.
  * Bump checkstyle from 8.34 to 8.40.
  * Bump actions/checkout from v2.3.1 to v2.3.4.
  * Bump actions/setup-java from v1.4.0 to v1.4.2.
  * Update commons.jacoco.version 0.8.5 to 0.8.6 (Fixes Java 15 builds).
  * Update maven-surefire-plugin 2.22.2 -&gt; 3.0.0-M5.
  * Bump maven-pmd-plugin from 3.13.0 to 3.14.0.
  * Bump jmh.version from 1.21 to 1.27.
  * Update commons.japicmp.version 0.14.3 -&gt; 0.15.2.
  * Processor.java: check enum equality with == instead of .equals() method.
  * Bump junit-pioneer from 1.1.0 to 1.3.0.
  * Bump maven-checkstyle-plugin from 3.1.1 to 3.1.2.
  * Bump actions/cache from v2 to v2.1.4.
  * Bump junit-bom from 5.7.0 to 5.7.1.
  * Minor Improvements.
  * Minor Improvement: Add final variable.try to make the code read-only.
  * Minor Improvement: Remove redundant initializer.
  * Use own validator ObjectUtils.anyNull to check null String input.
- From 3.11 Update:
  - New features:
  * Add ArrayUtils.isSameLength() to compare more array types.
  * Added the Locks class as a convenient possibility to deal with locked objects.
  * Add to Functions: FailableBooleanSupplier, FailableIntSupplier, FailableLongSupplier, FailableDoubleSupplier, and so on.
  * Add ArrayUtils.get(T[], index, T) to provide an out-of-bounds default value.
  * Add JavaVersion enum constants for Java 14 and 15.
  * Add JavaVersion enum constants for Java 16.
  * Use Java 8 lambdas and Map operations.
  * Change removeLastFieldSeparator to use endsWith.
  * Change a Pattern to a static final field, for not letting it compile each time the function invoked.
  * Add ImmutablePair factory methods left() and right().
  * Add ObjectUtils.toString(Object, Supplier&lt;String&gt;).
  * Add org.apache.commons.lang3.StringUtils.substringAfter(String, int).
  * Add org.apache.commons.lang3.StringUtils.substringAfterLast(String, int).
  - Fixed Bugs:
  * Fix Javadoc for StringUtils.appendIfMissingIgnoreCase().
  * Refine Javadoc.
  * Fix typos
  * Ignored exception `ignored`, should not be called so.
  * StringUtils.replaceEachRepeatedly gives IllegalStateException.
  * [JSON string for maps] ToStringBuilder.reflectionToString doesnt render nested maps correctly.
  * Correct Javadocs of methods that use Validate.notNull() and replace some uses of Validate.isTrue() with Validate.notNull().
  * Add allNull() and anyNull() methods to ObjectUtils.
  - Changes:
  * Refine test output for FastDateParserTest
  * CharSequenceUtils.lastIndexOf : remake it
  * remove encoding and docEncoding and use inherited values from commons-parent
  * Simplify null checks in Pair.hashCode() using Objects.hashCode().
  * Simplify null checks in Triple.hashCode() using Objects.hashCode().
  * Simplify some if statements in StringUtils.
  * Simplify a null check in the private replaceEach() method of StringUtils.
  * Replace some usages of the ternary operator with calls to Math.max() and Math.min().
  * (Javadoc) Fix return tag for throwableOf*() methods.
  * CharSequenceUtils.regionMatches is wrong dealing with Georgian.
  * Optimize ArrayUtils::isArrayIndexValid method.
  * Use List.sort instead of Collection.sort.
  * Use StandardCharsets.UTF_8.
  * Use Collections.singletonList insteadof Arrays.asList when there be only one element.
  * Change array style from `int a[]` to `int[] a`.
  * Change from addAll to constructors for some List.
  * Simplify if as some conditions are covered by others.
  * Fixed Javadocs for setTestRecursive().
  * ToStringBuilder.reflectionToString - Wrong JSON format when object has a List of Enum.
  * Make org.apache.commons.lang3.CharSequenceUtils.toCharArray(CharSequence) public.
  * org.apache.commons:commons-parent 50 -&gt; 51.
  * org.junit-pioneer:junit-pioneer 0.5.4 -&gt; 0.6.0.
  * org.junit.jupiter:junit-jupiter 5.6.0 -&gt; 5.6.2.
  * com.github.spotbugs:spotbugs 4.0.0 -&gt; 4.0.6.
  * com.puppycrawl.tools:checkstyle 8.29 -&gt; 8.34.
  * commons.surefire.version 3.0.0-M4 -&gt; 3.0.0-M5..
- From 3.10 Update:
  - New features:
  * Add ExceptionUtils.throwableOfType(Throwable, Class) and friends.
  * Add EMPTY_ARRAY constants to classes in org.apache.commons.lang3.tuple.
  * Add null-safe StringUtils APIs to wrap String#getBytes([Charset|String]).
  * Add zero arg constructor for org.apache.commons.lang3.NotImplementedException.
  * Add ArrayUtils.addFirst() methods.
  * Add Range.fit(T) to fit a value into a range.
  * Added Functions.as*, and tests thereof, as suggested by Peter Verhas
  * Add getters for lhs and rhs objects in DiffResult.
  * Generify builder classes Diffable, DiffBuilder, and DiffResult.
  * Add ClassLoaderUtils with toString() implementations.
  * Add null-safe APIs as StringUtils.toRootLowerCase(String) and StringUtils.toRootUpperCase(String).
  * Add org.apache.commons.lang3.time.Calendars.
  * Add EnumUtils getEnum() methods with default values.
  * Added indexesOf methods and simplified removeAllOccurences.
  * Add support of lambda value evaluation for defaulting methods.
  * Add factory methods to Pair classes with Map.Entry input.
  * Add StopWatch convenience APIs to format times and create a simple instance.
  * Allow a StopWatch to carry an optional message.
  * Add ComparableUtils.
  * Add org.apache.commons.lang3.SystemUtils.getUserName().
  * Add ObjectToStringComparator.
  * Add org.apache.commons.lang3.arch.Processor.Arch.getLabel().
  * Add IS_JAVA_14 and IS_JAVA_15 to org.apache.commons.lang3.SystemUtils.
  * ObjectUtils: Get first non-null supplier value.
  * Added the Streams class, and Functions.stream() as an accessor thereof.
  - Fixed Bugs:
  * Make test more stable by wrapping assertions in hashset.
  * Generate Javadoc jar on build.
  * Trivial: year of release for 3.9 says 2018, should be 2019.
  * Use synchronize on a set created with Collections.synchronizedSet before iterating.
  * StringUtils.unwrap incorrect throw StringIndexOutOfBoundsException.
  * StringIndexOutOfBoundsException in StringUtils.replaceIgnoreCase.
  * StringUtils.removeIgnoreCase("?a", "a") throws IndexOutOfBoundsException.
  * Corrected usage examples in Javadocs.
  * StringUtils abbreviate returns String of length greater than maxWidth.
  * Test may fail due to a different order of fields returned by reflection api.
  * Sort fields in ReflectionToStringBuilder for deterministic order.
  * MethodUtils will throw a NPE if invokeMethod() is called for a var-args method.
  * MethodUtils.getAnnotation() with searchSupers = true does not work if super is generic.
  - Changes:
  * Remove redundant if statements in join methods.
  * commons.japicmp.version 0.13.1 -&gt; 0.14.1.
  * junit-jupiter 5.5.0 -&gt; 5.5.1.
  * junit-jupiter 5.5.1 -&gt; 5.5.2.
  * Improve Javadoc based on the discussion of the GitHub PR.
  * maven-checkstyle-plugin 3.0.0 -&gt; 3.1.0.
  * Update documentation related to the issue LANG-696.
  * AnnotationUtils little cleanup.
  * Update test dependency: org.easymock:easymock 4.0.2 -&gt; 4.1.
  * Update test dependency: org.hamcrest:hamcrest 2.1 -&gt; 2.2.
  * Update test dependency: org.junit-pioneer:junit-pioneer 0.3.0 -&gt; 0.4.2.
  * Update build dependency: com.puppycrawl.tools:checkstyle 8.18 -&gt; 8.27.
  * Update POM parent: org.apache.commons:commons-parent 48 -&gt; 50.
  * BooleanUtils Javadoc.
  * Functions Javadoc.
  * org.easymock:easymock 4.1 -&gt; 4.2.
  * org.junit-pioneer:junit-pioneer 0.4.2 -&gt; 0.5.4.
  * org.junit.jupiter:junit-jupiter 5.5.2 -&gt; 5.6.0.
  * Use Javadoc {@code} instead of pre tags.
  * ExceptionUtilsTest to 100%.
  * Reuse own code in Functions.java.
  * Avoid unnecessary allocation in StringUtils.wrapIfMissing.
  * Internally use Validate.notNull(foo, ...) instead of Validate.isTrue(foo != null, ...).
  * Add 1 and 0 in toBooleanObject(final String str).
  * Remove an redundant argument check in NumberUtils.
  * Deprecate org.apache.commons.lang3.ArrayUtils.removeAllOccurences(*) for org.apache.commons.lang3.ArrayUtils.removeAllOccurrences(*).</changelog>
  <changelog author="david.anes@suse.com" date="1640779200">- Fix component version in default.properties to 3.12</changelog>
  <changelog author="pmonreal@suse.com" date="1640779201">- Remove the junit bom dependency for now as it breaks the build of
  other packages like log4j.
  * Add apache-commons-lang3-junit-bom.patch</changelog>
  <changelog author="fstrba@suse.com" date="1693396800">- Break cycle with the new bcel
- Removed patch:
  * apache-commons-lang3-junit-bom.patch
    + not needed since we install the pom file using the new
    %%mvn_install_pom macro which sanitizes the pom file to the
    bare runtime dependencies.</changelog>
  <changelog author="fstrba@suse.com" date="1715688000">- Update to 3.14.0:
  * New features:
    + Add Functions#function(Function).
    + Add FailableFunction#function(FailableFunction).
    + Add CalendarUtils.getInstance().
    + Add syntax for optional tokens to DurationFormatUtils.
    + Add ArrayFill.
    + Add FastDateParser.TimeZoneStrategy.TzInfo.toString().
    + Add LocaleUtils.isLanguageUndetermined(Locale).
    + Add ObjectUtils.toString(Supplier&lt;Object&gt;, Supplier&lt;String&gt;).
    + Add LazyInitializer.isInitialized().
    + Add ConcurrentInitializer#isInitialized() #1120.
    + Add Streams.failableStream(T...).
    + Add FailableSupplier.nul().
    + Add Suppliers.nul().
    + Add ExceptionUtils.throwUnchecked(T) where T extends
    Throwable, and deprecate Object version.
    + Add ExceptionUtils.rethrowRuntimeException(T), and deprecate
    rethrow(T).
    + ConcurrentInitializer implementations can now be instantiated
    and configured with allocation and release lambdas.
    Fixes LANG-1716.
    + Add support for RISC-V in ArchUtils #1128. Fixes LANG-1717.
  * Fixed bugs:
    + Rename variable names from 'clss' to 'clazz'.
    + [Javadoc] ComparableUtils'c1' to 'comparable1', 'c2' to
    'comparable2'
    + [Javadoc] Remove 2.1 specific comment #1091.
    + [Javadoc] Fix Incorrect Description in Processor isAarch64()
    [#1093]. Fixes LANG-1704.
    + [Javadoc] Point to right getShortClassName flavor in Javadoc
    for relevant notes #1097.
    + Improve performance of StringUtils.isMixedCase().
    + ThreadUtils find methods should not return null items. Fixes
    LANG-1706.
    + ReflectionToStringBuilder changes in version 3.13.0 has broken
    the logic for overriding classes. Fixes LANG-1710.
    + Return "null" instead of NPE in
    ClassLoaderUtils.toString(ClassLoader).
    + Return "null" instead of NPE in
    ClassLoaderUtils.toString(URLClassLoader).
    + Return ToStringStyle.nullText instead of NPE for
    ReflectionToStringBuilder.toString().
    + Fix ThresholdCircuitBreaker#checkState().
    + Use ConcurrentInitializer implementations without subclassing.
    + Update critical value for chi-square test.
    + Fix Javadoc syntax errors #1129.
- From 3.13.0 update
  * New features:
    + Add GitHub coverage.yml.
    + Add EnumUtils.getEnumSystemProperty(...).
    + Add TriConsumer.
    + Add and use EnumUtils.getFirstEnumIgnoreCase(Class, String,
    Function, E).
    + Add and use Suppliers.
    + Add and use ArrayUtils.getComponentType(T[]).
    + Add and use ClassUtils.getComponentType(Class&gt;T[]&gt;).
    + Add and use ObjectUtils.getClass(T).
    + Add and use ArrayUtils.newInstance(Class&gt;T&gt;, int).
    + Add and use null-safe Streams.of(T...).
    + Add ClassUtils.comparator().
    + Add and use ThreadUtils.sleepQuietly(Duration).
    + Add and use ArrayUtils.setAll(T[], IntFunction).
    + Add and use ArrayUtils.setAll(T[], Supplier).
    + Add BooleanConsumer.
    + Add IntToCharFunction.
    + Add IntStreams.
    + Add UncheckedFuture.
    + Add UncheckedException.
    + Add UncheckedExecutionException.
    + Add UncheckedTimeoutException.
    + Add UncheckedInterruptedException.
    + Add TimeZones.GMT.
    + Add ObjectUtils.identityHashCodeHex(Object).
    + Add ObjectUtils.hashCodeHex(Object).
    + Add StringUtils.removeStart(String, char).
    + Add null-safe ObjectUtils.isArray(). Fixes LANG-1659.
    + Add ComparableUtils.max(A, A) and ComparableUtils.min(A, A).
    + Add UncheckedReflectiveOperationException.
    + Add and use ClassUtils.isPublic(Class).
    + Add UncheckedIllegalAccessException.
    + Add MethodInvokers.
    + Add Streams.nullSafeStream(Collection).
    + Add Streams.toStream(Collection).
    + Add Streams.failableStream(Collection) and deprecate misnamed
    stream(Collection).
    + Add Streams.failableStream(Stream) and deprecate misnamed
    stream(Stream).
    + Add EnumUtils.getEnumMap(Class, Function).
    + Add FluentBitSet.
    + Add Streams.instancesOf(Class, Collection).
    + Add ImmutablePair.ofNonNull(L, R).
    + Add ImmutableTriple.ofNonNull(L, M, R).
    + Add MutablePair.ofNonNull(L, R).
    + Add MutableTriple.ofNonNull(L, M, R).
    + Add Pair.ofNonNull(L, R).
    + Add Triple.ofNonNull(L, M, R).
    + Add ArrayUtils.containsAny(Object[], Object...).
    + Add Processor.Type.AARCH_64.
    + Add Processor.isAarch64().
    + Update ArchUtils.getProcessor(String) for "aarch64".
    + Add JavaVersion.JAVA_18.
    + Add JavaVersion.JAVA_19.
    + Add JavaVersion.JAVA_20.
    + Add JavaVersion.JAVA_21.
    + Add TimeZones.toTimeZone(TimeZone).
    + Add FutureTasks.
    + Add Memoizer(Function) and Memoizer(Function, boolean).
    + Add Consumers.
    + Add github/codeql-action.
    + Add coverage.yml.
    + Add DurationUtils.since(Temporal).
    + Add DurationUtils.of(FailableConsumer|FailableRunnbale).
    + Add ExceptionUtils.forEach(Throwable, Consumer&lt;Throwable&gt;).
    + Add ExceptionUtils.stream(Throwable).
    + Add ExceptionUtils.getRootCauseStackTraceList(Throwable).
    + Add SystemUtils.IS_OS_WINDOWS_11.
    + Add SystemUtils.IS_JAVA_16.
    + Add SystemUtils.IS_JAVA_17.
    + Add SystemUtils.IS_JAVA_18.
    + Add SystemUtils.IS_JAVA_19.
    + Add SystemUtils.IS_JAVA_20.
    + Add SystemUtils.IS_JAVA_21.
    + Add ArrayUtils.oneHot(). Fixes LANG-1627.
    + Let ReflectionToStringBuilder only reflect given field names.
    Fixes LANG-1662.
    + Add Streams.of(Enumeration&lt;E&gt;).
    + Add Streams.of(Iterable&lt;E&gt;).
    + Add Streams.of(Iterator&lt;E&gt;).
    + Simple support for Optional in ObjectUtils#isEmpty(). Fixes
    LANG-1689.
    + Add Processor.Type.getLabel().
    + Add Processor.toString().
    + Add HashCodeBuilder.equals(Object).
    + Add BooleanUtils.values() and forEach().
    + Add ClassPathUtils.packageToPath(String) and pathToPackage(String)
    + Add CalendarUtils#getDayOfYear()
    + Add NumberRange, DoubleRange, IntegerRange, LongRange.
    + Add missing exception javadoc/tests for some null arguments.
    + Add ClassLoaderUtils.getSystemURLs() and getThreadURLs().
    + Add RegExUtils.dotAll() and dotAllMatcher().
    + Add Pair.accept(FailableBiConsumer).
    + Add Pair.apply(FailableBiFunction).
    + Add ReflectionDiffBuilder.setExcludeFieldNames(...) and
    DiffExclude a... Fixes LANG-1677.
    + Add and ExceptionUtils.isChecked() and isUnchecked(). Fixes
    LANG-1647.
    + Add and use ExceptionUtils.throwUnchecked(throwable).
    + Add LockingVisitors.create(O, ReadWriteLock).
  * Fixed bugs:
    + NumberUtils.createNumber() to recognize hex integers prefixed
    with +. Fixes LANG-1645.
    + NumberUtils.createNumber() to return requested floating point
    type for zero. Fixes LANG-1646.
    + DMI: Random object created and used only once
    (DMI_RANDOM_USED_ONLY_ONCE); Better multi-threaded behavior.
    + Redundant Collection operation. Use
    Collections.emptyIterator(). Fixes LANG-1646.
    + Make Streams.stream(Collection) null-safe.
    + Allow tests to access java.util classes such as ArrayList in
    Java 16. Fixes LANG-1667.
    + OpenJDK 16 Day Period Parsing. Fixes LANG-1669.
    + Update documentation to list correct exception for null array
    parameters. Fixes LANG-1663.
    + Fixing reversed Javadoc descriptions in StopWatch.
    + Fix typos in JavaDoc. Fixes LANG-1670.
    + Simplify assertions with equivalent but more simple..
    + Avoid multiple equivalent occurrences of the same expression.
    + Remove redundant initializers.
    + Fix ObjectUtils Javadocs.
    + Make Range constructors more generic. Fixes LANG-1674.
    + Use final and Remove redundant String.
    + Use Set instead of List for checking the contains() method.
    + Javadoc for StringUtils.substringBefore(String str,
    int separator) doesn't mention that the separator is an int.
    + Fix NullPointerException in ThreadUtils.getSystemThreadGroup()
    when the current thread is stopped.
    + ArrayUtils.toPrimitive(Boolean...) null array elements map to
    false, like Boolean.parseBoolean(null) and its callers return
    false.
    + StrBuilder.StrBuilderReader.skip(long): Throw an exception
    when an implicit narrowing conversion in a compound assignment
    would result in information loss or a numeric error such as an
    overflows.
    + Deprecate Validate#notNull(Object) in favor of using
    Objects#requireNonNull(Object, String).
    + Use TimeZone from calendar in DateFormatUtils. Fixes
    LANG-1462.
    + Updating javadoc for NullPointerException when
    Validate.notNull() is called.
    + Fixing and adding DateUtils exception Javadocs.
    + Improve performance of StringUtils.unwrap(String, String).
    Fixes LANG-1679.
    + Improve performance of StringUtils.join for primitives. Fixes
    LANG-1675.
    + Fixed NPE getting Stack Trace if Throwable is null. Fixes
    LANG-1675.
    + Make Validate.isAssignableFrom() check null inputs.
    + Fix Javadoc for Validate.isAssignableFrom().
    + Make final mappingFunction variable.
    + Remove unnecessary variable creations.
    + Minor changes.
    + FastDateFormat does not support the 'L'-Pattern from
    SimpleDateFormat. Fixes LANG-1680.
    + Increase test coverage of ComparableUtils from 71% to 100%.
    + Increase method test coverage of
    MultilineRecursiveToStringStyle.
    + Fix unstable coverage of CharSequenceUtils tests noticed
    during merge of PRs 898 and 899.
    + Rewrite Conversion.binaryBeMsb0ToHexDigit to invert logic of
    binaryToHexDigit.
    + Allow extension of previously final classes ImmutablePair and
    ImmutableTriple.
    + Update ClassUtils Javadoc with some missing throws NPE.
    + Javadoc: StringUtils.repeat("", "x", 3) = "xx";.
    + StringUtils.join(Iterable, String) should only return null
    when the Iterable is null.
    + Add tests to increase coverage.
    + Extends Object clauses are redundant.
    + Simplify conditional expression..
    + Fix some Javadoc comments.
    + Deprecate getNanosOfMiili() method with typo and create proper
    getNanosOfMilli().
    + Deprecate ThreadUtils code that defines custom function
    interfaces in favor of stock java.util.function.Predicate
    usage.
    + Fix links in Javadoc and documentation.
    + Deprecate RandomUtils in favor of Apache Commons RNG
    UniformRandomProvider. Fixes LANG-1604.
    + Added docs regarding week year support. Fixes LANG-1638.
    + ClassUtils.getShortCanonicalName doesn't use the
    canonicalName. Fixes LANG-1691.
    + Validate: Get error messages without using String.format when
    varargs is empty.
    + Simplify expression (length is never &lt; 0).
    + Fix simple broken javadoc..
    + Fix typo.
    + Use Objects.requireNonNull() directly.
    + MethodUtils.getMatchingMethod() fails with "Found multiple
    candidates". Fixes LANG-1694.
    + Construct ArrayList with better default size. Fixes LANG-1643.
    + ThreadUtilsTest#testThreadGroups will test failed when using
    Junit5 parallel test.
    + Swap the order of assertion args (first excepted then actual).
    + Fix the comment of Failable, redundant "-".
    + Fix the comment of ComparableUtils, using "smallest", not
    "largest".
    + AnnotationUtilsTest and FormattableUtilsTest Only use static
    imports to import assert methods in tests.
    + [LANG-1681] Fix some FieldUtils Javadocs.
    + Remove unnecessary statement in DurationFormatUtils.
    + Corrected value of SystemUtils.JAVA_VENDOR. Fixes LANG-1699.
    + [StepSecurity] ci: Harden GitHub Actions.
    + Update Javadoc for the insert methods in ArrayUtils.
    + Deprecate ExceptionUtils.ExceptionUtils().
    + TypeUtils.getRawType() throws a NullPointerException on
    Wildcard GenericArrayType. Fixes LANG-1697.
    + Throw IllegalArgumentException instead of InternalError in the
    builder package.
    + Avoid NPE in MutableObject#equals() for null content.
    + SystemUtils fix and updates related to macOS.</changelog>
  <changelog author="gus.kenion@suse.com" date="1723204800">- Update to 3.16.0:
  * New features:
    + Add StopWatch.getSplitDuration() and deprecate
    getSplitTime().
    + Add StopWatch.getStartInstant() and deprecate getStartTime().
    + Add StopWatch.getStopInstant() and deprecate getStopTime().
    + Add StopWatch.getDuration() and deprecate getTime().
    + Add Javadoc links from StopWatch to DurationUtils #1249.
    + Add LangCollectors.collect(Collector, T...).
    + Add RandomStringUtils.secure().
    + Add RandomStringUtils.insecure().
  * Fixed bugs:
    + Reimplement StopWatch internals to use java.time.
    + RandomStringUtils.random() with a negative character index
    should throw IllegalArgumentException. Fixes LANG-1745.
    + LocaleUtils.toLocale(String) cannot parse four segments.
    Fixes LANG-1741.
    + Use fewer intermediary strings in
    DefaultExceptionContext.getFormattedExceptionMessage(String).
    + Fix Javadoc in StringUtils.splitPreserveAllTokens() #1251.
    + Deprecate ArraySort constructor for removal.
    + Deprecate CharEncoding constructor for removal.
    + Deprecate Conversion constructor for removal.
    + Deprecate Conversion constructor for removal.
    + Deprecate EntityArrays constructor for removal.
    + Deprecate ObjectToStringComparator constructor for removal.
    + Deprecate RuntimeEnvironment constructor for removal.
- Includes changes from 3.15.0:
  * New features:
    + Customize text pattern in DiffResult#toString(). Fixes
    LANG-1724.
    + Add DiffBuilder.Builder.
    + Add DiffBuilder.builder().
    + Add ReflectionDiffBuilder.Builder.
    + Add ReflectionDiffBuilder.builder().
    + Add test in TypeUtilsTest #1151.
    + Add Streams.failableStream(T), non-varargs variant.
    + Add Streams.nonNull(T), non-varargs variant.
    + Add ArrayUtils.nullTo(T[], T[]).
    + Add T ArrayUtils.arraycopy(T, int, T, int, int) fluent style.
    + Add T ArrayUtils.arraycopy(T, int, int, int, Function) fluent
    style.
    + Add SystemUtils.IS_JAVA_22.
    + Add JavaVersion.JAVA_22.
    + Add SystemProperties.getUserName(Supplier&lt;String&gt;).
    + Add SystemProperties.getLineSeparator(Supplier&lt;String&gt;).
    + Add
    + SystemProperties.getJavaSpecificationVersion(Supplier&lt;String&gt;).
    + Add SystemProperties constants and methods for system
    properties as of Java 22.
    + Add MethodUtils.getMethodObject(Class, String, Class...).
    + Add null-safe Consumers.accept() and Functions.apply() #1215.
    Fixes LANG-1733.
    + Add SystemUtils.IS_OS_ANDROID.
    + Add SystemUtils.IS_OS_MAC_OSX_SONOMA.
    + Add RuntimeEnvironment.inContainer() #1241.
    + Add AppendableJoiner and refactor string joining #1244.
  * Fixed bugs:
    + Improve Javadoc in ExceptionUtils #1136.
    + Fixed two non-deterministic tests in EnumUtilsTest.java
    [#1131].
    + Fix wrong number check that cause
    StringIndexOutOfBoundsException #1140. Fixes LANG-1721.
    + Rethrow NegativeArraySizeException as SerializationException
    in SerializationUtils.deserialize(InputStream) #1141. Fixes
    LANG-1722.
    + Throw NumberFormatException instead of
    IndexOutOfBoundsException in NumberUtils.getMantissa(String,
    int) #1145. Fixes LANG-1723.
    + Minor grammar fixes #1143.
    + ArrayUtils will return null when adding two null arrays, but
    undocumented. Fixes LANG-1713.
    + Let parent POM figure out commons.spdx.version.
    + Undeprecate ExceptionUtils.rethrow(Throwable). Fixes
    LANG-1726.
    + Test the Conversion class #1155. Fixes LANG-1702.
    + Address minor redundancies after code inspection #1148.
    + Allow EventListenerSupport to handle (and ignore) exception
    from listeners allowing invocation of all listeners #1167.
    + Deprecate AnnotationUtils 0-argument constructor.
    + Deprecate ArchUtils 0-argument constructor.
    + Deprecate ArrayUtils 0-argument constructor.
    + Deprecate BooleanUtils 0-argument constructor.
    + Deprecate CharSequenceUtils 0-argument constructor.
    + Deprecate CharSetUtils 0-argument constructor.
    + Deprecate CharUtils 0-argument constructor.
    + Deprecate ClassLoaderUtils 0-argument constructor.
    + Deprecate ClassPathUtils 0-argument constructor.
    + Deprecate ClassUtils 0-argument constructor.
    + Deprecate ConstructorUtils 0-argument constructor.
    + Deprecate DateFormatUtils 0-argument constructor.
    + Deprecate DateUtils 0-argument constructor.
    + Deprecate Diff.getType().
    + Deprecate DiffBuilder.DiffBuilder(T, T, ToStringStyle).
    + Deprecate DiffBuilder.DiffBuilder(T, T, ToStringStyle,
    boolean).
    + Deprecate DurationFormatUtils 0-argument constructor.
    + Deprecate DurationUtils 0-argument constructor.
    + Deprecate EnumUtils 0-argument constructor.
    + Deprecate EventUtils 0-argument constructor.
    + Deprecate FieldUtils 0-argument constructor.
    + Deprecate IEEE754rUtils 0-argument constructor.
    + Deprecate InheritanceUtils 0-argument constructor.
    + Deprecate IntStreams 0-argument constructor.
    + Deprecate LocaleUtils 0-argument constructor.
    + Deprecate LockingVisitors 0-argument constructor.
    + Deprecate MemberUtils 0-argument constructor.
    + Deprecate MethodUtils 0-argument constructor.
    + Deprecate NumberUtils 0-argument constructor.
    + Deprecate ObjectUtils 0-argument constructor.
    + Deprecate RandomStringUtils 0-argument constructor.
    + Deprecate RandomUtils 0-argument constructor.
    + Deprecate ReflectionDiffBuilder.ReflectionDiffBuilder(T, T,
    ToStringStyle).
    + Deprecate RegExUtils 0-argument constructor.
    + Deprecate SerializationUtils 0-argument constructor.
    + Deprecate Streams 0-argument constructor.
    + Deprecate StringEscapeUtils 0-argument constructor.
    + Deprecate StringUtils 0-argument constructor.
    + Deprecate Suppliers 0-argument constructor.
    + Deprecate SystemProperties 0-argument constructor.
    + Deprecate ThreadUtils 0-argument constructor.
    + Deprecate TypeUtils 0-argument constructor.
    + Make ArrayFill null-safe.
    + Make ArraySorter null-safe.
    + Make ArrayUtils.removeAll() null-safe.
    + Fix Java version in README.md #1170.
    + StringUtils.stripAccents() should handle ligatures, UTF32
    math blocks, etc. #1201.
    + TypeUtils.toString(Type) StackOverflowError for an inner
    class in the inner class parameterized enclosing class #657.
    Fixes LANG-1524.
    + Deprecate SystemUtils.getUserName(String) in favor of
    SystemProperties.getUserName(Supplier).
    + Make LockVisitor.acceptReadLocked(FailableConsumer)
    null-safe.
    + Make LockVisitor.applyWriteLocked(FailableConsumer)
    null-safe.
    + Make ObjectUtils.getFirstNonNull(Supplier...) null-safe.
    + Make SystemProperties.getLineSeparator(Supplier).
    + StringUtils.stripAccents(String) doesn't handle "\u0111" and
    "\u0110" (Vietnamese) #1216.
    + StringUtils.stripAccents(String) doesn't handle I with bar.
    + StringUtils.stripAccents(String) doesn't handle U with bar.
    + StringUtils.stripAccents(String) doesn't handle T with
    stroke.
    + Fix Javadoc for FluentBitSet.setInclusive(int, int) #1222.
    Fixes LANG-1735.
    + Same Javadoc changes as [TEXT-234] #1223.
    + Remove duplicate static data in
    SerializationUtils.ClassLoaderAwareObjectInputStream.
    + Reimplement RandomUtils and RandomStringUtils on top of
    SecureRandom#getInstanceStrong() #1235.
    + DiffBuilder: Type constraint for method append(...,
    DiffResult) too strict #786. Fixes LANG-1657.</changelog>
</package>
<package pkgid="8aa161da5fdff52dd1d611172d69784643d6c5b32235d3c3d258a3b43c95ef4f" name="apache-commons-lang3" arch="src">
  <version epoch="0" ver="3.16.0" rel="150200.3.9.2"/>
  <changelog author="p.drouand@gmail.com" date="1453636800">- Initial release (version 3.4)</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Specify java target and source level 1.6
- Force building with jdk &lt; 1.9, since jdk9's javadoc chocks on one
  class file (internal error)</changelog>
  <changelog author="fstrba@suse.com" date="1507550400">- Modified patch:
  * commons-lang3-3.4-javadoc.patch
    + Fix build with jdk9
- Allow building with jdk9 too
- Run fdupes on javadoc</changelog>
  <changelog author="tchvatal@suse.com" date="1525262400">- Format with spec-cleaner</changelog>
  <changelog author="fstrba@suse.com" date="1540209600">- Build commons-lang3-3.8.1 using modified build.xml and
  default.properties from 3.4.
- Removed patch:
  * commons-lang3-3.4-javadoc.patch
  - integrated in the build.xml
- Use source and target version 1.7, since the code contains
  diamond operator.</changelog>
  <changelog author="fstrba@suse.com" date="1549281600">- Clean-up the spec file and install less jar symlinks</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="fstrba@suse.com" date="1613476800">- Add OSGi manifest</changelog>
  <changelog author="rpm@fthiessen.de" date="1619179200">- Fixed SPEC file: Replaced broken URL
- Update to 3.9
  * Requires jdk &gt;= 1.8
  * Fixed issues with java 12
  * Add more SystemUtils.IS_JAVA_XX variants
  * Adding the Functions class
  * Add @FunctionalInterface to ThreadPredicate and ThreadGroupPredicate
  * Add isEmpty method to ObjectUtils
  * null-safe StringUtils.valueOf(char[]) to delegate to
    String.valueOf(char[]).
  * Add API org.apache.commons.lang3.SystemUtils.isJavaVersionAtMost(JavaVersion)
  * Consolidate the StringUtils equals and equalsIgnoreCase</changelog>
  <changelog author="david.anes@suse.com" date="1640347200">- Updated download URL.
- Update to 3.12.0:
  - New features:
  * Add BooleanUtils.booleanValues().
  * Add BooleanUtils.primitiveValues().
  * Add StringUtils.containsAnyIgnoreCase(CharSequence, CharSequence...).
  * Add StopWatch.getStopTime().
  * More test coverage for CharSequenceUtils.
  * Add fluent-style ArraySorter.
  * Add and use LocaleUtils.toLocale(Locale) to avoid NPEs.
  * Add FailableShortSupplier, handy for JDBC APIs.
  * Add JavaVersion.JAVA_17.
  * Add missing boolean[] join method.
  * Add StringUtils.substringBefore(String, int).
  * Add Range.INTEGER.
  * Add DurationUtils.
  * Introduce the use of @Nonnull, and @Nullable, and the Objects class as a helper tool.
  * Add and use true and false String constants.
  * Add and use ObjectUtils.requireNonEmpty().
  - Fixed Bugs:
  * Correct implementation of RandomUtils.nextLong(long, long).
  * Restore handling of collections for non-JSON ToStringStyle.
  * ContextedException Javadoc add missing semicolon.
  * Resolve JUnit pioneer transitive dependencies using JUnit BOM.
  * NumberUtilsTest - incorrect types in min/max tests.
  * Improve StringUtils.stripAccents conversion of remaining accents.
  * StringUtils.countMatches - clarify Javadoc.
  * Remove redundant argument from substring call.
  * BigDecimal is created when you pass it the min and max values.
  * ArrayUtils.contains() and indexOf() fail to handle Double.NaN.
  * ArrayUtils contains() and indexOf() fail to handle Float.NaN.
  * Fix potential NPE in TypeUtils.isAssignable(Type, ParameterizedType, Map, Type&gt;).
  * TypeUtils.isAssignable returns wrong result for GenericArrayType and ParameterizedType.
  * testGetAllFields and testGetFieldsWithAnnotation sometimes fail.
  * Fix Javadoc for SystemUtils.isJavaVersionAtMost().
  * Fix StringUtils.unwrap throws StringIndexOutOfBoundsException.
  * Fix formatting of isAnyBlank() and isAnyEmpty().
  * TypeUtils. containsTypeVariables does not support GenericArrayType.
  * Javadoc of some methods incorrectly refers to another method.
  * Refine StringUtils.lastIndexOfIgnoreCase.
  * Refine StringUtils.abbreviate.
  * Refine StringUtils.isNumericSpace.
  * Refine StringUtils.deleteWhitespace.
  * Correction in Javadoc of some methods.
  * Javadoc for RandomStringUtils.random() letters, numbers parameters is wrong.
  * Correct markup in Javadoc for unbalanced braces.
  * MethodUtils.invokeMethod NullPointerException in case of null in args list.
  * Fix 2 digit week year formatting.
  * Fix broken Javadoc links to commons-text.
  * Add and use ThreadUtils.sleep(Duration).
  * Add and use ThreadUtils.join(Thread, Duration).
  * Add ObjectUtils.wait(Duration).
  - Changes:
  * ArrayUtils.toPrimitive(Object) does not support boolean and other types.
  * Enable Dependabot.
  * Bump junit-jupiter from 5.6.2 to 5.7.0.
  * Bump spotbugs from 4.1.2 to 4.2.1.
  * Bump spotbugs-maven-plugin from 4.0.0 to 4.2.0.
  * Bump biz.aQute.bndlib from 5.1.1 to 5.3.0.
  * Bump junit-pioneer from 0.6.0 to 1.1.0.
  * Bump checkstyle from 8.34 to 8.40.
  * Bump actions/checkout from v2.3.1 to v2.3.4.
  * Bump actions/setup-java from v1.4.0 to v1.4.2.
  * Update commons.jacoco.version 0.8.5 to 0.8.6 (Fixes Java 15 builds).
  * Update maven-surefire-plugin 2.22.2 -&gt; 3.0.0-M5.
  * Bump maven-pmd-plugin from 3.13.0 to 3.14.0.
  * Bump jmh.version from 1.21 to 1.27.
  * Update commons.japicmp.version 0.14.3 -&gt; 0.15.2.
  * Processor.java: check enum equality with == instead of .equals() method.
  * Bump junit-pioneer from 1.1.0 to 1.3.0.
  * Bump maven-checkstyle-plugin from 3.1.1 to 3.1.2.
  * Bump actions/cache from v2 to v2.1.4.
  * Bump junit-bom from 5.7.0 to 5.7.1.
  * Minor Improvements.
  * Minor Improvement: Add final variable.try to make the code read-only.
  * Minor Improvement: Remove redundant initializer.
  * Use own validator ObjectUtils.anyNull to check null String input.
- From 3.11 Update:
  - New features:
  * Add ArrayUtils.isSameLength() to compare more array types.
  * Added the Locks class as a convenient possibility to deal with locked objects.
  * Add to Functions: FailableBooleanSupplier, FailableIntSupplier, FailableLongSupplier, FailableDoubleSupplier, and so on.
  * Add ArrayUtils.get(T[], index, T) to provide an out-of-bounds default value.
  * Add JavaVersion enum constants for Java 14 and 15.
  * Add JavaVersion enum constants for Java 16.
  * Use Java 8 lambdas and Map operations.
  * Change removeLastFieldSeparator to use endsWith.
  * Change a Pattern to a static final field, for not letting it compile each time the function invoked.
  * Add ImmutablePair factory methods left() and right().
  * Add ObjectUtils.toString(Object, Supplier&lt;String&gt;).
  * Add org.apache.commons.lang3.StringUtils.substringAfter(String, int).
  * Add org.apache.commons.lang3.StringUtils.substringAfterLast(String, int).
  - Fixed Bugs:
  * Fix Javadoc for StringUtils.appendIfMissingIgnoreCase().
  * Refine Javadoc.
  * Fix typos
  * Ignored exception `ignored`, should not be called so.
  * StringUtils.replaceEachRepeatedly gives IllegalStateException.
  * [JSON string for maps] ToStringBuilder.reflectionToString doesnt render nested maps correctly.
  * Correct Javadocs of methods that use Validate.notNull() and replace some uses of Validate.isTrue() with Validate.notNull().
  * Add allNull() and anyNull() methods to ObjectUtils.
  - Changes:
  * Refine test output for FastDateParserTest
  * CharSequenceUtils.lastIndexOf : remake it
  * remove encoding and docEncoding and use inherited values from commons-parent
  * Simplify null checks in Pair.hashCode() using Objects.hashCode().
  * Simplify null checks in Triple.hashCode() using Objects.hashCode().
  * Simplify some if statements in StringUtils.
  * Simplify a null check in the private replaceEach() method of StringUtils.
  * Replace some usages of the ternary operator with calls to Math.max() and Math.min().
  * (Javadoc) Fix return tag for throwableOf*() methods.
  * CharSequenceUtils.regionMatches is wrong dealing with Georgian.
  * Optimize ArrayUtils::isArrayIndexValid method.
  * Use List.sort instead of Collection.sort.
  * Use StandardCharsets.UTF_8.
  * Use Collections.singletonList insteadof Arrays.asList when there be only one element.
  * Change array style from `int a[]` to `int[] a`.
  * Change from addAll to constructors for some List.
  * Simplify if as some conditions are covered by others.
  * Fixed Javadocs for setTestRecursive().
  * ToStringBuilder.reflectionToString - Wrong JSON format when object has a List of Enum.
  * Make org.apache.commons.lang3.CharSequenceUtils.toCharArray(CharSequence) public.
  * org.apache.commons:commons-parent 50 -&gt; 51.
  * org.junit-pioneer:junit-pioneer 0.5.4 -&gt; 0.6.0.
  * org.junit.jupiter:junit-jupiter 5.6.0 -&gt; 5.6.2.
  * com.github.spotbugs:spotbugs 4.0.0 -&gt; 4.0.6.
  * com.puppycrawl.tools:checkstyle 8.29 -&gt; 8.34.
  * commons.surefire.version 3.0.0-M4 -&gt; 3.0.0-M5..
- From 3.10 Update:
  - New features:
  * Add ExceptionUtils.throwableOfType(Throwable, Class) and friends.
  * Add EMPTY_ARRAY constants to classes in org.apache.commons.lang3.tuple.
  * Add null-safe StringUtils APIs to wrap String#getBytes([Charset|String]).
  * Add zero arg constructor for org.apache.commons.lang3.NotImplementedException.
  * Add ArrayUtils.addFirst() methods.
  * Add Range.fit(T) to fit a value into a range.
  * Added Functions.as*, and tests thereof, as suggested by Peter Verhas
  * Add getters for lhs and rhs objects in DiffResult.
  * Generify builder classes Diffable, DiffBuilder, and DiffResult.
  * Add ClassLoaderUtils with toString() implementations.
  * Add null-safe APIs as StringUtils.toRootLowerCase(String) and StringUtils.toRootUpperCase(String).
  * Add org.apache.commons.lang3.time.Calendars.
  * Add EnumUtils getEnum() methods with default values.
  * Added indexesOf methods and simplified removeAllOccurences.
  * Add support of lambda value evaluation for defaulting methods.
  * Add factory methods to Pair classes with Map.Entry input.
  * Add StopWatch convenience APIs to format times and create a simple instance.
  * Allow a StopWatch to carry an optional message.
  * Add ComparableUtils.
  * Add org.apache.commons.lang3.SystemUtils.getUserName().
  * Add ObjectToStringComparator.
  * Add org.apache.commons.lang3.arch.Processor.Arch.getLabel().
  * Add IS_JAVA_14 and IS_JAVA_15 to org.apache.commons.lang3.SystemUtils.
  * ObjectUtils: Get first non-null supplier value.
  * Added the Streams class, and Functions.stream() as an accessor thereof.
  - Fixed Bugs:
  * Make test more stable by wrapping assertions in hashset.
  * Generate Javadoc jar on build.
  * Trivial: year of release for 3.9 says 2018, should be 2019.
  * Use synchronize on a set created with Collections.synchronizedSet before iterating.
  * StringUtils.unwrap incorrect throw StringIndexOutOfBoundsException.
  * StringIndexOutOfBoundsException in StringUtils.replaceIgnoreCase.
  * StringUtils.removeIgnoreCase("?a", "a") throws IndexOutOfBoundsException.
  * Corrected usage examples in Javadocs.
  * StringUtils abbreviate returns String of length greater than maxWidth.
  * Test may fail due to a different order of fields returned by reflection api.
  * Sort fields in ReflectionToStringBuilder for deterministic order.
  * MethodUtils will throw a NPE if invokeMethod() is called for a var-args method.
  * MethodUtils.getAnnotation() with searchSupers = true does not work if super is generic.
  - Changes:
  * Remove redundant if statements in join methods.
  * commons.japicmp.version 0.13.1 -&gt; 0.14.1.
  * junit-jupiter 5.5.0 -&gt; 5.5.1.
  * junit-jupiter 5.5.1 -&gt; 5.5.2.
  * Improve Javadoc based on the discussion of the GitHub PR.
  * maven-checkstyle-plugin 3.0.0 -&gt; 3.1.0.
  * Update documentation related to the issue LANG-696.
  * AnnotationUtils little cleanup.
  * Update test dependency: org.easymock:easymock 4.0.2 -&gt; 4.1.
  * Update test dependency: org.hamcrest:hamcrest 2.1 -&gt; 2.2.
  * Update test dependency: org.junit-pioneer:junit-pioneer 0.3.0 -&gt; 0.4.2.
  * Update build dependency: com.puppycrawl.tools:checkstyle 8.18 -&gt; 8.27.
  * Update POM parent: org.apache.commons:commons-parent 48 -&gt; 50.
  * BooleanUtils Javadoc.
  * Functions Javadoc.
  * org.easymock:easymock 4.1 -&gt; 4.2.
  * org.junit-pioneer:junit-pioneer 0.4.2 -&gt; 0.5.4.
  * org.junit.jupiter:junit-jupiter 5.5.2 -&gt; 5.6.0.
  * Use Javadoc {@code} instead of pre tags.
  * ExceptionUtilsTest to 100%.
  * Reuse own code in Functions.java.
  * Avoid unnecessary allocation in StringUtils.wrapIfMissing.
  * Internally use Validate.notNull(foo, ...) instead of Validate.isTrue(foo != null, ...).
  * Add 1 and 0 in toBooleanObject(final String str).
  * Remove an redundant argument check in NumberUtils.
  * Deprecate org.apache.commons.lang3.ArrayUtils.removeAllOccurences(*) for org.apache.commons.lang3.ArrayUtils.removeAllOccurrences(*).</changelog>
  <changelog author="david.anes@suse.com" date="1640779200">- Fix component version in default.properties to 3.12</changelog>
  <changelog author="pmonreal@suse.com" date="1640779201">- Remove the junit bom dependency for now as it breaks the build of
  other packages like log4j.
  * Add apache-commons-lang3-junit-bom.patch</changelog>
  <changelog author="fstrba@suse.com" date="1693396800">- Break cycle with the new bcel
- Removed patch:
  * apache-commons-lang3-junit-bom.patch
    + not needed since we install the pom file using the new
    %%mvn_install_pom macro which sanitizes the pom file to the
    bare runtime dependencies.</changelog>
  <changelog author="fstrba@suse.com" date="1715688000">- Update to 3.14.0:
  * New features:
    + Add Functions#function(Function).
    + Add FailableFunction#function(FailableFunction).
    + Add CalendarUtils.getInstance().
    + Add syntax for optional tokens to DurationFormatUtils.
    + Add ArrayFill.
    + Add FastDateParser.TimeZoneStrategy.TzInfo.toString().
    + Add LocaleUtils.isLanguageUndetermined(Locale).
    + Add ObjectUtils.toString(Supplier&lt;Object&gt;, Supplier&lt;String&gt;).
    + Add LazyInitializer.isInitialized().
    + Add ConcurrentInitializer#isInitialized() #1120.
    + Add Streams.failableStream(T...).
    + Add FailableSupplier.nul().
    + Add Suppliers.nul().
    + Add ExceptionUtils.throwUnchecked(T) where T extends
    Throwable, and deprecate Object version.
    + Add ExceptionUtils.rethrowRuntimeException(T), and deprecate
    rethrow(T).
    + ConcurrentInitializer implementations can now be instantiated
    and configured with allocation and release lambdas.
    Fixes LANG-1716.
    + Add support for RISC-V in ArchUtils #1128. Fixes LANG-1717.
  * Fixed bugs:
    + Rename variable names from 'clss' to 'clazz'.
    + [Javadoc] ComparableUtils'c1' to 'comparable1', 'c2' to
    'comparable2'
    + [Javadoc] Remove 2.1 specific comment #1091.
    + [Javadoc] Fix Incorrect Description in Processor isAarch64()
    [#1093]. Fixes LANG-1704.
    + [Javadoc] Point to right getShortClassName flavor in Javadoc
    for relevant notes #1097.
    + Improve performance of StringUtils.isMixedCase().
    + ThreadUtils find methods should not return null items. Fixes
    LANG-1706.
    + ReflectionToStringBuilder changes in version 3.13.0 has broken
    the logic for overriding classes. Fixes LANG-1710.
    + Return "null" instead of NPE in
    ClassLoaderUtils.toString(ClassLoader).
    + Return "null" instead of NPE in
    ClassLoaderUtils.toString(URLClassLoader).
    + Return ToStringStyle.nullText instead of NPE for
    ReflectionToStringBuilder.toString().
    + Fix ThresholdCircuitBreaker#checkState().
    + Use ConcurrentInitializer implementations without subclassing.
    + Update critical value for chi-square test.
    + Fix Javadoc syntax errors #1129.
- From 3.13.0 update
  * New features:
    + Add GitHub coverage.yml.
    + Add EnumUtils.getEnumSystemProperty(...).
    + Add TriConsumer.
    + Add and use EnumUtils.getFirstEnumIgnoreCase(Class, String,
    Function, E).
    + Add and use Suppliers.
    + Add and use ArrayUtils.getComponentType(T[]).
    + Add and use ClassUtils.getComponentType(Class&gt;T[]&gt;).
    + Add and use ObjectUtils.getClass(T).
    + Add and use ArrayUtils.newInstance(Class&gt;T&gt;, int).
    + Add and use null-safe Streams.of(T...).
    + Add ClassUtils.comparator().
    + Add and use ThreadUtils.sleepQuietly(Duration).
    + Add and use ArrayUtils.setAll(T[], IntFunction).
    + Add and use ArrayUtils.setAll(T[], Supplier).
    + Add BooleanConsumer.
    + Add IntToCharFunction.
    + Add IntStreams.
    + Add UncheckedFuture.
    + Add UncheckedException.
    + Add UncheckedExecutionException.
    + Add UncheckedTimeoutException.
    + Add UncheckedInterruptedException.
    + Add TimeZones.GMT.
    + Add ObjectUtils.identityHashCodeHex(Object).
    + Add ObjectUtils.hashCodeHex(Object).
    + Add StringUtils.removeStart(String, char).
    + Add null-safe ObjectUtils.isArray(). Fixes LANG-1659.
    + Add ComparableUtils.max(A, A) and ComparableUtils.min(A, A).
    + Add UncheckedReflectiveOperationException.
    + Add and use ClassUtils.isPublic(Class).
    + Add UncheckedIllegalAccessException.
    + Add MethodInvokers.
    + Add Streams.nullSafeStream(Collection).
    + Add Streams.toStream(Collection).
    + Add Streams.failableStream(Collection) and deprecate misnamed
    stream(Collection).
    + Add Streams.failableStream(Stream) and deprecate misnamed
    stream(Stream).
    + Add EnumUtils.getEnumMap(Class, Function).
    + Add FluentBitSet.
    + Add Streams.instancesOf(Class, Collection).
    + Add ImmutablePair.ofNonNull(L, R).
    + Add ImmutableTriple.ofNonNull(L, M, R).
    + Add MutablePair.ofNonNull(L, R).
    + Add MutableTriple.ofNonNull(L, M, R).
    + Add Pair.ofNonNull(L, R).
    + Add Triple.ofNonNull(L, M, R).
    + Add ArrayUtils.containsAny(Object[], Object...).
    + Add Processor.Type.AARCH_64.
    + Add Processor.isAarch64().
    + Update ArchUtils.getProcessor(String) for "aarch64".
    + Add JavaVersion.JAVA_18.
    + Add JavaVersion.JAVA_19.
    + Add JavaVersion.JAVA_20.
    + Add JavaVersion.JAVA_21.
    + Add TimeZones.toTimeZone(TimeZone).
    + Add FutureTasks.
    + Add Memoizer(Function) and Memoizer(Function, boolean).
    + Add Consumers.
    + Add github/codeql-action.
    + Add coverage.yml.
    + Add DurationUtils.since(Temporal).
    + Add DurationUtils.of(FailableConsumer|FailableRunnbale).
    + Add ExceptionUtils.forEach(Throwable, Consumer&lt;Throwable&gt;).
    + Add ExceptionUtils.stream(Throwable).
    + Add ExceptionUtils.getRootCauseStackTraceList(Throwable).
    + Add SystemUtils.IS_OS_WINDOWS_11.
    + Add SystemUtils.IS_JAVA_16.
    + Add SystemUtils.IS_JAVA_17.
    + Add SystemUtils.IS_JAVA_18.
    + Add SystemUtils.IS_JAVA_19.
    + Add SystemUtils.IS_JAVA_20.
    + Add SystemUtils.IS_JAVA_21.
    + Add ArrayUtils.oneHot(). Fixes LANG-1627.
    + Let ReflectionToStringBuilder only reflect given field names.
    Fixes LANG-1662.
    + Add Streams.of(Enumeration&lt;E&gt;).
    + Add Streams.of(Iterable&lt;E&gt;).
    + Add Streams.of(Iterator&lt;E&gt;).
    + Simple support for Optional in ObjectUtils#isEmpty(). Fixes
    LANG-1689.
    + Add Processor.Type.getLabel().
    + Add Processor.toString().
    + Add HashCodeBuilder.equals(Object).
    + Add BooleanUtils.values() and forEach().
    + Add ClassPathUtils.packageToPath(String) and pathToPackage(String)
    + Add CalendarUtils#getDayOfYear()
    + Add NumberRange, DoubleRange, IntegerRange, LongRange.
    + Add missing exception javadoc/tests for some null arguments.
    + Add ClassLoaderUtils.getSystemURLs() and getThreadURLs().
    + Add RegExUtils.dotAll() and dotAllMatcher().
    + Add Pair.accept(FailableBiConsumer).
    + Add Pair.apply(FailableBiFunction).
    + Add ReflectionDiffBuilder.setExcludeFieldNames(...) and
    DiffExclude a... Fixes LANG-1677.
    + Add and ExceptionUtils.isChecked() and isUnchecked(). Fixes
    LANG-1647.
    + Add and use ExceptionUtils.throwUnchecked(throwable).
    + Add LockingVisitors.create(O, ReadWriteLock).
  * Fixed bugs:
    + NumberUtils.createNumber() to recognize hex integers prefixed
    with +. Fixes LANG-1645.
    + NumberUtils.createNumber() to return requested floating point
    type for zero. Fixes LANG-1646.
    + DMI: Random object created and used only once
    (DMI_RANDOM_USED_ONLY_ONCE); Better multi-threaded behavior.
    + Redundant Collection operation. Use
    Collections.emptyIterator(). Fixes LANG-1646.
    + Make Streams.stream(Collection) null-safe.
    + Allow tests to access java.util classes such as ArrayList in
    Java 16. Fixes LANG-1667.
    + OpenJDK 16 Day Period Parsing. Fixes LANG-1669.
    + Update documentation to list correct exception for null array
    parameters. Fixes LANG-1663.
    + Fixing reversed Javadoc descriptions in StopWatch.
    + Fix typos in JavaDoc. Fixes LANG-1670.
    + Simplify assertions with equivalent but more simple..
    + Avoid multiple equivalent occurrences of the same expression.
    + Remove redundant initializers.
    + Fix ObjectUtils Javadocs.
    + Make Range constructors more generic. Fixes LANG-1674.
    + Use final and Remove redundant String.
    + Use Set instead of List for checking the contains() method.
    + Javadoc for StringUtils.substringBefore(String str,
    int separator) doesn't mention that the separator is an int.
    + Fix NullPointerException in ThreadUtils.getSystemThreadGroup()
    when the current thread is stopped.
    + ArrayUtils.toPrimitive(Boolean...) null array elements map to
    false, like Boolean.parseBoolean(null) and its callers return
    false.
    + StrBuilder.StrBuilderReader.skip(long): Throw an exception
    when an implicit narrowing conversion in a compound assignment
    would result in information loss or a numeric error such as an
    overflows.
    + Deprecate Validate#notNull(Object) in favor of using
    Objects#requireNonNull(Object, String).
    + Use TimeZone from calendar in DateFormatUtils. Fixes
    LANG-1462.
    + Updating javadoc for NullPointerException when
    Validate.notNull() is called.
    + Fixing and adding DateUtils exception Javadocs.
    + Improve performance of StringUtils.unwrap(String, String).
    Fixes LANG-1679.
    + Improve performance of StringUtils.join for primitives. Fixes
    LANG-1675.
    + Fixed NPE getting Stack Trace if Throwable is null. Fixes
    LANG-1675.
    + Make Validate.isAssignableFrom() check null inputs.
    + Fix Javadoc for Validate.isAssignableFrom().
    + Make final mappingFunction variable.
    + Remove unnecessary variable creations.
    + Minor changes.
    + FastDateFormat does not support the 'L'-Pattern from
    SimpleDateFormat. Fixes LANG-1680.
    + Increase test coverage of ComparableUtils from 71% to 100%.
    + Increase method test coverage of
    MultilineRecursiveToStringStyle.
    + Fix unstable coverage of CharSequenceUtils tests noticed
    during merge of PRs 898 and 899.
    + Rewrite Conversion.binaryBeMsb0ToHexDigit to invert logic of
    binaryToHexDigit.
    + Allow extension of previously final classes ImmutablePair and
    ImmutableTriple.
    + Update ClassUtils Javadoc with some missing throws NPE.
    + Javadoc: StringUtils.repeat("", "x", 3) = "xx";.
    + StringUtils.join(Iterable, String) should only return null
    when the Iterable is null.
    + Add tests to increase coverage.
    + Extends Object clauses are redundant.
    + Simplify conditional expression..
    + Fix some Javadoc comments.
    + Deprecate getNanosOfMiili() method with typo and create proper
    getNanosOfMilli().
    + Deprecate ThreadUtils code that defines custom function
    interfaces in favor of stock java.util.function.Predicate
    usage.
    + Fix links in Javadoc and documentation.
    + Deprecate RandomUtils in favor of Apache Commons RNG
    UniformRandomProvider. Fixes LANG-1604.
    + Added docs regarding week year support. Fixes LANG-1638.
    + ClassUtils.getShortCanonicalName doesn't use the
    canonicalName. Fixes LANG-1691.
    + Validate: Get error messages without using String.format when
    varargs is empty.
    + Simplify expression (length is never &lt; 0).
    + Fix simple broken javadoc..
    + Fix typo.
    + Use Objects.requireNonNull() directly.
    + MethodUtils.getMatchingMethod() fails with "Found multiple
    candidates". Fixes LANG-1694.
    + Construct ArrayList with better default size. Fixes LANG-1643.
    + ThreadUtilsTest#testThreadGroups will test failed when using
    Junit5 parallel test.
    + Swap the order of assertion args (first excepted then actual).
    + Fix the comment of Failable, redundant "-".
    + Fix the comment of ComparableUtils, using "smallest", not
    "largest".
    + AnnotationUtilsTest and FormattableUtilsTest Only use static
    imports to import assert methods in tests.
    + [LANG-1681] Fix some FieldUtils Javadocs.
    + Remove unnecessary statement in DurationFormatUtils.
    + Corrected value of SystemUtils.JAVA_VENDOR. Fixes LANG-1699.
    + [StepSecurity] ci: Harden GitHub Actions.
    + Update Javadoc for the insert methods in ArrayUtils.
    + Deprecate ExceptionUtils.ExceptionUtils().
    + TypeUtils.getRawType() throws a NullPointerException on
    Wildcard GenericArrayType. Fixes LANG-1697.
    + Throw IllegalArgumentException instead of InternalError in the
    builder package.
    + Avoid NPE in MutableObject#equals() for null content.
    + SystemUtils fix and updates related to macOS.</changelog>
  <changelog author="gus.kenion@suse.com" date="1723204800">- Update to 3.16.0:
  * New features:
    + Add StopWatch.getSplitDuration() and deprecate
    getSplitTime().
    + Add StopWatch.getStartInstant() and deprecate getStartTime().
    + Add StopWatch.getStopInstant() and deprecate getStopTime().
    + Add StopWatch.getDuration() and deprecate getTime().
    + Add Javadoc links from StopWatch to DurationUtils #1249.
    + Add LangCollectors.collect(Collector, T...).
    + Add RandomStringUtils.secure().
    + Add RandomStringUtils.insecure().
  * Fixed bugs:
    + Reimplement StopWatch internals to use java.time.
    + RandomStringUtils.random() with a negative character index
    should throw IllegalArgumentException. Fixes LANG-1745.
    + LocaleUtils.toLocale(String) cannot parse four segments.
    Fixes LANG-1741.
    + Use fewer intermediary strings in
    DefaultExceptionContext.getFormattedExceptionMessage(String).
    + Fix Javadoc in StringUtils.splitPreserveAllTokens() #1251.
    + Deprecate ArraySort constructor for removal.
    + Deprecate CharEncoding constructor for removal.
    + Deprecate Conversion constructor for removal.
    + Deprecate Conversion constructor for removal.
    + Deprecate EntityArrays constructor for removal.
    + Deprecate ObjectToStringComparator constructor for removal.
    + Deprecate RuntimeEnvironment constructor for removal.
- Includes changes from 3.15.0:
  * New features:
    + Customize text pattern in DiffResult#toString(). Fixes
    LANG-1724.
    + Add DiffBuilder.Builder.
    + Add DiffBuilder.builder().
    + Add ReflectionDiffBuilder.Builder.
    + Add ReflectionDiffBuilder.builder().
    + Add test in TypeUtilsTest #1151.
    + Add Streams.failableStream(T), non-varargs variant.
    + Add Streams.nonNull(T), non-varargs variant.
    + Add ArrayUtils.nullTo(T[], T[]).
    + Add T ArrayUtils.arraycopy(T, int, T, int, int) fluent style.
    + Add T ArrayUtils.arraycopy(T, int, int, int, Function) fluent
    style.
    + Add SystemUtils.IS_JAVA_22.
    + Add JavaVersion.JAVA_22.
    + Add SystemProperties.getUserName(Supplier&lt;String&gt;).
    + Add SystemProperties.getLineSeparator(Supplier&lt;String&gt;).
    + Add
    + SystemProperties.getJavaSpecificationVersion(Supplier&lt;String&gt;).
    + Add SystemProperties constants and methods for system
    properties as of Java 22.
    + Add MethodUtils.getMethodObject(Class, String, Class...).
    + Add null-safe Consumers.accept() and Functions.apply() #1215.
    Fixes LANG-1733.
    + Add SystemUtils.IS_OS_ANDROID.
    + Add SystemUtils.IS_OS_MAC_OSX_SONOMA.
    + Add RuntimeEnvironment.inContainer() #1241.
    + Add AppendableJoiner and refactor string joining #1244.
  * Fixed bugs:
    + Improve Javadoc in ExceptionUtils #1136.
    + Fixed two non-deterministic tests in EnumUtilsTest.java
    [#1131].
    + Fix wrong number check that cause
    StringIndexOutOfBoundsException #1140. Fixes LANG-1721.
    + Rethrow NegativeArraySizeException as SerializationException
    in SerializationUtils.deserialize(InputStream) #1141. Fixes
    LANG-1722.
    + Throw NumberFormatException instead of
    IndexOutOfBoundsException in NumberUtils.getMantissa(String,
    int) #1145. Fixes LANG-1723.
    + Minor grammar fixes #1143.
    + ArrayUtils will return null when adding two null arrays, but
    undocumented. Fixes LANG-1713.
    + Let parent POM figure out commons.spdx.version.
    + Undeprecate ExceptionUtils.rethrow(Throwable). Fixes
    LANG-1726.
    + Test the Conversion class #1155. Fixes LANG-1702.
    + Address minor redundancies after code inspection #1148.
    + Allow EventListenerSupport to handle (and ignore) exception
    from listeners allowing invocation of all listeners #1167.
    + Deprecate AnnotationUtils 0-argument constructor.
    + Deprecate ArchUtils 0-argument constructor.
    + Deprecate ArrayUtils 0-argument constructor.
    + Deprecate BooleanUtils 0-argument constructor.
    + Deprecate CharSequenceUtils 0-argument constructor.
    + Deprecate CharSetUtils 0-argument constructor.
    + Deprecate CharUtils 0-argument constructor.
    + Deprecate ClassLoaderUtils 0-argument constructor.
    + Deprecate ClassPathUtils 0-argument constructor.
    + Deprecate ClassUtils 0-argument constructor.
    + Deprecate ConstructorUtils 0-argument constructor.
    + Deprecate DateFormatUtils 0-argument constructor.
    + Deprecate DateUtils 0-argument constructor.
    + Deprecate Diff.getType().
    + Deprecate DiffBuilder.DiffBuilder(T, T, ToStringStyle).
    + Deprecate DiffBuilder.DiffBuilder(T, T, ToStringStyle,
    boolean).
    + Deprecate DurationFormatUtils 0-argument constructor.
    + Deprecate DurationUtils 0-argument constructor.
    + Deprecate EnumUtils 0-argument constructor.
    + Deprecate EventUtils 0-argument constructor.
    + Deprecate FieldUtils 0-argument constructor.
    + Deprecate IEEE754rUtils 0-argument constructor.
    + Deprecate InheritanceUtils 0-argument constructor.
    + Deprecate IntStreams 0-argument constructor.
    + Deprecate LocaleUtils 0-argument constructor.
    + Deprecate LockingVisitors 0-argument constructor.
    + Deprecate MemberUtils 0-argument constructor.
    + Deprecate MethodUtils 0-argument constructor.
    + Deprecate NumberUtils 0-argument constructor.
    + Deprecate ObjectUtils 0-argument constructor.
    + Deprecate RandomStringUtils 0-argument constructor.
    + Deprecate RandomUtils 0-argument constructor.
    + Deprecate ReflectionDiffBuilder.ReflectionDiffBuilder(T, T,
    ToStringStyle).
    + Deprecate RegExUtils 0-argument constructor.
    + Deprecate SerializationUtils 0-argument constructor.
    + Deprecate Streams 0-argument constructor.
    + Deprecate StringEscapeUtils 0-argument constructor.
    + Deprecate StringUtils 0-argument constructor.
    + Deprecate Suppliers 0-argument constructor.
    + Deprecate SystemProperties 0-argument constructor.
    + Deprecate ThreadUtils 0-argument constructor.
    + Deprecate TypeUtils 0-argument constructor.
    + Make ArrayFill null-safe.
    + Make ArraySorter null-safe.
    + Make ArrayUtils.removeAll() null-safe.
    + Fix Java version in README.md #1170.
    + StringUtils.stripAccents() should handle ligatures, UTF32
    math blocks, etc. #1201.
    + TypeUtils.toString(Type) StackOverflowError for an inner
    class in the inner class parameterized enclosing class #657.
    Fixes LANG-1524.
    + Deprecate SystemUtils.getUserName(String) in favor of
    SystemProperties.getUserName(Supplier).
    + Make LockVisitor.acceptReadLocked(FailableConsumer)
    null-safe.
    + Make LockVisitor.applyWriteLocked(FailableConsumer)
    null-safe.
    + Make ObjectUtils.getFirstNonNull(Supplier...) null-safe.
    + Make SystemProperties.getLineSeparator(Supplier).
    + StringUtils.stripAccents(String) doesn't handle "\u0111" and
    "\u0110" (Vietnamese) #1216.
    + StringUtils.stripAccents(String) doesn't handle I with bar.
    + StringUtils.stripAccents(String) doesn't handle U with bar.
    + StringUtils.stripAccents(String) doesn't handle T with
    stroke.
    + Fix Javadoc for FluentBitSet.setInclusive(int, int) #1222.
    Fixes LANG-1735.
    + Same Javadoc changes as [TEXT-234] #1223.
    + Remove duplicate static data in
    SerializationUtils.ClassLoaderAwareObjectInputStream.
    + Reimplement RandomUtils and RandomStringUtils on top of
    SecureRandom#getInstanceStrong() #1235.
    + DiffBuilder: Type constraint for method append(...,
    DiffResult) too strict #786. Fixes LANG-1657.</changelog>
</package>
<package pkgid="f1b6d7ce7c447daf6dc3c83ea7a0d7cc4410ecb5f7e59a7ade4221b4c35b4b17" name="apache-commons-lang3-javadoc" arch="noarch">
  <version epoch="0" ver="3.16.0" rel="150200.3.9.2"/>
  <changelog author="p.drouand@gmail.com" date="1453636800">- Initial release (version 3.4)</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Specify java target and source level 1.6
- Force building with jdk &lt; 1.9, since jdk9's javadoc chocks on one
  class file (internal error)</changelog>
  <changelog author="fstrba@suse.com" date="1507550400">- Modified patch:
  * commons-lang3-3.4-javadoc.patch
    + Fix build with jdk9
- Allow building with jdk9 too
- Run fdupes on javadoc</changelog>
  <changelog author="tchvatal@suse.com" date="1525262400">- Format with spec-cleaner</changelog>
  <changelog author="fstrba@suse.com" date="1540209600">- Build commons-lang3-3.8.1 using modified build.xml and
  default.properties from 3.4.
- Removed patch:
  * commons-lang3-3.4-javadoc.patch
  - integrated in the build.xml
- Use source and target version 1.7, since the code contains
  diamond operator.</changelog>
  <changelog author="fstrba@suse.com" date="1549281600">- Clean-up the spec file and install less jar symlinks</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="fstrba@suse.com" date="1613476800">- Add OSGi manifest</changelog>
  <changelog author="rpm@fthiessen.de" date="1619179200">- Fixed SPEC file: Replaced broken URL
- Update to 3.9
  * Requires jdk &gt;= 1.8
  * Fixed issues with java 12
  * Add more SystemUtils.IS_JAVA_XX variants
  * Adding the Functions class
  * Add @FunctionalInterface to ThreadPredicate and ThreadGroupPredicate
  * Add isEmpty method to ObjectUtils
  * null-safe StringUtils.valueOf(char[]) to delegate to
    String.valueOf(char[]).
  * Add API org.apache.commons.lang3.SystemUtils.isJavaVersionAtMost(JavaVersion)
  * Consolidate the StringUtils equals and equalsIgnoreCase</changelog>
  <changelog author="david.anes@suse.com" date="1640347200">- Updated download URL.
- Update to 3.12.0:
  - New features:
  * Add BooleanUtils.booleanValues().
  * Add BooleanUtils.primitiveValues().
  * Add StringUtils.containsAnyIgnoreCase(CharSequence, CharSequence...).
  * Add StopWatch.getStopTime().
  * More test coverage for CharSequenceUtils.
  * Add fluent-style ArraySorter.
  * Add and use LocaleUtils.toLocale(Locale) to avoid NPEs.
  * Add FailableShortSupplier, handy for JDBC APIs.
  * Add JavaVersion.JAVA_17.
  * Add missing boolean[] join method.
  * Add StringUtils.substringBefore(String, int).
  * Add Range.INTEGER.
  * Add DurationUtils.
  * Introduce the use of @Nonnull, and @Nullable, and the Objects class as a helper tool.
  * Add and use true and false String constants.
  * Add and use ObjectUtils.requireNonEmpty().
  - Fixed Bugs:
  * Correct implementation of RandomUtils.nextLong(long, long).
  * Restore handling of collections for non-JSON ToStringStyle.
  * ContextedException Javadoc add missing semicolon.
  * Resolve JUnit pioneer transitive dependencies using JUnit BOM.
  * NumberUtilsTest - incorrect types in min/max tests.
  * Improve StringUtils.stripAccents conversion of remaining accents.
  * StringUtils.countMatches - clarify Javadoc.
  * Remove redundant argument from substring call.
  * BigDecimal is created when you pass it the min and max values.
  * ArrayUtils.contains() and indexOf() fail to handle Double.NaN.
  * ArrayUtils contains() and indexOf() fail to handle Float.NaN.
  * Fix potential NPE in TypeUtils.isAssignable(Type, ParameterizedType, Map, Type&gt;).
  * TypeUtils.isAssignable returns wrong result for GenericArrayType and ParameterizedType.
  * testGetAllFields and testGetFieldsWithAnnotation sometimes fail.
  * Fix Javadoc for SystemUtils.isJavaVersionAtMost().
  * Fix StringUtils.unwrap throws StringIndexOutOfBoundsException.
  * Fix formatting of isAnyBlank() and isAnyEmpty().
  * TypeUtils. containsTypeVariables does not support GenericArrayType.
  * Javadoc of some methods incorrectly refers to another method.
  * Refine StringUtils.lastIndexOfIgnoreCase.
  * Refine StringUtils.abbreviate.
  * Refine StringUtils.isNumericSpace.
  * Refine StringUtils.deleteWhitespace.
  * Correction in Javadoc of some methods.
  * Javadoc for RandomStringUtils.random() letters, numbers parameters is wrong.
  * Correct markup in Javadoc for unbalanced braces.
  * MethodUtils.invokeMethod NullPointerException in case of null in args list.
  * Fix 2 digit week year formatting.
  * Fix broken Javadoc links to commons-text.
  * Add and use ThreadUtils.sleep(Duration).
  * Add and use ThreadUtils.join(Thread, Duration).
  * Add ObjectUtils.wait(Duration).
  - Changes:
  * ArrayUtils.toPrimitive(Object) does not support boolean and other types.
  * Enable Dependabot.
  * Bump junit-jupiter from 5.6.2 to 5.7.0.
  * Bump spotbugs from 4.1.2 to 4.2.1.
  * Bump spotbugs-maven-plugin from 4.0.0 to 4.2.0.
  * Bump biz.aQute.bndlib from 5.1.1 to 5.3.0.
  * Bump junit-pioneer from 0.6.0 to 1.1.0.
  * Bump checkstyle from 8.34 to 8.40.
  * Bump actions/checkout from v2.3.1 to v2.3.4.
  * Bump actions/setup-java from v1.4.0 to v1.4.2.
  * Update commons.jacoco.version 0.8.5 to 0.8.6 (Fixes Java 15 builds).
  * Update maven-surefire-plugin 2.22.2 -&gt; 3.0.0-M5.
  * Bump maven-pmd-plugin from 3.13.0 to 3.14.0.
  * Bump jmh.version from 1.21 to 1.27.
  * Update commons.japicmp.version 0.14.3 -&gt; 0.15.2.
  * Processor.java: check enum equality with == instead of .equals() method.
  * Bump junit-pioneer from 1.1.0 to 1.3.0.
  * Bump maven-checkstyle-plugin from 3.1.1 to 3.1.2.
  * Bump actions/cache from v2 to v2.1.4.
  * Bump junit-bom from 5.7.0 to 5.7.1.
  * Minor Improvements.
  * Minor Improvement: Add final variable.try to make the code read-only.
  * Minor Improvement: Remove redundant initializer.
  * Use own validator ObjectUtils.anyNull to check null String input.
- From 3.11 Update:
  - New features:
  * Add ArrayUtils.isSameLength() to compare more array types.
  * Added the Locks class as a convenient possibility to deal with locked objects.
  * Add to Functions: FailableBooleanSupplier, FailableIntSupplier, FailableLongSupplier, FailableDoubleSupplier, and so on.
  * Add ArrayUtils.get(T[], index, T) to provide an out-of-bounds default value.
  * Add JavaVersion enum constants for Java 14 and 15.
  * Add JavaVersion enum constants for Java 16.
  * Use Java 8 lambdas and Map operations.
  * Change removeLastFieldSeparator to use endsWith.
  * Change a Pattern to a static final field, for not letting it compile each time the function invoked.
  * Add ImmutablePair factory methods left() and right().
  * Add ObjectUtils.toString(Object, Supplier&lt;String&gt;).
  * Add org.apache.commons.lang3.StringUtils.substringAfter(String, int).
  * Add org.apache.commons.lang3.StringUtils.substringAfterLast(String, int).
  - Fixed Bugs:
  * Fix Javadoc for StringUtils.appendIfMissingIgnoreCase().
  * Refine Javadoc.
  * Fix typos
  * Ignored exception `ignored`, should not be called so.
  * StringUtils.replaceEachRepeatedly gives IllegalStateException.
  * [JSON string for maps] ToStringBuilder.reflectionToString doesnt render nested maps correctly.
  * Correct Javadocs of methods that use Validate.notNull() and replace some uses of Validate.isTrue() with Validate.notNull().
  * Add allNull() and anyNull() methods to ObjectUtils.
  - Changes:
  * Refine test output for FastDateParserTest
  * CharSequenceUtils.lastIndexOf : remake it
  * remove encoding and docEncoding and use inherited values from commons-parent
  * Simplify null checks in Pair.hashCode() using Objects.hashCode().
  * Simplify null checks in Triple.hashCode() using Objects.hashCode().
  * Simplify some if statements in StringUtils.
  * Simplify a null check in the private replaceEach() method of StringUtils.
  * Replace some usages of the ternary operator with calls to Math.max() and Math.min().
  * (Javadoc) Fix return tag for throwableOf*() methods.
  * CharSequenceUtils.regionMatches is wrong dealing with Georgian.
  * Optimize ArrayUtils::isArrayIndexValid method.
  * Use List.sort instead of Collection.sort.
  * Use StandardCharsets.UTF_8.
  * Use Collections.singletonList insteadof Arrays.asList when there be only one element.
  * Change array style from `int a[]` to `int[] a`.
  * Change from addAll to constructors for some List.
  * Simplify if as some conditions are covered by others.
  * Fixed Javadocs for setTestRecursive().
  * ToStringBuilder.reflectionToString - Wrong JSON format when object has a List of Enum.
  * Make org.apache.commons.lang3.CharSequenceUtils.toCharArray(CharSequence) public.
  * org.apache.commons:commons-parent 50 -&gt; 51.
  * org.junit-pioneer:junit-pioneer 0.5.4 -&gt; 0.6.0.
  * org.junit.jupiter:junit-jupiter 5.6.0 -&gt; 5.6.2.
  * com.github.spotbugs:spotbugs 4.0.0 -&gt; 4.0.6.
  * com.puppycrawl.tools:checkstyle 8.29 -&gt; 8.34.
  * commons.surefire.version 3.0.0-M4 -&gt; 3.0.0-M5..
- From 3.10 Update:
  - New features:
  * Add ExceptionUtils.throwableOfType(Throwable, Class) and friends.
  * Add EMPTY_ARRAY constants to classes in org.apache.commons.lang3.tuple.
  * Add null-safe StringUtils APIs to wrap String#getBytes([Charset|String]).
  * Add zero arg constructor for org.apache.commons.lang3.NotImplementedException.
  * Add ArrayUtils.addFirst() methods.
  * Add Range.fit(T) to fit a value into a range.
  * Added Functions.as*, and tests thereof, as suggested by Peter Verhas
  * Add getters for lhs and rhs objects in DiffResult.
  * Generify builder classes Diffable, DiffBuilder, and DiffResult.
  * Add ClassLoaderUtils with toString() implementations.
  * Add null-safe APIs as StringUtils.toRootLowerCase(String) and StringUtils.toRootUpperCase(String).
  * Add org.apache.commons.lang3.time.Calendars.
  * Add EnumUtils getEnum() methods with default values.
  * Added indexesOf methods and simplified removeAllOccurences.
  * Add support of lambda value evaluation for defaulting methods.
  * Add factory methods to Pair classes with Map.Entry input.
  * Add StopWatch convenience APIs to format times and create a simple instance.
  * Allow a StopWatch to carry an optional message.
  * Add ComparableUtils.
  * Add org.apache.commons.lang3.SystemUtils.getUserName().
  * Add ObjectToStringComparator.
  * Add org.apache.commons.lang3.arch.Processor.Arch.getLabel().
  * Add IS_JAVA_14 and IS_JAVA_15 to org.apache.commons.lang3.SystemUtils.
  * ObjectUtils: Get first non-null supplier value.
  * Added the Streams class, and Functions.stream() as an accessor thereof.
  - Fixed Bugs:
  * Make test more stable by wrapping assertions in hashset.
  * Generate Javadoc jar on build.
  * Trivial: year of release for 3.9 says 2018, should be 2019.
  * Use synchronize on a set created with Collections.synchronizedSet before iterating.
  * StringUtils.unwrap incorrect throw StringIndexOutOfBoundsException.
  * StringIndexOutOfBoundsException in StringUtils.replaceIgnoreCase.
  * StringUtils.removeIgnoreCase("?a", "a") throws IndexOutOfBoundsException.
  * Corrected usage examples in Javadocs.
  * StringUtils abbreviate returns String of length greater than maxWidth.
  * Test may fail due to a different order of fields returned by reflection api.
  * Sort fields in ReflectionToStringBuilder for deterministic order.
  * MethodUtils will throw a NPE if invokeMethod() is called for a var-args method.
  * MethodUtils.getAnnotation() with searchSupers = true does not work if super is generic.
  - Changes:
  * Remove redundant if statements in join methods.
  * commons.japicmp.version 0.13.1 -&gt; 0.14.1.
  * junit-jupiter 5.5.0 -&gt; 5.5.1.
  * junit-jupiter 5.5.1 -&gt; 5.5.2.
  * Improve Javadoc based on the discussion of the GitHub PR.
  * maven-checkstyle-plugin 3.0.0 -&gt; 3.1.0.
  * Update documentation related to the issue LANG-696.
  * AnnotationUtils little cleanup.
  * Update test dependency: org.easymock:easymock 4.0.2 -&gt; 4.1.
  * Update test dependency: org.hamcrest:hamcrest 2.1 -&gt; 2.2.
  * Update test dependency: org.junit-pioneer:junit-pioneer 0.3.0 -&gt; 0.4.2.
  * Update build dependency: com.puppycrawl.tools:checkstyle 8.18 -&gt; 8.27.
  * Update POM parent: org.apache.commons:commons-parent 48 -&gt; 50.
  * BooleanUtils Javadoc.
  * Functions Javadoc.
  * org.easymock:easymock 4.1 -&gt; 4.2.
  * org.junit-pioneer:junit-pioneer 0.4.2 -&gt; 0.5.4.
  * org.junit.jupiter:junit-jupiter 5.5.2 -&gt; 5.6.0.
  * Use Javadoc {@code} instead of pre tags.
  * ExceptionUtilsTest to 100%.
  * Reuse own code in Functions.java.
  * Avoid unnecessary allocation in StringUtils.wrapIfMissing.
  * Internally use Validate.notNull(foo, ...) instead of Validate.isTrue(foo != null, ...).
  * Add 1 and 0 in toBooleanObject(final String str).
  * Remove an redundant argument check in NumberUtils.
  * Deprecate org.apache.commons.lang3.ArrayUtils.removeAllOccurences(*) for org.apache.commons.lang3.ArrayUtils.removeAllOccurrences(*).</changelog>
  <changelog author="david.anes@suse.com" date="1640779200">- Fix component version in default.properties to 3.12</changelog>
  <changelog author="pmonreal@suse.com" date="1640779201">- Remove the junit bom dependency for now as it breaks the build of
  other packages like log4j.
  * Add apache-commons-lang3-junit-bom.patch</changelog>
  <changelog author="fstrba@suse.com" date="1693396800">- Break cycle with the new bcel
- Removed patch:
  * apache-commons-lang3-junit-bom.patch
    + not needed since we install the pom file using the new
    %%mvn_install_pom macro which sanitizes the pom file to the
    bare runtime dependencies.</changelog>
  <changelog author="fstrba@suse.com" date="1715688000">- Update to 3.14.0:
  * New features:
    + Add Functions#function(Function).
    + Add FailableFunction#function(FailableFunction).
    + Add CalendarUtils.getInstance().
    + Add syntax for optional tokens to DurationFormatUtils.
    + Add ArrayFill.
    + Add FastDateParser.TimeZoneStrategy.TzInfo.toString().
    + Add LocaleUtils.isLanguageUndetermined(Locale).
    + Add ObjectUtils.toString(Supplier&lt;Object&gt;, Supplier&lt;String&gt;).
    + Add LazyInitializer.isInitialized().
    + Add ConcurrentInitializer#isInitialized() #1120.
    + Add Streams.failableStream(T...).
    + Add FailableSupplier.nul().
    + Add Suppliers.nul().
    + Add ExceptionUtils.throwUnchecked(T) where T extends
    Throwable, and deprecate Object version.
    + Add ExceptionUtils.rethrowRuntimeException(T), and deprecate
    rethrow(T).
    + ConcurrentInitializer implementations can now be instantiated
    and configured with allocation and release lambdas.
    Fixes LANG-1716.
    + Add support for RISC-V in ArchUtils #1128. Fixes LANG-1717.
  * Fixed bugs:
    + Rename variable names from 'clss' to 'clazz'.
    + [Javadoc] ComparableUtils'c1' to 'comparable1', 'c2' to
    'comparable2'
    + [Javadoc] Remove 2.1 specific comment #1091.
    + [Javadoc] Fix Incorrect Description in Processor isAarch64()
    [#1093]. Fixes LANG-1704.
    + [Javadoc] Point to right getShortClassName flavor in Javadoc
    for relevant notes #1097.
    + Improve performance of StringUtils.isMixedCase().
    + ThreadUtils find methods should not return null items. Fixes
    LANG-1706.
    + ReflectionToStringBuilder changes in version 3.13.0 has broken
    the logic for overriding classes. Fixes LANG-1710.
    + Return "null" instead of NPE in
    ClassLoaderUtils.toString(ClassLoader).
    + Return "null" instead of NPE in
    ClassLoaderUtils.toString(URLClassLoader).
    + Return ToStringStyle.nullText instead of NPE for
    ReflectionToStringBuilder.toString().
    + Fix ThresholdCircuitBreaker#checkState().
    + Use ConcurrentInitializer implementations without subclassing.
    + Update critical value for chi-square test.
    + Fix Javadoc syntax errors #1129.
- From 3.13.0 update
  * New features:
    + Add GitHub coverage.yml.
    + Add EnumUtils.getEnumSystemProperty(...).
    + Add TriConsumer.
    + Add and use EnumUtils.getFirstEnumIgnoreCase(Class, String,
    Function, E).
    + Add and use Suppliers.
    + Add and use ArrayUtils.getComponentType(T[]).
    + Add and use ClassUtils.getComponentType(Class&gt;T[]&gt;).
    + Add and use ObjectUtils.getClass(T).
    + Add and use ArrayUtils.newInstance(Class&gt;T&gt;, int).
    + Add and use null-safe Streams.of(T...).
    + Add ClassUtils.comparator().
    + Add and use ThreadUtils.sleepQuietly(Duration).
    + Add and use ArrayUtils.setAll(T[], IntFunction).
    + Add and use ArrayUtils.setAll(T[], Supplier).
    + Add BooleanConsumer.
    + Add IntToCharFunction.
    + Add IntStreams.
    + Add UncheckedFuture.
    + Add UncheckedException.
    + Add UncheckedExecutionException.
    + Add UncheckedTimeoutException.
    + Add UncheckedInterruptedException.
    + Add TimeZones.GMT.
    + Add ObjectUtils.identityHashCodeHex(Object).
    + Add ObjectUtils.hashCodeHex(Object).
    + Add StringUtils.removeStart(String, char).
    + Add null-safe ObjectUtils.isArray(). Fixes LANG-1659.
    + Add ComparableUtils.max(A, A) and ComparableUtils.min(A, A).
    + Add UncheckedReflectiveOperationException.
    + Add and use ClassUtils.isPublic(Class).
    + Add UncheckedIllegalAccessException.
    + Add MethodInvokers.
    + Add Streams.nullSafeStream(Collection).
    + Add Streams.toStream(Collection).
    + Add Streams.failableStream(Collection) and deprecate misnamed
    stream(Collection).
    + Add Streams.failableStream(Stream) and deprecate misnamed
    stream(Stream).
    + Add EnumUtils.getEnumMap(Class, Function).
    + Add FluentBitSet.
    + Add Streams.instancesOf(Class, Collection).
    + Add ImmutablePair.ofNonNull(L, R).
    + Add ImmutableTriple.ofNonNull(L, M, R).
    + Add MutablePair.ofNonNull(L, R).
    + Add MutableTriple.ofNonNull(L, M, R).
    + Add Pair.ofNonNull(L, R).
    + Add Triple.ofNonNull(L, M, R).
    + Add ArrayUtils.containsAny(Object[], Object...).
    + Add Processor.Type.AARCH_64.
    + Add Processor.isAarch64().
    + Update ArchUtils.getProcessor(String) for "aarch64".
    + Add JavaVersion.JAVA_18.
    + Add JavaVersion.JAVA_19.
    + Add JavaVersion.JAVA_20.
    + Add JavaVersion.JAVA_21.
    + Add TimeZones.toTimeZone(TimeZone).
    + Add FutureTasks.
    + Add Memoizer(Function) and Memoizer(Function, boolean).
    + Add Consumers.
    + Add github/codeql-action.
    + Add coverage.yml.
    + Add DurationUtils.since(Temporal).
    + Add DurationUtils.of(FailableConsumer|FailableRunnbale).
    + Add ExceptionUtils.forEach(Throwable, Consumer&lt;Throwable&gt;).
    + Add ExceptionUtils.stream(Throwable).
    + Add ExceptionUtils.getRootCauseStackTraceList(Throwable).
    + Add SystemUtils.IS_OS_WINDOWS_11.
    + Add SystemUtils.IS_JAVA_16.
    + Add SystemUtils.IS_JAVA_17.
    + Add SystemUtils.IS_JAVA_18.
    + Add SystemUtils.IS_JAVA_19.
    + Add SystemUtils.IS_JAVA_20.
    + Add SystemUtils.IS_JAVA_21.
    + Add ArrayUtils.oneHot(). Fixes LANG-1627.
    + Let ReflectionToStringBuilder only reflect given field names.
    Fixes LANG-1662.
    + Add Streams.of(Enumeration&lt;E&gt;).
    + Add Streams.of(Iterable&lt;E&gt;).
    + Add Streams.of(Iterator&lt;E&gt;).
    + Simple support for Optional in ObjectUtils#isEmpty(). Fixes
    LANG-1689.
    + Add Processor.Type.getLabel().
    + Add Processor.toString().
    + Add HashCodeBuilder.equals(Object).
    + Add BooleanUtils.values() and forEach().
    + Add ClassPathUtils.packageToPath(String) and pathToPackage(String)
    + Add CalendarUtils#getDayOfYear()
    + Add NumberRange, DoubleRange, IntegerRange, LongRange.
    + Add missing exception javadoc/tests for some null arguments.
    + Add ClassLoaderUtils.getSystemURLs() and getThreadURLs().
    + Add RegExUtils.dotAll() and dotAllMatcher().
    + Add Pair.accept(FailableBiConsumer).
    + Add Pair.apply(FailableBiFunction).
    + Add ReflectionDiffBuilder.setExcludeFieldNames(...) and
    DiffExclude a... Fixes LANG-1677.
    + Add and ExceptionUtils.isChecked() and isUnchecked(). Fixes
    LANG-1647.
    + Add and use ExceptionUtils.throwUnchecked(throwable).
    + Add LockingVisitors.create(O, ReadWriteLock).
  * Fixed bugs:
    + NumberUtils.createNumber() to recognize hex integers prefixed
    with +. Fixes LANG-1645.
    + NumberUtils.createNumber() to return requested floating point
    type for zero. Fixes LANG-1646.
    + DMI: Random object created and used only once
    (DMI_RANDOM_USED_ONLY_ONCE); Better multi-threaded behavior.
    + Redundant Collection operation. Use
    Collections.emptyIterator(). Fixes LANG-1646.
    + Make Streams.stream(Collection) null-safe.
    + Allow tests to access java.util classes such as ArrayList in
    Java 16. Fixes LANG-1667.
    + OpenJDK 16 Day Period Parsing. Fixes LANG-1669.
    + Update documentation to list correct exception for null array
    parameters. Fixes LANG-1663.
    + Fixing reversed Javadoc descriptions in StopWatch.
    + Fix typos in JavaDoc. Fixes LANG-1670.
    + Simplify assertions with equivalent but more simple..
    + Avoid multiple equivalent occurrences of the same expression.
    + Remove redundant initializers.
    + Fix ObjectUtils Javadocs.
    + Make Range constructors more generic. Fixes LANG-1674.
    + Use final and Remove redundant String.
    + Use Set instead of List for checking the contains() method.
    + Javadoc for StringUtils.substringBefore(String str,
    int separator) doesn't mention that the separator is an int.
    + Fix NullPointerException in ThreadUtils.getSystemThreadGroup()
    when the current thread is stopped.
    + ArrayUtils.toPrimitive(Boolean...) null array elements map to
    false, like Boolean.parseBoolean(null) and its callers return
    false.
    + StrBuilder.StrBuilderReader.skip(long): Throw an exception
    when an implicit narrowing conversion in a compound assignment
    would result in information loss or a numeric error such as an
    overflows.
    + Deprecate Validate#notNull(Object) in favor of using
    Objects#requireNonNull(Object, String).
    + Use TimeZone from calendar in DateFormatUtils. Fixes
    LANG-1462.
    + Updating javadoc for NullPointerException when
    Validate.notNull() is called.
    + Fixing and adding DateUtils exception Javadocs.
    + Improve performance of StringUtils.unwrap(String, String).
    Fixes LANG-1679.
    + Improve performance of StringUtils.join for primitives. Fixes
    LANG-1675.
    + Fixed NPE getting Stack Trace if Throwable is null. Fixes
    LANG-1675.
    + Make Validate.isAssignableFrom() check null inputs.
    + Fix Javadoc for Validate.isAssignableFrom().
    + Make final mappingFunction variable.
    + Remove unnecessary variable creations.
    + Minor changes.
    + FastDateFormat does not support the 'L'-Pattern from
    SimpleDateFormat. Fixes LANG-1680.
    + Increase test coverage of ComparableUtils from 71% to 100%.
    + Increase method test coverage of
    MultilineRecursiveToStringStyle.
    + Fix unstable coverage of CharSequenceUtils tests noticed
    during merge of PRs 898 and 899.
    + Rewrite Conversion.binaryBeMsb0ToHexDigit to invert logic of
    binaryToHexDigit.
    + Allow extension of previously final classes ImmutablePair and
    ImmutableTriple.
    + Update ClassUtils Javadoc with some missing throws NPE.
    + Javadoc: StringUtils.repeat("", "x", 3) = "xx";.
    + StringUtils.join(Iterable, String) should only return null
    when the Iterable is null.
    + Add tests to increase coverage.
    + Extends Object clauses are redundant.
    + Simplify conditional expression..
    + Fix some Javadoc comments.
    + Deprecate getNanosOfMiili() method with typo and create proper
    getNanosOfMilli().
    + Deprecate ThreadUtils code that defines custom function
    interfaces in favor of stock java.util.function.Predicate
    usage.
    + Fix links in Javadoc and documentation.
    + Deprecate RandomUtils in favor of Apache Commons RNG
    UniformRandomProvider. Fixes LANG-1604.
    + Added docs regarding week year support. Fixes LANG-1638.
    + ClassUtils.getShortCanonicalName doesn't use the
    canonicalName. Fixes LANG-1691.
    + Validate: Get error messages without using String.format when
    varargs is empty.
    + Simplify expression (length is never &lt; 0).
    + Fix simple broken javadoc..
    + Fix typo.
    + Use Objects.requireNonNull() directly.
    + MethodUtils.getMatchingMethod() fails with "Found multiple
    candidates". Fixes LANG-1694.
    + Construct ArrayList with better default size. Fixes LANG-1643.
    + ThreadUtilsTest#testThreadGroups will test failed when using
    Junit5 parallel test.
    + Swap the order of assertion args (first excepted then actual).
    + Fix the comment of Failable, redundant "-".
    + Fix the comment of ComparableUtils, using "smallest", not
    "largest".
    + AnnotationUtilsTest and FormattableUtilsTest Only use static
    imports to import assert methods in tests.
    + [LANG-1681] Fix some FieldUtils Javadocs.
    + Remove unnecessary statement in DurationFormatUtils.
    + Corrected value of SystemUtils.JAVA_VENDOR. Fixes LANG-1699.
    + [StepSecurity] ci: Harden GitHub Actions.
    + Update Javadoc for the insert methods in ArrayUtils.
    + Deprecate ExceptionUtils.ExceptionUtils().
    + TypeUtils.getRawType() throws a NullPointerException on
    Wildcard GenericArrayType. Fixes LANG-1697.
    + Throw IllegalArgumentException instead of InternalError in the
    builder package.
    + Avoid NPE in MutableObject#equals() for null content.
    + SystemUtils fix and updates related to macOS.</changelog>
  <changelog author="gus.kenion@suse.com" date="1723204800">- Update to 3.16.0:
  * New features:
    + Add StopWatch.getSplitDuration() and deprecate
    getSplitTime().
    + Add StopWatch.getStartInstant() and deprecate getStartTime().
    + Add StopWatch.getStopInstant() and deprecate getStopTime().
    + Add StopWatch.getDuration() and deprecate getTime().
    + Add Javadoc links from StopWatch to DurationUtils #1249.
    + Add LangCollectors.collect(Collector, T...).
    + Add RandomStringUtils.secure().
    + Add RandomStringUtils.insecure().
  * Fixed bugs:
    + Reimplement StopWatch internals to use java.time.
    + RandomStringUtils.random() with a negative character index
    should throw IllegalArgumentException. Fixes LANG-1745.
    + LocaleUtils.toLocale(String) cannot parse four segments.
    Fixes LANG-1741.
    + Use fewer intermediary strings in
    DefaultExceptionContext.getFormattedExceptionMessage(String).
    + Fix Javadoc in StringUtils.splitPreserveAllTokens() #1251.
    + Deprecate ArraySort constructor for removal.
    + Deprecate CharEncoding constructor for removal.
    + Deprecate Conversion constructor for removal.
    + Deprecate Conversion constructor for removal.
    + Deprecate EntityArrays constructor for removal.
    + Deprecate ObjectToStringComparator constructor for removal.
    + Deprecate RuntimeEnvironment constructor for removal.
- Includes changes from 3.15.0:
  * New features:
    + Customize text pattern in DiffResult#toString(). Fixes
    LANG-1724.
    + Add DiffBuilder.Builder.
    + Add DiffBuilder.builder().
    + Add ReflectionDiffBuilder.Builder.
    + Add ReflectionDiffBuilder.builder().
    + Add test in TypeUtilsTest #1151.
    + Add Streams.failableStream(T), non-varargs variant.
    + Add Streams.nonNull(T), non-varargs variant.
    + Add ArrayUtils.nullTo(T[], T[]).
    + Add T ArrayUtils.arraycopy(T, int, T, int, int) fluent style.
    + Add T ArrayUtils.arraycopy(T, int, int, int, Function) fluent
    style.
    + Add SystemUtils.IS_JAVA_22.
    + Add JavaVersion.JAVA_22.
    + Add SystemProperties.getUserName(Supplier&lt;String&gt;).
    + Add SystemProperties.getLineSeparator(Supplier&lt;String&gt;).
    + Add
    + SystemProperties.getJavaSpecificationVersion(Supplier&lt;String&gt;).
    + Add SystemProperties constants and methods for system
    properties as of Java 22.
    + Add MethodUtils.getMethodObject(Class, String, Class...).
    + Add null-safe Consumers.accept() and Functions.apply() #1215.
    Fixes LANG-1733.
    + Add SystemUtils.IS_OS_ANDROID.
    + Add SystemUtils.IS_OS_MAC_OSX_SONOMA.
    + Add RuntimeEnvironment.inContainer() #1241.
    + Add AppendableJoiner and refactor string joining #1244.
  * Fixed bugs:
    + Improve Javadoc in ExceptionUtils #1136.
    + Fixed two non-deterministic tests in EnumUtilsTest.java
    [#1131].
    + Fix wrong number check that cause
    StringIndexOutOfBoundsException #1140. Fixes LANG-1721.
    + Rethrow NegativeArraySizeException as SerializationException
    in SerializationUtils.deserialize(InputStream) #1141. Fixes
    LANG-1722.
    + Throw NumberFormatException instead of
    IndexOutOfBoundsException in NumberUtils.getMantissa(String,
    int) #1145. Fixes LANG-1723.
    + Minor grammar fixes #1143.
    + ArrayUtils will return null when adding two null arrays, but
    undocumented. Fixes LANG-1713.
    + Let parent POM figure out commons.spdx.version.
    + Undeprecate ExceptionUtils.rethrow(Throwable). Fixes
    LANG-1726.
    + Test the Conversion class #1155. Fixes LANG-1702.
    + Address minor redundancies after code inspection #1148.
    + Allow EventListenerSupport to handle (and ignore) exception
    from listeners allowing invocation of all listeners #1167.
    + Deprecate AnnotationUtils 0-argument constructor.
    + Deprecate ArchUtils 0-argument constructor.
    + Deprecate ArrayUtils 0-argument constructor.
    + Deprecate BooleanUtils 0-argument constructor.
    + Deprecate CharSequenceUtils 0-argument constructor.
    + Deprecate CharSetUtils 0-argument constructor.
    + Deprecate CharUtils 0-argument constructor.
    + Deprecate ClassLoaderUtils 0-argument constructor.
    + Deprecate ClassPathUtils 0-argument constructor.
    + Deprecate ClassUtils 0-argument constructor.
    + Deprecate ConstructorUtils 0-argument constructor.
    + Deprecate DateFormatUtils 0-argument constructor.
    + Deprecate DateUtils 0-argument constructor.
    + Deprecate Diff.getType().
    + Deprecate DiffBuilder.DiffBuilder(T, T, ToStringStyle).
    + Deprecate DiffBuilder.DiffBuilder(T, T, ToStringStyle,
    boolean).
    + Deprecate DurationFormatUtils 0-argument constructor.
    + Deprecate DurationUtils 0-argument constructor.
    + Deprecate EnumUtils 0-argument constructor.
    + Deprecate EventUtils 0-argument constructor.
    + Deprecate FieldUtils 0-argument constructor.
    + Deprecate IEEE754rUtils 0-argument constructor.
    + Deprecate InheritanceUtils 0-argument constructor.
    + Deprecate IntStreams 0-argument constructor.
    + Deprecate LocaleUtils 0-argument constructor.
    + Deprecate LockingVisitors 0-argument constructor.
    + Deprecate MemberUtils 0-argument constructor.
    + Deprecate MethodUtils 0-argument constructor.
    + Deprecate NumberUtils 0-argument constructor.
    + Deprecate ObjectUtils 0-argument constructor.
    + Deprecate RandomStringUtils 0-argument constructor.
    + Deprecate RandomUtils 0-argument constructor.
    + Deprecate ReflectionDiffBuilder.ReflectionDiffBuilder(T, T,
    ToStringStyle).
    + Deprecate RegExUtils 0-argument constructor.
    + Deprecate SerializationUtils 0-argument constructor.
    + Deprecate Streams 0-argument constructor.
    + Deprecate StringEscapeUtils 0-argument constructor.
    + Deprecate StringUtils 0-argument constructor.
    + Deprecate Suppliers 0-argument constructor.
    + Deprecate SystemProperties 0-argument constructor.
    + Deprecate ThreadUtils 0-argument constructor.
    + Deprecate TypeUtils 0-argument constructor.
    + Make ArrayFill null-safe.
    + Make ArraySorter null-safe.
    + Make ArrayUtils.removeAll() null-safe.
    + Fix Java version in README.md #1170.
    + StringUtils.stripAccents() should handle ligatures, UTF32
    math blocks, etc. #1201.
    + TypeUtils.toString(Type) StackOverflowError for an inner
    class in the inner class parameterized enclosing class #657.
    Fixes LANG-1524.
    + Deprecate SystemUtils.getUserName(String) in favor of
    SystemProperties.getUserName(Supplier).
    + Make LockVisitor.acceptReadLocked(FailableConsumer)
    null-safe.
    + Make LockVisitor.applyWriteLocked(FailableConsumer)
    null-safe.
    + Make ObjectUtils.getFirstNonNull(Supplier...) null-safe.
    + Make SystemProperties.getLineSeparator(Supplier).
    + StringUtils.stripAccents(String) doesn't handle "\u0111" and
    "\u0110" (Vietnamese) #1216.
    + StringUtils.stripAccents(String) doesn't handle I with bar.
    + StringUtils.stripAccents(String) doesn't handle U with bar.
    + StringUtils.stripAccents(String) doesn't handle T with
    stroke.
    + Fix Javadoc for FluentBitSet.setInclusive(int, int) #1222.
    Fixes LANG-1735.
    + Same Javadoc changes as [TEXT-234] #1223.
    + Remove duplicate static data in
    SerializationUtils.ClassLoaderAwareObjectInputStream.
    + Reimplement RandomUtils and RandomStringUtils on top of
    SecureRandom#getInstanceStrong() #1235.
    + DiffBuilder: Type constraint for method append(...,
    DiffResult) too strict #786. Fixes LANG-1657.</changelog>
</package>
<package pkgid="1377b208c1805864516cf236f88fb9d8ba0650dfa63e88818465e935a8815d13" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="e367c4f3e0908b65eacbe2dd34484b340e5c8749adc745421a503db8011a071b" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="6810567cc9e19a888eadc152e0070f47a83b9abae7ebd8c94e44fc23a06e4a1e" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="06c5e81f4d4a6a03b22cf864293f063b8c0ea7e792db86a5a0458dfc7f198906" name="apache2" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="e9df642b4b857f38aee120996fda71c251e49d0b1a5246e52e1bbccbea8d1c78" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="393f2b100c4cd0e5e688cf3ad185701a876e4efb7194de95280360378dc51374" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="27feb29002eda4d9ade288e76ab90e97bc6165a1d53974d741c0fed82b178f9d" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="2b43dfb47ca16c7e2e2100d41035b3469a36be6333f0a2617d2d01d70d362a5b" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="71278026010f998bca2e5311836a518e03e84f66915248c012d62e7e64666a54" name="apache2" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="2f5b35ba68fa8a57a8a5354ce14dba2a09e2551d98dab365654273e39fc7d7f4" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="76b8b9ed7c05e25c47956f83f2e5161c27cb6ef32ce4b6c6d53d976cc4b1d6b1" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="684b589b4d9914c3d503bb169dc2c2d0f7cbfe76c87213dfd4226986ec3f8c27" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="565ad6f240581ca8a635c2b8d6a816d8a184e4223f43808982f5a3d8d68edd42" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="2a6e2fd1dc775831efb1eeee6cb4fb82e42aa3347fce2fd8f4fc25f9e9535539" name="apache2" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="54fc0f838e770caf9cfebd07e12b19b37b4cb8dd3e0c2e5166e4ee7d313628a1" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="aa3bc6e179a94415329822923f9021884761a5369884a12ac94a499c6809157c" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="6e4c4e48435d027be90dfb83d323adb3593210ffedcd1878528691d1c73f410b" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="3b2a64f932e5eb92698e7cfa6eb29c4c4bb0f02ce738e7af8bb612b1d96ef773" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="8e4f6f952812f27801135ef3d87ed1b4bc7e00cd24a851736d9036c0453c78e3" name="apache2" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="3f79f129edc6d4be2d475dcb144725f9b35988a5b917c907b1de3801109cd109" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="298dada7a0211e328024552f176b3af7ec61be5f744e1e70a1532b92668300ba" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="8973aab8d912b3d0ec1a06bd6c8b24f2fe9c6c8efc7dad20a29a640854c79b45" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="0e6bf49982e660677f587b6947fd3e9982e96a668f9c7f5b7450b8addc149c0b" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="010a8b248cfc8720c134fe9c7f7347f8606a837056d1cdb4ab7d6b332b8ac556" name="apache2" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="c0a3629856ddb93350dcbdd5cfc00a4843eb2104f954b6720f0920764842a8ec" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="b8fb31b86163a064d2587158238baad627e2d233bcf6a930fdb51c6fbcbc63bd" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="abfafc15d76d4943d22f4f67184af6a6a58cbfd843c405b9bd3dd74a2c063af7" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="73a3b8cffccea06e42dabe088c6c847e50c88d44a3e1c40f28b8915f4cc96c3a" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="d99f2a49729c4ba96dd4687aa474c3d970a5e6edde15f9c2fa146fa1d74af99b" name="apache2" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="88b05bf122ed2f78ad583cf461d4143698d518f0edaa823c4f2e5e275492601e" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="4fdf0296c82346f25cc5a6a5b03d28026f271ea9211a3832984be5d3eae12258" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="18084dfbc5fcb95f0de6951a35bbf60de8bc0c7051053a029faff255effbf8a1" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="85f4629c63da695f334913f84fee79ce65b695777a52ee80b9dd5c1ab7649df9" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="5112a9fc80889cb436938b0c2860f0e4468770846d01a9d04abf011ebe5b5981" name="apache2" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="babd7c5a4622a821310a527cf280593ceadcd815a1f49c41c27feee7c943a748" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="2a7b4c5e3e0699033e7dcec4248f061c42416bfe3e6301bfa5cbb6621bec5d6a" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="35adfcb62cff86ce426d9cee850aa5174dfa091d18253a26e805a4071405bcdf" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="42575ac51737aee60a87e98ab35311a8afb11f2c0a10492085c46b003c8a8f50" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="aa22978d231fd5c32a6cf20142f8fde613723527bdc57afb122a9581adc2118b" name="apache2-devel" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="3109c24e47f4c00258133c4a733d54e04d24e87e8e070f0199b921a84a81530c" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="9670fd4c785719068905d1ed7db5c00cba655f0893a24e480512e121c35295d4" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="4ed2076f50e4908a8f8910a1fb8230eeaa82b0bf38c2c50e2d6e5da5aca469a4" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="990f8646bbb3a9fb159addc06caadce0dbbf19642547b85d278176dfdb1248e7" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="d8d50a7fb53484b097a700e93c0e2fbf135ea6080dfdb304eb8346eadb5924f0" name="apache2-devel" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="279e8ae4c01e88627ef199b110049a809e6cccb33ce77c808ff67f2a854382f2" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="76b08e9b03b0df49d22bbd2751d43e9735058f085ad4dfec0626e1a6a9cbd685" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="b3b4c781c316bf78dffe59aa6be3285cdecae5a4d085311b25341c95fd85585b" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="625c32b25c22ca7fc17e58c8fc3037ce97d027dd814f575caba891ceb8a6765e" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="34a301794e3f5b1a68f4874fc8477dce617b3f6ab536b7664fb08aadcdcb66dd" name="apache2-devel" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="26a025d732b45dc3ed911c44fa49e47a6697c144b24452ecb08ceb6820f60d40" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="6dd804dccdd8a9d8969bba18efc62d140a2150e3560dfd782ea9ecc791955a45" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="06be46a5fdb91931236e75344a0221703535fc4c9b2d89a06f3b4b608fa9361f" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="2f40da543da1656dcb7a8aea18a81b353770876b7a3e0c14cea6708088db2653" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="ba76310cc0d728d97be699acb2a00393eaed98a53abcc928a8710f7b43d63af7" name="apache2-devel" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="f261e0056f9ff7cf461d9046f3a224338cc4321aa029ec695282da98bf8364ba" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="c6b04830d3865acf0f67a7b9ba2060b81946b2c09e450f260f328e9198cba36a" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="e7915055bf13a2c7daad9510afacf77594d25e269aaa017c67152c55a49e2510" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="c9f1a8ff1edab3fa5b210778a0da7f58cc2497a0673385c53b7b156e941ff046" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="9206d3a1f2e1278a3124716fdb8dee5f31c7ee749c8b43471d34a8fc9a5b47b2" name="apache2-devel" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="e45fcbdceb82f61c884537d3cd327c40abd3323e9e42e0cbb64a68549c24b84b" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="b782b7532ef9180fdf3e062be12000894452a8a8255932bf4db84f9f9e7be368" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="508faa8566b388ef82fcc838bf82f28371d5b651cae82c235ee29e41b3f7f017" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="a45649fb1f8a227eebf5419a883e6930f51fa0b4a1b149e2020f20df943cca4d" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="3a0e6cfe3c471db0a40960cae81e3dc571dbbdbdcb151e91f67ca1d9278b4a85" name="apache2-devel" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="8420b5db6035ee48efd0ff500f3e7ab1cd31b326f3a6d99de02e6f83343c3566" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="7952ae9b75e6a85d953cb1f311cbecfae26caf0db27a21d0a7cf6373015bec24" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="5520b492e78e21037e4885d4ff727bcfc018fc5e24de6bb9bd1940e44db916d0" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="208a20170c9144452edd53d70141bb3e1bbb7b509525ab41410f09a6142313d6" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="c49017a3f61f0d1305e186d06f969ab39ef54387b0a72dce35f3bd8cc465c38d" name="apache2-devel" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="3ef4dcb48592bade6fd35b2f9e2c6dd455b96fde039fe147fac4cc823b57803a" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="bf3b84081d54000b910ecd404964da6e6497215392cd655a42dc9e1c162aab78" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="613b5292e8cf78c2384718170d6c704ecff0c52c0435726cc21dcc75223e18ef" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="bb542a59d35e37b8983c2a501a8c4181a0a7a0f841fb69a029031bd4de8736dd" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="404a80acbb15289c3d7e4c814833fffb8bd0aa88bf8147eb2eef93ee07f151a3" name="apache2-event" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="44de2eedea687d22381d853a7ec3951b416c89b430d8c07b16283a19731fadfd" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="0e788045f6a15f2496a4980f0c80e0a2befe94e9f6681b5913b3b6b46ac2238f" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="4c982fb399ef5a3011cc71d7e8998ef4cf9ebd144662e1e5e827ea98b93e8b6d" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="256683ccb370606acef4fd2606840de6f7f8d2538185c40910b774e9f6fae196" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="e189fa93506a659bc24939cc1ad26e5df5a52e9478de40be89208fe8877e82fd" name="apache2-event" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="bbf32e2e0c2bff37f267f62e1af78311e350d5c53ccc7e10bbf86199efd9828b" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="f8f9410a102a3436234db3a2cde68f0e8eef626b98074bf643d3ab678f25e78c" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="a9d55930568d446301c0d2fa8f088ed8248ccfa90d08995f43bf1f67ae333b32" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="8e5b76c8bbb44979350a8fedec636fa0c5032421420c7d240b7cecf83e8d45e9" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="0898675a2cec1b50dfcd7e2e0c9d86f79f874e8330bcfe7158f852cb4ba0998c" name="apache2-event" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="850c0b616256a0232b45d1773e3589f253a4bf4d336f9d51ca4c4a5497c6f09e" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="85316a214fc5f0dc6163aa3cfeea72ca448cbfa898e6f3e8c24e6ea285e58c90" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="71a44976029627ee388e29b21995f1bbd65a2b6d57d2b49dabe6d4a273b6f481" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="e052f8ae98aa88e0e11fbdd0383fd86d20eb46486499a897f6431adba7fe71a4" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="a6b610b69340b5e7b250d1299bba3245920da1faae8c271837142447fc3cc536" name="apache2-event" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="dab1c623957c8a077ffde395dc9d1dae6057dac5a14e18b2bd912bea827364c3" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="9e991fe3feaf16ba2db3be3d6d688d2ff3e9e8429b02bca8148e7eb736ed7a80" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="e6dd200593bf493549f8ae1294c591e99d63901fb2b7ca75606b9abf48daf786" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="ba3ddad0ecbb035eeff6e8fe31eec55cad8e4332cc59ee4b9c4107309a6eb13a" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="dee38f2c59f2f66778e42e0eb79abebf851ddb1f8959f00007ce4758e6994abb" name="apache2-event" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="0f0e30457139ff51404d182f6209f044e6f323d1d51cf71c70a47a422758c025" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="e2361a92430288d3c9eabba32520b88b87b194b19ea3d18e151d32084c4302a7" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="b3aa93d997ea1856937266b1a3534a07c97bd2fe7886efb3d487b952c5ac1e4c" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="8db4caa550d65636b5451e1afdf6713c6487f7bb60ebec975c001357cbbe816b" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="1dd35e8f1af5b06c3b57209d7bc63c727d9f0c248afc7bd0c60072a063800eb7" name="apache2-event" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="c5fb607039e7f0d1c9922e610140d06ecfd80f72a9c9ec6204ab78e332017c1e" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="52baf9704f56676478a17777a5a5c2f3d1d8f1a30cea7674e06946415e480872" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="a1cf89495e8fa725e5e5040ba2e2ebfa20eb3036888acd7c86d879c63a759c78" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="8c5ec9290a03b4f3c83a23afb92bb8dccc6df94b42fcabaa7e1d49fc29671814" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="b8adfdb9582357f3f61eeaeccc2daffc8ab6d4c48bcb0e614d3c321f8b9dc3f9" name="apache2-event" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="b231805468c224848b1cb242d70a28e7072c535abeff58769fc505d4b47388f8" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="49402c8b59919790b8764bef174411be9e400f22a8fd1edc60e3f57090ed47bb" name="apache2-manual" arch="noarch">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="bcac2c2ffab6789cc35dace888fb5c70ffe86ab7f682fafa19f66599a567f8e4" name="apache2-manual" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="0353727a5d0470944e38f4068e0950413a2b55f6d7ebf0943b3df391cfe91468" name="apache2-manual" arch="noarch">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="64a59c770e6d923ca5239518deebc0d754045b2eed9b3d59828fb107e529599e" name="apache2-manual" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="935f1d6e18eb5d828edc3bf408e88c62bd6817b9838240f47c87729552b4b68f" name="apache2-manual" arch="noarch">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="a2ca544daa5f1dfaca33e736f90cc1cc86cf6539d3fd2255f94fa6f5aa2ea966" name="apache2-manual" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="43d11a3bc3790f5146d94d31bd6caa57d6915f8044695e9a0b1d121443305930" name="apache2-manual" arch="noarch">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="ccd956579b1e86d3769a6fc9ad35ddcf383babe2281c5a556491908ddde80d31" name="apache2-manual" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="190d4bc1632c0d942ba37a5f2121c06304e413715f2d14e25fc1d0075b89d820" name="apache2-manual" arch="noarch">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="92fdf3d75eea25216faf55581633f0f8f5fc14fd40118f418471269abdd66533" name="apache2-manual" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="5360c09fa41d6da08450ad63c18fe99015f71c0b54b49276e62ff9b7a7e69c93" name="apache2-manual" arch="noarch">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="24ea6c0ed18663b2e28ad9c240776b281c290fa6af1155820590ebc22d18d7fb" name="apache2-manual" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="4020b40059993e453d2bdf31a5de60892c7a2f4e9f4dd3763456aeb125715c5e" name="apache2-manual" arch="noarch">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="32213fb4de4ab58a99dd80cde7d480465088d2e20d45d5fdc12f3609ecd3d52c" name="apache2-manual" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="cebc165efd05e370fbf522c411a939251a941f8607879ee8e167954a4be60054" name="apache2-mod_auth_openidc" arch="aarch64">
  <version epoch="0" ver="2.3.8" rel="150600.16.5.1"/>
  <changelog author="christof.hanke@mpcdf.mpg.de" date="1513166400">- initial packaging</changelog>
  <changelog author="vcizek@suse.com" date="1524830400">- update to 2.3.4
- requested in fate#323817</changelog>
  <changelog author="kstreitova@suse.com" date="1540900800">- update to 2.3.8
- changes in 2.3.8
  * fix return result FALSE when JWT payload parsing fails
  * add LGTM code quality badges
  * fix 3 LGTM alerts
  * improve auto-detection of XMLHttpRequests via Accept header
  * initialize test_proto_authorization_request properly
  * add sanity check on provider-&gt;auth_request_method
  * allow usage with LibreSSL
  * don't return content with 503 since it will turn the HTTP
    status code into a 200
  * add option to set an upper limit to the number of concurrent
    state cookies via OIDCStateMaxNumberOfCookies
  * make the default maximum number of parallel state cookies
    7 instead of unlimited
  * fix using access token as endpoint auth method in
    introspection calls
  * fix reading access_token form POST parameters when combined
    with `AuthType auth-openidc`
- changes in 2.3.7
  * abort when string length for remote user name substitution
    is larger than 255 characters
  * fix Redis concurrency issue when used with multiple vhosts
  * add support for authorization server metadata with
    OIDCOAuthServerMetadataURL as in RFC 8414
  * refactor session object creation
  * clear session cookie and contents if cache corruption is detected
  * use apr_pstrdup when setting r-&gt;user
  * reserve 255 characters in remote username substition instead of 50
- changes in 2.3.6
  * add check to detect session cache corruption for server-based
    caches and cached static metadata
  * avoid using pipelining for Redis
  * send Basic header in OAuth www-authenticate response if that's
    the only accepted method; thanks @puiterwijk
  * refactor Redis cache backend to solve issues on AUTH errors:
    a) memory leak and b) redisGetReply lagging behind
  * adjust copyright year/org
  * fix buffer overflow in shm cache key set strcpy
  * turn missing session_state from warning into a debug statement
  * fix missing "return" on error return from the OP
  * explicitly set encryption kid so we're compatible with
    cjose &gt;= 0.6.0
- changes in 2.3.5
  * fix encoding of preserved POST data
  * avoid buffer overflow in shm cache key construction
  * compile with with Libressl</changelog>
  <changelog author="kstreitova@suse.com" date="1541764800">- submission to SLE15SP1 because of fate#324447
- build with hiredis only for openSUSE where hiredis is available
- add a version for jansson BuildRequires</changelog>
  <changelog author="kstreitova@suse.com" date="1572436800">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-14857.patch to fix
  open redirect issue that exists in URLs with trailing slashes
  [bsc#1153666], [CVE-2019-14857]</changelog>
  <changelog author="kstreitova@suse.com" date="1583323200">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch to fix
  open redirect issue that exists in URLs with a slash and
  backslash at the beginning [bsc#1164459], [CVE-2019-20479]</changelog>
  <changelog author="pgajdos@suse.com" date="1617278400">- require hiredis only for newer distros than SLE-15 [jsc#SLE-11726]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627041600">- Fix CVE-2021-32785 format string bug via hiredis
  (CVE-2021-32785, bsc#1188638)
  * fix-CVE-2021-32785.patch
- Fix CVE-2021-32786 open redirect in logout functionality
  (CVE-2021-32786, bsc#1188639)
  * fix-CVE-2021-32786.patch
- Refresh apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627473600">- Fix CVE-2021-32791 Hardcoded static IV and AAD with a reused key in AES GCM encryption
  (CVE-2021-32791, bsc#1188849)
  * fix-CVE-2021-32791.patch
- Fix CVE-2021-32792 XSS when using OIDCPreservePost On
  (CVE-2021-32792, bsc#1188848)
  * fix-CVE-2021-32792-1.patch
  * fix-CVE-2021-32792-2.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649851200">- Fix CVE-2021-39191 open redirect issue in target_link_uri parameter
  (CVE-2021-39191, bsc#1190223)
  * fix-CVE-2021-39191.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671796800">- Fix CVE-2022-23527, Open Redirect in oidc_validate_redirect_url() using tab character
  (CVE-2022-23527, bsc#1206441)
  * fix-CVE-2022-23527-0.patch
  * fix-CVE-2022-23527-1.patch
  * fix-CVE-2022-23527-3.patch
  * fix-CVE-2022-23527-2.patch
- Harden oidc_handle_refresh_token_request function
  * harden-refresh-token-request.patch
- Fixes bsc#1199868, mod_auth_openidc not loading</changelog>
  <changelog author="danilo.spinella@suse.com" date="1680609600">- Fix CVE-2023-28625, NULL pointer dereference when OIDCStripCookies is
  set and a crafted Cookie header is supplied, bsc#1210073
  * fix-CVE-2023-28625.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1719489600">- Fix CVE-2024-24814, DoS when `OIDCSessionType client-cookie` is set
  and a crafted Cookie header is supplied, bsc#1219911
  * fix-CVE-2024-24814.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1720008000">- Fix apxs2 binary location, which made the library file be installed in root folder,
  bsc#1227261</changelog>
</package>
<package pkgid="c343a3bcf2ef53087cdde7b8dabf4f789dd6a630025f9d63661f7f534e1df151" name="apache2-mod_auth_openidc" arch="ppc64le">
  <version epoch="0" ver="2.3.8" rel="150600.16.5.1"/>
  <changelog author="christof.hanke@mpcdf.mpg.de" date="1513166400">- initial packaging</changelog>
  <changelog author="vcizek@suse.com" date="1524830400">- update to 2.3.4
- requested in fate#323817</changelog>
  <changelog author="kstreitova@suse.com" date="1540900800">- update to 2.3.8
- changes in 2.3.8
  * fix return result FALSE when JWT payload parsing fails
  * add LGTM code quality badges
  * fix 3 LGTM alerts
  * improve auto-detection of XMLHttpRequests via Accept header
  * initialize test_proto_authorization_request properly
  * add sanity check on provider-&gt;auth_request_method
  * allow usage with LibreSSL
  * don't return content with 503 since it will turn the HTTP
    status code into a 200
  * add option to set an upper limit to the number of concurrent
    state cookies via OIDCStateMaxNumberOfCookies
  * make the default maximum number of parallel state cookies
    7 instead of unlimited
  * fix using access token as endpoint auth method in
    introspection calls
  * fix reading access_token form POST parameters when combined
    with `AuthType auth-openidc`
- changes in 2.3.7
  * abort when string length for remote user name substitution
    is larger than 255 characters
  * fix Redis concurrency issue when used with multiple vhosts
  * add support for authorization server metadata with
    OIDCOAuthServerMetadataURL as in RFC 8414
  * refactor session object creation
  * clear session cookie and contents if cache corruption is detected
  * use apr_pstrdup when setting r-&gt;user
  * reserve 255 characters in remote username substition instead of 50
- changes in 2.3.6
  * add check to detect session cache corruption for server-based
    caches and cached static metadata
  * avoid using pipelining for Redis
  * send Basic header in OAuth www-authenticate response if that's
    the only accepted method; thanks @puiterwijk
  * refactor Redis cache backend to solve issues on AUTH errors:
    a) memory leak and b) redisGetReply lagging behind
  * adjust copyright year/org
  * fix buffer overflow in shm cache key set strcpy
  * turn missing session_state from warning into a debug statement
  * fix missing "return" on error return from the OP
  * explicitly set encryption kid so we're compatible with
    cjose &gt;= 0.6.0
- changes in 2.3.5
  * fix encoding of preserved POST data
  * avoid buffer overflow in shm cache key construction
  * compile with with Libressl</changelog>
  <changelog author="kstreitova@suse.com" date="1541764800">- submission to SLE15SP1 because of fate#324447
- build with hiredis only for openSUSE where hiredis is available
- add a version for jansson BuildRequires</changelog>
  <changelog author="kstreitova@suse.com" date="1572436800">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-14857.patch to fix
  open redirect issue that exists in URLs with trailing slashes
  [bsc#1153666], [CVE-2019-14857]</changelog>
  <changelog author="kstreitova@suse.com" date="1583323200">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch to fix
  open redirect issue that exists in URLs with a slash and
  backslash at the beginning [bsc#1164459], [CVE-2019-20479]</changelog>
  <changelog author="pgajdos@suse.com" date="1617278400">- require hiredis only for newer distros than SLE-15 [jsc#SLE-11726]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627041600">- Fix CVE-2021-32785 format string bug via hiredis
  (CVE-2021-32785, bsc#1188638)
  * fix-CVE-2021-32785.patch
- Fix CVE-2021-32786 open redirect in logout functionality
  (CVE-2021-32786, bsc#1188639)
  * fix-CVE-2021-32786.patch
- Refresh apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627473600">- Fix CVE-2021-32791 Hardcoded static IV and AAD with a reused key in AES GCM encryption
  (CVE-2021-32791, bsc#1188849)
  * fix-CVE-2021-32791.patch
- Fix CVE-2021-32792 XSS when using OIDCPreservePost On
  (CVE-2021-32792, bsc#1188848)
  * fix-CVE-2021-32792-1.patch
  * fix-CVE-2021-32792-2.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649851200">- Fix CVE-2021-39191 open redirect issue in target_link_uri parameter
  (CVE-2021-39191, bsc#1190223)
  * fix-CVE-2021-39191.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671796800">- Fix CVE-2022-23527, Open Redirect in oidc_validate_redirect_url() using tab character
  (CVE-2022-23527, bsc#1206441)
  * fix-CVE-2022-23527-0.patch
  * fix-CVE-2022-23527-1.patch
  * fix-CVE-2022-23527-3.patch
  * fix-CVE-2022-23527-2.patch
- Harden oidc_handle_refresh_token_request function
  * harden-refresh-token-request.patch
- Fixes bsc#1199868, mod_auth_openidc not loading</changelog>
  <changelog author="danilo.spinella@suse.com" date="1680609600">- Fix CVE-2023-28625, NULL pointer dereference when OIDCStripCookies is
  set and a crafted Cookie header is supplied, bsc#1210073
  * fix-CVE-2023-28625.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1719489600">- Fix CVE-2024-24814, DoS when `OIDCSessionType client-cookie` is set
  and a crafted Cookie header is supplied, bsc#1219911
  * fix-CVE-2024-24814.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1720008000">- Fix apxs2 binary location, which made the library file be installed in root folder,
  bsc#1227261</changelog>
</package>
<package pkgid="81557ac071e3ab97ed8a0e399c507f47ac56ee482acd7cd5871b373f332a9359" name="apache2-mod_auth_openidc" arch="s390x">
  <version epoch="0" ver="2.3.8" rel="150600.16.5.1"/>
  <changelog author="christof.hanke@mpcdf.mpg.de" date="1513166400">- initial packaging</changelog>
  <changelog author="vcizek@suse.com" date="1524830400">- update to 2.3.4
- requested in fate#323817</changelog>
  <changelog author="kstreitova@suse.com" date="1540900800">- update to 2.3.8
- changes in 2.3.8
  * fix return result FALSE when JWT payload parsing fails
  * add LGTM code quality badges
  * fix 3 LGTM alerts
  * improve auto-detection of XMLHttpRequests via Accept header
  * initialize test_proto_authorization_request properly
  * add sanity check on provider-&gt;auth_request_method
  * allow usage with LibreSSL
  * don't return content with 503 since it will turn the HTTP
    status code into a 200
  * add option to set an upper limit to the number of concurrent
    state cookies via OIDCStateMaxNumberOfCookies
  * make the default maximum number of parallel state cookies
    7 instead of unlimited
  * fix using access token as endpoint auth method in
    introspection calls
  * fix reading access_token form POST parameters when combined
    with `AuthType auth-openidc`
- changes in 2.3.7
  * abort when string length for remote user name substitution
    is larger than 255 characters
  * fix Redis concurrency issue when used with multiple vhosts
  * add support for authorization server metadata with
    OIDCOAuthServerMetadataURL as in RFC 8414
  * refactor session object creation
  * clear session cookie and contents if cache corruption is detected
  * use apr_pstrdup when setting r-&gt;user
  * reserve 255 characters in remote username substition instead of 50
- changes in 2.3.6
  * add check to detect session cache corruption for server-based
    caches and cached static metadata
  * avoid using pipelining for Redis
  * send Basic header in OAuth www-authenticate response if that's
    the only accepted method; thanks @puiterwijk
  * refactor Redis cache backend to solve issues on AUTH errors:
    a) memory leak and b) redisGetReply lagging behind
  * adjust copyright year/org
  * fix buffer overflow in shm cache key set strcpy
  * turn missing session_state from warning into a debug statement
  * fix missing "return" on error return from the OP
  * explicitly set encryption kid so we're compatible with
    cjose &gt;= 0.6.0
- changes in 2.3.5
  * fix encoding of preserved POST data
  * avoid buffer overflow in shm cache key construction
  * compile with with Libressl</changelog>
  <changelog author="kstreitova@suse.com" date="1541764800">- submission to SLE15SP1 because of fate#324447
- build with hiredis only for openSUSE where hiredis is available
- add a version for jansson BuildRequires</changelog>
  <changelog author="kstreitova@suse.com" date="1572436800">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-14857.patch to fix
  open redirect issue that exists in URLs with trailing slashes
  [bsc#1153666], [CVE-2019-14857]</changelog>
  <changelog author="kstreitova@suse.com" date="1583323200">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch to fix
  open redirect issue that exists in URLs with a slash and
  backslash at the beginning [bsc#1164459], [CVE-2019-20479]</changelog>
  <changelog author="pgajdos@suse.com" date="1617278400">- require hiredis only for newer distros than SLE-15 [jsc#SLE-11726]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627041600">- Fix CVE-2021-32785 format string bug via hiredis
  (CVE-2021-32785, bsc#1188638)
  * fix-CVE-2021-32785.patch
- Fix CVE-2021-32786 open redirect in logout functionality
  (CVE-2021-32786, bsc#1188639)
  * fix-CVE-2021-32786.patch
- Refresh apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627473600">- Fix CVE-2021-32791 Hardcoded static IV and AAD with a reused key in AES GCM encryption
  (CVE-2021-32791, bsc#1188849)
  * fix-CVE-2021-32791.patch
- Fix CVE-2021-32792 XSS when using OIDCPreservePost On
  (CVE-2021-32792, bsc#1188848)
  * fix-CVE-2021-32792-1.patch
  * fix-CVE-2021-32792-2.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649851200">- Fix CVE-2021-39191 open redirect issue in target_link_uri parameter
  (CVE-2021-39191, bsc#1190223)
  * fix-CVE-2021-39191.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671796800">- Fix CVE-2022-23527, Open Redirect in oidc_validate_redirect_url() using tab character
  (CVE-2022-23527, bsc#1206441)
  * fix-CVE-2022-23527-0.patch
  * fix-CVE-2022-23527-1.patch
  * fix-CVE-2022-23527-3.patch
  * fix-CVE-2022-23527-2.patch
- Harden oidc_handle_refresh_token_request function
  * harden-refresh-token-request.patch
- Fixes bsc#1199868, mod_auth_openidc not loading</changelog>
  <changelog author="danilo.spinella@suse.com" date="1680609600">- Fix CVE-2023-28625, NULL pointer dereference when OIDCStripCookies is
  set and a crafted Cookie header is supplied, bsc#1210073
  * fix-CVE-2023-28625.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1719489600">- Fix CVE-2024-24814, DoS when `OIDCSessionType client-cookie` is set
  and a crafted Cookie header is supplied, bsc#1219911
  * fix-CVE-2024-24814.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1720008000">- Fix apxs2 binary location, which made the library file be installed in root folder,
  bsc#1227261</changelog>
</package>
<package pkgid="5b2cb567fc5bc622578c91fdae5d2c1511d054e51dcdc65795364c5bf2e1b498" name="apache2-mod_auth_openidc" arch="src">
  <version epoch="0" ver="2.3.8" rel="150600.16.5.1"/>
  <changelog author="christof.hanke@mpcdf.mpg.de" date="1513166400">- initial packaging</changelog>
  <changelog author="vcizek@suse.com" date="1524830400">- update to 2.3.4
- requested in fate#323817</changelog>
  <changelog author="kstreitova@suse.com" date="1540900800">- update to 2.3.8
- changes in 2.3.8
  * fix return result FALSE when JWT payload parsing fails
  * add LGTM code quality badges
  * fix 3 LGTM alerts
  * improve auto-detection of XMLHttpRequests via Accept header
  * initialize test_proto_authorization_request properly
  * add sanity check on provider-&gt;auth_request_method
  * allow usage with LibreSSL
  * don't return content with 503 since it will turn the HTTP
    status code into a 200
  * add option to set an upper limit to the number of concurrent
    state cookies via OIDCStateMaxNumberOfCookies
  * make the default maximum number of parallel state cookies
    7 instead of unlimited
  * fix using access token as endpoint auth method in
    introspection calls
  * fix reading access_token form POST parameters when combined
    with `AuthType auth-openidc`
- changes in 2.3.7
  * abort when string length for remote user name substitution
    is larger than 255 characters
  * fix Redis concurrency issue when used with multiple vhosts
  * add support for authorization server metadata with
    OIDCOAuthServerMetadataURL as in RFC 8414
  * refactor session object creation
  * clear session cookie and contents if cache corruption is detected
  * use apr_pstrdup when setting r-&gt;user
  * reserve 255 characters in remote username substition instead of 50
- changes in 2.3.6
  * add check to detect session cache corruption for server-based
    caches and cached static metadata
  * avoid using pipelining for Redis
  * send Basic header in OAuth www-authenticate response if that's
    the only accepted method; thanks @puiterwijk
  * refactor Redis cache backend to solve issues on AUTH errors:
    a) memory leak and b) redisGetReply lagging behind
  * adjust copyright year/org
  * fix buffer overflow in shm cache key set strcpy
  * turn missing session_state from warning into a debug statement
  * fix missing "return" on error return from the OP
  * explicitly set encryption kid so we're compatible with
    cjose &gt;= 0.6.0
- changes in 2.3.5
  * fix encoding of preserved POST data
  * avoid buffer overflow in shm cache key construction
  * compile with with Libressl</changelog>
  <changelog author="kstreitova@suse.com" date="1541764800">- submission to SLE15SP1 because of fate#324447
- build with hiredis only for openSUSE where hiredis is available
- add a version for jansson BuildRequires</changelog>
  <changelog author="kstreitova@suse.com" date="1572436800">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-14857.patch to fix
  open redirect issue that exists in URLs with trailing slashes
  [bsc#1153666], [CVE-2019-14857]</changelog>
  <changelog author="kstreitova@suse.com" date="1583323200">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch to fix
  open redirect issue that exists in URLs with a slash and
  backslash at the beginning [bsc#1164459], [CVE-2019-20479]</changelog>
  <changelog author="pgajdos@suse.com" date="1617278400">- require hiredis only for newer distros than SLE-15 [jsc#SLE-11726]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627041600">- Fix CVE-2021-32785 format string bug via hiredis
  (CVE-2021-32785, bsc#1188638)
  * fix-CVE-2021-32785.patch
- Fix CVE-2021-32786 open redirect in logout functionality
  (CVE-2021-32786, bsc#1188639)
  * fix-CVE-2021-32786.patch
- Refresh apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627473600">- Fix CVE-2021-32791 Hardcoded static IV and AAD with a reused key in AES GCM encryption
  (CVE-2021-32791, bsc#1188849)
  * fix-CVE-2021-32791.patch
- Fix CVE-2021-32792 XSS when using OIDCPreservePost On
  (CVE-2021-32792, bsc#1188848)
  * fix-CVE-2021-32792-1.patch
  * fix-CVE-2021-32792-2.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649851200">- Fix CVE-2021-39191 open redirect issue in target_link_uri parameter
  (CVE-2021-39191, bsc#1190223)
  * fix-CVE-2021-39191.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671796800">- Fix CVE-2022-23527, Open Redirect in oidc_validate_redirect_url() using tab character
  (CVE-2022-23527, bsc#1206441)
  * fix-CVE-2022-23527-0.patch
  * fix-CVE-2022-23527-1.patch
  * fix-CVE-2022-23527-3.patch
  * fix-CVE-2022-23527-2.patch
- Harden oidc_handle_refresh_token_request function
  * harden-refresh-token-request.patch
- Fixes bsc#1199868, mod_auth_openidc not loading</changelog>
  <changelog author="danilo.spinella@suse.com" date="1680609600">- Fix CVE-2023-28625, NULL pointer dereference when OIDCStripCookies is
  set and a crafted Cookie header is supplied, bsc#1210073
  * fix-CVE-2023-28625.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1719489600">- Fix CVE-2024-24814, DoS when `OIDCSessionType client-cookie` is set
  and a crafted Cookie header is supplied, bsc#1219911
  * fix-CVE-2024-24814.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1720008000">- Fix apxs2 binary location, which made the library file be installed in root folder,
  bsc#1227261</changelog>
</package>
<package pkgid="18d1e0d08d4b775e7ba19360b3c12a9058c93d14a982c376986a0d95e236e3e2" name="apache2-mod_auth_openidc" arch="x86_64">
  <version epoch="0" ver="2.3.8" rel="150600.16.5.1"/>
  <changelog author="christof.hanke@mpcdf.mpg.de" date="1513166400">- initial packaging</changelog>
  <changelog author="vcizek@suse.com" date="1524830400">- update to 2.3.4
- requested in fate#323817</changelog>
  <changelog author="kstreitova@suse.com" date="1540900800">- update to 2.3.8
- changes in 2.3.8
  * fix return result FALSE when JWT payload parsing fails
  * add LGTM code quality badges
  * fix 3 LGTM alerts
  * improve auto-detection of XMLHttpRequests via Accept header
  * initialize test_proto_authorization_request properly
  * add sanity check on provider-&gt;auth_request_method
  * allow usage with LibreSSL
  * don't return content with 503 since it will turn the HTTP
    status code into a 200
  * add option to set an upper limit to the number of concurrent
    state cookies via OIDCStateMaxNumberOfCookies
  * make the default maximum number of parallel state cookies
    7 instead of unlimited
  * fix using access token as endpoint auth method in
    introspection calls
  * fix reading access_token form POST parameters when combined
    with `AuthType auth-openidc`
- changes in 2.3.7
  * abort when string length for remote user name substitution
    is larger than 255 characters
  * fix Redis concurrency issue when used with multiple vhosts
  * add support for authorization server metadata with
    OIDCOAuthServerMetadataURL as in RFC 8414
  * refactor session object creation
  * clear session cookie and contents if cache corruption is detected
  * use apr_pstrdup when setting r-&gt;user
  * reserve 255 characters in remote username substition instead of 50
- changes in 2.3.6
  * add check to detect session cache corruption for server-based
    caches and cached static metadata
  * avoid using pipelining for Redis
  * send Basic header in OAuth www-authenticate response if that's
    the only accepted method; thanks @puiterwijk
  * refactor Redis cache backend to solve issues on AUTH errors:
    a) memory leak and b) redisGetReply lagging behind
  * adjust copyright year/org
  * fix buffer overflow in shm cache key set strcpy
  * turn missing session_state from warning into a debug statement
  * fix missing "return" on error return from the OP
  * explicitly set encryption kid so we're compatible with
    cjose &gt;= 0.6.0
- changes in 2.3.5
  * fix encoding of preserved POST data
  * avoid buffer overflow in shm cache key construction
  * compile with with Libressl</changelog>
  <changelog author="kstreitova@suse.com" date="1541764800">- submission to SLE15SP1 because of fate#324447
- build with hiredis only for openSUSE where hiredis is available
- add a version for jansson BuildRequires</changelog>
  <changelog author="kstreitova@suse.com" date="1572436800">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-14857.patch to fix
  open redirect issue that exists in URLs with trailing slashes
  [bsc#1153666], [CVE-2019-14857]</changelog>
  <changelog author="kstreitova@suse.com" date="1583323200">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch to fix
  open redirect issue that exists in URLs with a slash and
  backslash at the beginning [bsc#1164459], [CVE-2019-20479]</changelog>
  <changelog author="pgajdos@suse.com" date="1617278400">- require hiredis only for newer distros than SLE-15 [jsc#SLE-11726]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627041600">- Fix CVE-2021-32785 format string bug via hiredis
  (CVE-2021-32785, bsc#1188638)
  * fix-CVE-2021-32785.patch
- Fix CVE-2021-32786 open redirect in logout functionality
  (CVE-2021-32786, bsc#1188639)
  * fix-CVE-2021-32786.patch
- Refresh apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627473600">- Fix CVE-2021-32791 Hardcoded static IV and AAD with a reused key in AES GCM encryption
  (CVE-2021-32791, bsc#1188849)
  * fix-CVE-2021-32791.patch
- Fix CVE-2021-32792 XSS when using OIDCPreservePost On
  (CVE-2021-32792, bsc#1188848)
  * fix-CVE-2021-32792-1.patch
  * fix-CVE-2021-32792-2.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649851200">- Fix CVE-2021-39191 open redirect issue in target_link_uri parameter
  (CVE-2021-39191, bsc#1190223)
  * fix-CVE-2021-39191.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671796800">- Fix CVE-2022-23527, Open Redirect in oidc_validate_redirect_url() using tab character
  (CVE-2022-23527, bsc#1206441)
  * fix-CVE-2022-23527-0.patch
  * fix-CVE-2022-23527-1.patch
  * fix-CVE-2022-23527-3.patch
  * fix-CVE-2022-23527-2.patch
- Harden oidc_handle_refresh_token_request function
  * harden-refresh-token-request.patch
- Fixes bsc#1199868, mod_auth_openidc not loading</changelog>
  <changelog author="danilo.spinella@suse.com" date="1680609600">- Fix CVE-2023-28625, NULL pointer dereference when OIDCStripCookies is
  set and a crafted Cookie header is supplied, bsc#1210073
  * fix-CVE-2023-28625.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1719489600">- Fix CVE-2024-24814, DoS when `OIDCSessionType client-cookie` is set
  and a crafted Cookie header is supplied, bsc#1219911
  * fix-CVE-2024-24814.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1720008000">- Fix apxs2 binary location, which made the library file be installed in root folder,
  bsc#1227261</changelog>
</package>
<package pkgid="ee3e2bf39272f0d119fb9384fa7c047d5a09f9b7e064df516801a19db8abdc5d" name="apache2-mod_php7" arch="aarch64">
  <version epoch="0" ver="7.4.33" rel="150400.4.37.1"/>
  <changelog author="suse+build@de-korte.org" date="1632398400">- updated to 7.4.24: This is a security release (CVE-2021-21706)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.24</changelog>
  <changelog author="pgajdos@suse.com" date="1632744000">- previous version updates fixes also:
  CVE-2020-7068,CVE-2020-7069,CVE-2020-7070,CVE-2020-7071,
  CVE-2021-21702,CVE-2021-21704,CVE-2021-21705
  bsc#1175223,bsc#1177351,bsc#1177352,bsc#1180706,
  bsc#1182049,bsc#1188035,bsc#1188037</changelog>
  <changelog author="suse+build@de-korte.org" date="1634904000">- updated to 7.4.25: This is a security release (CVE-2021-21703)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.25</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1654862400">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655467200">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
- fixes [bsc#1203867] and [bsc#1203870]
- deleted patches
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
  <changelog author="pgajdos@suse.com" date="1673265600">- security update
- added patches
  fix CVE-2022-31631 [bsc#1206958], Due to an integer overflow PDO:quote() may return unquoted string
  + php7-CVE-2022-31631.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1676635200">- security update
- added patches
  fix CVE-2023-0568 [bsc#1208366], NULL byte off-by-one in php_check_specific_open_basedir
  + php7-CVE-2023-0568.patch
  fix CVE-2023-0662 [bsc#1208367], DoS vulnerability when parsing multipart request body
  + php7-CVE-2023-0662.patch
  https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 [bsc#1208388]
  + php7-crypt-possible-buffer-overread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678104000">- ensure extension=mysqlnd will be called before extension=mysqli
  [bsc#1205162]</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- fix potential buffer overflow [bsc#1208199]
- modified patches
  % php-systzdata-v19.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1679400000">- security update
- added patches
  fix CVE-2022-4900 [bsc#1209537], potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable
  + php7-CVE-2022-4900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1686830400">- security update
- added patches
  fix CVE-2023-3247 [bsc#1212349], Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
  + php7-CVE-2023-3247.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692792000">- security update
- added patches
  fix CVE-2023-3823 [bsc#1214106], XML loading external entity without being enabled
  + php7-CVE-2023-3823.patch
  fix CVE-2023-3824 [bsc#1214103], buffer overflows in phar_dir_read()
  + php7-CVE-2023-3824.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1705406400">- ensure we are building against openssl-1_1</changelog>
  <changelog author="pgajdos@suse.com" date="1713528000">- security update
- added patches
  fix CVE-2024-2756 [bsc#1222857], host/secure cookie bypass due to partial fix
  + php7-CVE-2024-2756.patch
  fix CVE-2024-3096 [bsc#1222858], password_verify can erroneously return true, opening ATO risk
  + php7-CVE-2024-3096.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-5458 [bsc#1226073], filter bypass in filter_var FILTER_VALIDATE_URL
  + php7-CVE-2024-5458.patch</changelog>
</package>
<package pkgid="367b3194f3bf2ffe5119f4a1179d10c85b7d91e8d477937add0b8f9bb5ca299f" name="apache2-mod_php7" arch="ppc64le">
  <version epoch="0" ver="7.4.33" rel="150400.4.37.1"/>
  <changelog author="suse+build@de-korte.org" date="1632398400">- updated to 7.4.24: This is a security release (CVE-2021-21706)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.24</changelog>
  <changelog author="pgajdos@suse.com" date="1632744000">- previous version updates fixes also:
  CVE-2020-7068,CVE-2020-7069,CVE-2020-7070,CVE-2020-7071,
  CVE-2021-21702,CVE-2021-21704,CVE-2021-21705
  bsc#1175223,bsc#1177351,bsc#1177352,bsc#1180706,
  bsc#1182049,bsc#1188035,bsc#1188037</changelog>
  <changelog author="suse+build@de-korte.org" date="1634904000">- updated to 7.4.25: This is a security release (CVE-2021-21703)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.25</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1654862400">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655467200">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
- fixes [bsc#1203867] and [bsc#1203870]
- deleted patches
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
  <changelog author="pgajdos@suse.com" date="1673265600">- security update
- added patches
  fix CVE-2022-31631 [bsc#1206958], Due to an integer overflow PDO:quote() may return unquoted string
  + php7-CVE-2022-31631.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1676635200">- security update
- added patches
  fix CVE-2023-0568 [bsc#1208366], NULL byte off-by-one in php_check_specific_open_basedir
  + php7-CVE-2023-0568.patch
  fix CVE-2023-0662 [bsc#1208367], DoS vulnerability when parsing multipart request body
  + php7-CVE-2023-0662.patch
  https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 [bsc#1208388]
  + php7-crypt-possible-buffer-overread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678104000">- ensure extension=mysqlnd will be called before extension=mysqli
  [bsc#1205162]</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- fix potential buffer overflow [bsc#1208199]
- modified patches
  % php-systzdata-v19.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1679400000">- security update
- added patches
  fix CVE-2022-4900 [bsc#1209537], potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable
  + php7-CVE-2022-4900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1686830400">- security update
- added patches
  fix CVE-2023-3247 [bsc#1212349], Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
  + php7-CVE-2023-3247.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692792000">- security update
- added patches
  fix CVE-2023-3823 [bsc#1214106], XML loading external entity without being enabled
  + php7-CVE-2023-3823.patch
  fix CVE-2023-3824 [bsc#1214103], buffer overflows in phar_dir_read()
  + php7-CVE-2023-3824.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1705406400">- ensure we are building against openssl-1_1</changelog>
  <changelog author="pgajdos@suse.com" date="1713528000">- security update
- added patches
  fix CVE-2024-2756 [bsc#1222857], host/secure cookie bypass due to partial fix
  + php7-CVE-2024-2756.patch
  fix CVE-2024-3096 [bsc#1222858], password_verify can erroneously return true, opening ATO risk
  + php7-CVE-2024-3096.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-5458 [bsc#1226073], filter bypass in filter_var FILTER_VALIDATE_URL
  + php7-CVE-2024-5458.patch</changelog>
</package>
<package pkgid="7e88a7cb6a4beb588f0feb27767608aae1eb8e3e973b72ebda5962f32ddc919a" name="apache2-mod_php7" arch="s390x">
  <version epoch="0" ver="7.4.33" rel="150400.4.37.1"/>
  <changelog author="suse+build@de-korte.org" date="1632398400">- updated to 7.4.24: This is a security release (CVE-2021-21706)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.24</changelog>
  <changelog author="pgajdos@suse.com" date="1632744000">- previous version updates fixes also:
  CVE-2020-7068,CVE-2020-7069,CVE-2020-7070,CVE-2020-7071,
  CVE-2021-21702,CVE-2021-21704,CVE-2021-21705
  bsc#1175223,bsc#1177351,bsc#1177352,bsc#1180706,
  bsc#1182049,bsc#1188035,bsc#1188037</changelog>
  <changelog author="suse+build@de-korte.org" date="1634904000">- updated to 7.4.25: This is a security release (CVE-2021-21703)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.25</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1654862400">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655467200">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
- fixes [bsc#1203867] and [bsc#1203870]
- deleted patches
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
  <changelog author="pgajdos@suse.com" date="1673265600">- security update
- added patches
  fix CVE-2022-31631 [bsc#1206958], Due to an integer overflow PDO:quote() may return unquoted string
  + php7-CVE-2022-31631.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1676635200">- security update
- added patches
  fix CVE-2023-0568 [bsc#1208366], NULL byte off-by-one in php_check_specific_open_basedir
  + php7-CVE-2023-0568.patch
  fix CVE-2023-0662 [bsc#1208367], DoS vulnerability when parsing multipart request body
  + php7-CVE-2023-0662.patch
  https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 [bsc#1208388]
  + php7-crypt-possible-buffer-overread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678104000">- ensure extension=mysqlnd will be called before extension=mysqli
  [bsc#1205162]</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- fix potential buffer overflow [bsc#1208199]
- modified patches
  % php-systzdata-v19.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1679400000">- security update
- added patches
  fix CVE-2022-4900 [bsc#1209537], potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable
  + php7-CVE-2022-4900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1686830400">- security update
- added patches
  fix CVE-2023-3247 [bsc#1212349], Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
  + php7-CVE-2023-3247.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692792000">- security update
- added patches
  fix CVE-2023-3823 [bsc#1214106], XML loading external entity without being enabled
  + php7-CVE-2023-3823.patch
  fix CVE-2023-3824 [bsc#1214103], buffer overflows in phar_dir_read()
  + php7-CVE-2023-3824.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1705406400">- ensure we are building against openssl-1_1</changelog>
  <changelog author="pgajdos@suse.com" date="1713528000">- security update
- added patches
  fix CVE-2024-2756 [bsc#1222857], host/secure cookie bypass due to partial fix
  + php7-CVE-2024-2756.patch
  fix CVE-2024-3096 [bsc#1222858], password_verify can erroneously return true, opening ATO risk
  + php7-CVE-2024-3096.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-5458 [bsc#1226073], filter bypass in filter_var FILTER_VALIDATE_URL
  + php7-CVE-2024-5458.patch</changelog>
</package>
<package pkgid="5901e548fe0d51be18bed8a40885d5a856a846274b01cdd29a55f5804f0ead5f" name="apache2-mod_php7" arch="src">
  <version epoch="0" ver="7.4.33" rel="150400.4.37.1"/>
  <changelog author="suse+build@de-korte.org" date="1632398400">- updated to 7.4.24: This is a security release (CVE-2021-21706)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.24</changelog>
  <changelog author="pgajdos@suse.com" date="1632744000">- previous version updates fixes also:
  CVE-2020-7068,CVE-2020-7069,CVE-2020-7070,CVE-2020-7071,
  CVE-2021-21702,CVE-2021-21704,CVE-2021-21705
  bsc#1175223,bsc#1177351,bsc#1177352,bsc#1180706,
  bsc#1182049,bsc#1188035,bsc#1188037</changelog>
  <changelog author="suse+build@de-korte.org" date="1634904000">- updated to 7.4.25: This is a security release (CVE-2021-21703)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.25</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1654862400">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655467200">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
- fixes [bsc#1203867] and [bsc#1203870]
- deleted patches
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
  <changelog author="pgajdos@suse.com" date="1673265600">- security update
- added patches
  fix CVE-2022-31631 [bsc#1206958], Due to an integer overflow PDO:quote() may return unquoted string
  + php7-CVE-2022-31631.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1676635200">- security update
- added patches
  fix CVE-2023-0568 [bsc#1208366], NULL byte off-by-one in php_check_specific_open_basedir
  + php7-CVE-2023-0568.patch
  fix CVE-2023-0662 [bsc#1208367], DoS vulnerability when parsing multipart request body
  + php7-CVE-2023-0662.patch
  https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 [bsc#1208388]
  + php7-crypt-possible-buffer-overread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678104000">- ensure extension=mysqlnd will be called before extension=mysqli
  [bsc#1205162]</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- fix potential buffer overflow [bsc#1208199]
- modified patches
  % php-systzdata-v19.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1679400000">- security update
- added patches
  fix CVE-2022-4900 [bsc#1209537], potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable
  + php7-CVE-2022-4900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1686830400">- security update
- added patches
  fix CVE-2023-3247 [bsc#1212349], Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
  + php7-CVE-2023-3247.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692792000">- security update
- added patches
  fix CVE-2023-3823 [bsc#1214106], XML loading external entity without being enabled
  + php7-CVE-2023-3823.patch
  fix CVE-2023-3824 [bsc#1214103], buffer overflows in phar_dir_read()
  + php7-CVE-2023-3824.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1705406400">- ensure we are building against openssl-1_1</changelog>
  <changelog author="pgajdos@suse.com" date="1713528000">- security update
- added patches
  fix CVE-2024-2756 [bsc#1222857], host/secure cookie bypass due to partial fix
  + php7-CVE-2024-2756.patch
  fix CVE-2024-3096 [bsc#1222858], password_verify can erroneously return true, opening ATO risk
  + php7-CVE-2024-3096.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-5458 [bsc#1226073], filter bypass in filter_var FILTER_VALIDATE_URL
  + php7-CVE-2024-5458.patch</changelog>
</package>
<package pkgid="f3dfdeba494c4bdcded4008d9a17e58e4f34d71c552bdd70d99769bbbe597286" name="apache2-mod_php7" arch="x86_64">
  <version epoch="0" ver="7.4.33" rel="150400.4.37.1"/>
  <changelog author="suse+build@de-korte.org" date="1632398400">- updated to 7.4.24: This is a security release (CVE-2021-21706)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.24</changelog>
  <changelog author="pgajdos@suse.com" date="1632744000">- previous version updates fixes also:
  CVE-2020-7068,CVE-2020-7069,CVE-2020-7070,CVE-2020-7071,
  CVE-2021-21702,CVE-2021-21704,CVE-2021-21705
  bsc#1175223,bsc#1177351,bsc#1177352,bsc#1180706,
  bsc#1182049,bsc#1188035,bsc#1188037</changelog>
  <changelog author="suse+build@de-korte.org" date="1634904000">- updated to 7.4.25: This is a security release (CVE-2021-21703)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.25</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1654862400">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655467200">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
- fixes [bsc#1203867] and [bsc#1203870]
- deleted patches
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
  <changelog author="pgajdos@suse.com" date="1673265600">- security update
- added patches
  fix CVE-2022-31631 [bsc#1206958], Due to an integer overflow PDO:quote() may return unquoted string
  + php7-CVE-2022-31631.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1676635200">- security update
- added patches
  fix CVE-2023-0568 [bsc#1208366], NULL byte off-by-one in php_check_specific_open_basedir
  + php7-CVE-2023-0568.patch
  fix CVE-2023-0662 [bsc#1208367], DoS vulnerability when parsing multipart request body
  + php7-CVE-2023-0662.patch
  https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 [bsc#1208388]
  + php7-crypt-possible-buffer-overread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678104000">- ensure extension=mysqlnd will be called before extension=mysqli
  [bsc#1205162]</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- fix potential buffer overflow [bsc#1208199]
- modified patches
  % php-systzdata-v19.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1679400000">- security update
- added patches
  fix CVE-2022-4900 [bsc#1209537], potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable
  + php7-CVE-2022-4900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1686830400">- security update
- added patches
  fix CVE-2023-3247 [bsc#1212349], Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
  + php7-CVE-2023-3247.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692792000">- security update
- added patches
  fix CVE-2023-3823 [bsc#1214106], XML loading external entity without being enabled
  + php7-CVE-2023-3823.patch
  fix CVE-2023-3824 [bsc#1214103], buffer overflows in phar_dir_read()
  + php7-CVE-2023-3824.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1705406400">- ensure we are building against openssl-1_1</changelog>
  <changelog author="pgajdos@suse.com" date="1713528000">- security update
- added patches
  fix CVE-2024-2756 [bsc#1222857], host/secure cookie bypass due to partial fix
  + php7-CVE-2024-2756.patch
  fix CVE-2024-3096 [bsc#1222858], password_verify can erroneously return true, opening ATO risk
  + php7-CVE-2024-3096.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-5458 [bsc#1226073], filter bypass in filter_var FILTER_VALIDATE_URL
  + php7-CVE-2024-5458.patch</changelog>
</package>
<package pkgid="d550233ab1e7cebb8a94b136f4521c42e400c542b56be87cc593e9c6a8ab930c" name="apache2-mod_php7" arch="aarch64">
  <version epoch="0" ver="7.4.33" rel="150400.4.40.1"/>
  <changelog author="pgajdos@suse.com" date="1632744000">- previous version updates fixes also:
  CVE-2020-7068,CVE-2020-7069,CVE-2020-7070,CVE-2020-7071,
  CVE-2021-21702,CVE-2021-21704,CVE-2021-21705
  bsc#1175223,bsc#1177351,bsc#1177352,bsc#1180706,
  bsc#1182049,bsc#1188035,bsc#1188037</changelog>
  <changelog author="suse+build@de-korte.org" date="1634904000">- updated to 7.4.25: This is a security release (CVE-2021-21703)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.25</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1654862400">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655467200">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
- fixes [bsc#1203867] and [bsc#1203870]
- deleted patches
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
  <changelog author="pgajdos@suse.com" date="1673265600">- security update
- added patches
  fix CVE-2022-31631 [bsc#1206958], Due to an integer overflow PDO:quote() may return unquoted string
  + php7-CVE-2022-31631.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1676635200">- security update
- added patches
  fix CVE-2023-0568 [bsc#1208366], NULL byte off-by-one in php_check_specific_open_basedir
  + php7-CVE-2023-0568.patch
  fix CVE-2023-0662 [bsc#1208367], DoS vulnerability when parsing multipart request body
  + php7-CVE-2023-0662.patch
  https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 [bsc#1208388]
  + php7-crypt-possible-buffer-overread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678104000">- ensure extension=mysqlnd will be called before extension=mysqli
  [bsc#1205162]</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- fix potential buffer overflow [bsc#1208199]
- modified patches
  % php-systzdata-v19.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1679400000">- security update
- added patches
  fix CVE-2022-4900 [bsc#1209537], potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable
  + php7-CVE-2022-4900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1686830400">- security update
- added patches
  fix CVE-2023-3247 [bsc#1212349], Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
  + php7-CVE-2023-3247.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692792000">- security update
- added patches
  fix CVE-2023-3823 [bsc#1214106], XML loading external entity without being enabled
  + php7-CVE-2023-3823.patch
  fix CVE-2023-3824 [bsc#1214103], buffer overflows in phar_dir_read()
  + php7-CVE-2023-3824.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1705406400">- ensure we are building against openssl-1_1</changelog>
  <changelog author="pgajdos@suse.com" date="1713528000">- security update
- added patches
  fix CVE-2024-2756 [bsc#1222857], host/secure cookie bypass due to partial fix
  + php7-CVE-2024-2756.patch
  fix CVE-2024-3096 [bsc#1222858], password_verify can erroneously return true, opening ATO risk
  + php7-CVE-2024-3096.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-5458 [bsc#1226073], filter bypass in filter_var FILTER_VALIDATE_URL
  + php7-CVE-2024-5458.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728648000">- security update
- added patches
  fix CVE-2024-8925 [bsc#1231360], erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed
  + php7-CVE-2024-8925.patch
  fix CVE-2024-8927 [bsc#1231358], cgi.force_redirect configuration is bypassable due to an environment variable collision
  + php7-CVE-2024-8927.patch
  fix CVE-2024-9026 [bsc#1231382], pollution of worker output logs in PHP-FPM
  + php7-CVE-2024-9026.patch</changelog>
</package>
<package pkgid="34fc89eb580dca9a44b7fe2fe15ac990501d9cbeed24bfdb9cb53819946cb77c" name="apache2-mod_php7" arch="ppc64le">
  <version epoch="0" ver="7.4.33" rel="150400.4.40.1"/>
  <changelog author="pgajdos@suse.com" date="1632744000">- previous version updates fixes also:
  CVE-2020-7068,CVE-2020-7069,CVE-2020-7070,CVE-2020-7071,
  CVE-2021-21702,CVE-2021-21704,CVE-2021-21705
  bsc#1175223,bsc#1177351,bsc#1177352,bsc#1180706,
  bsc#1182049,bsc#1188035,bsc#1188037</changelog>
  <changelog author="suse+build@de-korte.org" date="1634904000">- updated to 7.4.25: This is a security release (CVE-2021-21703)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.25</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1654862400">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655467200">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
- fixes [bsc#1203867] and [bsc#1203870]
- deleted patches
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
  <changelog author="pgajdos@suse.com" date="1673265600">- security update
- added patches
  fix CVE-2022-31631 [bsc#1206958], Due to an integer overflow PDO:quote() may return unquoted string
  + php7-CVE-2022-31631.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1676635200">- security update
- added patches
  fix CVE-2023-0568 [bsc#1208366], NULL byte off-by-one in php_check_specific_open_basedir
  + php7-CVE-2023-0568.patch
  fix CVE-2023-0662 [bsc#1208367], DoS vulnerability when parsing multipart request body
  + php7-CVE-2023-0662.patch
  https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 [bsc#1208388]
  + php7-crypt-possible-buffer-overread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678104000">- ensure extension=mysqlnd will be called before extension=mysqli
  [bsc#1205162]</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- fix potential buffer overflow [bsc#1208199]
- modified patches
  % php-systzdata-v19.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1679400000">- security update
- added patches
  fix CVE-2022-4900 [bsc#1209537], potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable
  + php7-CVE-2022-4900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1686830400">- security update
- added patches
  fix CVE-2023-3247 [bsc#1212349], Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
  + php7-CVE-2023-3247.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692792000">- security update
- added patches
  fix CVE-2023-3823 [bsc#1214106], XML loading external entity without being enabled
  + php7-CVE-2023-3823.patch
  fix CVE-2023-3824 [bsc#1214103], buffer overflows in phar_dir_read()
  + php7-CVE-2023-3824.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1705406400">- ensure we are building against openssl-1_1</changelog>
  <changelog author="pgajdos@suse.com" date="1713528000">- security update
- added patches
  fix CVE-2024-2756 [bsc#1222857], host/secure cookie bypass due to partial fix
  + php7-CVE-2024-2756.patch
  fix CVE-2024-3096 [bsc#1222858], password_verify can erroneously return true, opening ATO risk
  + php7-CVE-2024-3096.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-5458 [bsc#1226073], filter bypass in filter_var FILTER_VALIDATE_URL
  + php7-CVE-2024-5458.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728648000">- security update
- added patches
  fix CVE-2024-8925 [bsc#1231360], erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed
  + php7-CVE-2024-8925.patch
  fix CVE-2024-8927 [bsc#1231358], cgi.force_redirect configuration is bypassable due to an environment variable collision
  + php7-CVE-2024-8927.patch
  fix CVE-2024-9026 [bsc#1231382], pollution of worker output logs in PHP-FPM
  + php7-CVE-2024-9026.patch</changelog>
</package>
<package pkgid="cfd9db312569bfef505b2d5a345f7926ca2ebeb8e3d4ff56fc380deb7fb3c893" name="apache2-mod_php7" arch="s390x">
  <version epoch="0" ver="7.4.33" rel="150400.4.40.1"/>
  <changelog author="pgajdos@suse.com" date="1632744000">- previous version updates fixes also:
  CVE-2020-7068,CVE-2020-7069,CVE-2020-7070,CVE-2020-7071,
  CVE-2021-21702,CVE-2021-21704,CVE-2021-21705
  bsc#1175223,bsc#1177351,bsc#1177352,bsc#1180706,
  bsc#1182049,bsc#1188035,bsc#1188037</changelog>
  <changelog author="suse+build@de-korte.org" date="1634904000">- updated to 7.4.25: This is a security release (CVE-2021-21703)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.25</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1654862400">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655467200">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
- fixes [bsc#1203867] and [bsc#1203870]
- deleted patches
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
  <changelog author="pgajdos@suse.com" date="1673265600">- security update
- added patches
  fix CVE-2022-31631 [bsc#1206958], Due to an integer overflow PDO:quote() may return unquoted string
  + php7-CVE-2022-31631.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1676635200">- security update
- added patches
  fix CVE-2023-0568 [bsc#1208366], NULL byte off-by-one in php_check_specific_open_basedir
  + php7-CVE-2023-0568.patch
  fix CVE-2023-0662 [bsc#1208367], DoS vulnerability when parsing multipart request body
  + php7-CVE-2023-0662.patch
  https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 [bsc#1208388]
  + php7-crypt-possible-buffer-overread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678104000">- ensure extension=mysqlnd will be called before extension=mysqli
  [bsc#1205162]</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- fix potential buffer overflow [bsc#1208199]
- modified patches
  % php-systzdata-v19.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1679400000">- security update
- added patches
  fix CVE-2022-4900 [bsc#1209537], potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable
  + php7-CVE-2022-4900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1686830400">- security update
- added patches
  fix CVE-2023-3247 [bsc#1212349], Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
  + php7-CVE-2023-3247.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692792000">- security update
- added patches
  fix CVE-2023-3823 [bsc#1214106], XML loading external entity without being enabled
  + php7-CVE-2023-3823.patch
  fix CVE-2023-3824 [bsc#1214103], buffer overflows in phar_dir_read()
  + php7-CVE-2023-3824.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1705406400">- ensure we are building against openssl-1_1</changelog>
  <changelog author="pgajdos@suse.com" date="1713528000">- security update
- added patches
  fix CVE-2024-2756 [bsc#1222857], host/secure cookie bypass due to partial fix
  + php7-CVE-2024-2756.patch
  fix CVE-2024-3096 [bsc#1222858], password_verify can erroneously return true, opening ATO risk
  + php7-CVE-2024-3096.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-5458 [bsc#1226073], filter bypass in filter_var FILTER_VALIDATE_URL
  + php7-CVE-2024-5458.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728648000">- security update
- added patches
  fix CVE-2024-8925 [bsc#1231360], erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed
  + php7-CVE-2024-8925.patch
  fix CVE-2024-8927 [bsc#1231358], cgi.force_redirect configuration is bypassable due to an environment variable collision
  + php7-CVE-2024-8927.patch
  fix CVE-2024-9026 [bsc#1231382], pollution of worker output logs in PHP-FPM
  + php7-CVE-2024-9026.patch</changelog>
</package>
<package pkgid="436b3b98d38e84491a1155ae2c62bdd5a4f282c666d16d965243f1fe7b8af68b" name="apache2-mod_php7" arch="src">
  <version epoch="0" ver="7.4.33" rel="150400.4.40.1"/>
  <changelog author="pgajdos@suse.com" date="1632744000">- previous version updates fixes also:
  CVE-2020-7068,CVE-2020-7069,CVE-2020-7070,CVE-2020-7071,
  CVE-2021-21702,CVE-2021-21704,CVE-2021-21705
  bsc#1175223,bsc#1177351,bsc#1177352,bsc#1180706,
  bsc#1182049,bsc#1188035,bsc#1188037</changelog>
  <changelog author="suse+build@de-korte.org" date="1634904000">- updated to 7.4.25: This is a security release (CVE-2021-21703)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.25</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1654862400">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655467200">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
- fixes [bsc#1203867] and [bsc#1203870]
- deleted patches
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
  <changelog author="pgajdos@suse.com" date="1673265600">- security update
- added patches
  fix CVE-2022-31631 [bsc#1206958], Due to an integer overflow PDO:quote() may return unquoted string
  + php7-CVE-2022-31631.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1676635200">- security update
- added patches
  fix CVE-2023-0568 [bsc#1208366], NULL byte off-by-one in php_check_specific_open_basedir
  + php7-CVE-2023-0568.patch
  fix CVE-2023-0662 [bsc#1208367], DoS vulnerability when parsing multipart request body
  + php7-CVE-2023-0662.patch
  https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 [bsc#1208388]
  + php7-crypt-possible-buffer-overread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678104000">- ensure extension=mysqlnd will be called before extension=mysqli
  [bsc#1205162]</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- fix potential buffer overflow [bsc#1208199]
- modified patches
  % php-systzdata-v19.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1679400000">- security update
- added patches
  fix CVE-2022-4900 [bsc#1209537], potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable
  + php7-CVE-2022-4900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1686830400">- security update
- added patches
  fix CVE-2023-3247 [bsc#1212349], Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
  + php7-CVE-2023-3247.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692792000">- security update
- added patches
  fix CVE-2023-3823 [bsc#1214106], XML loading external entity without being enabled
  + php7-CVE-2023-3823.patch
  fix CVE-2023-3824 [bsc#1214103], buffer overflows in phar_dir_read()
  + php7-CVE-2023-3824.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1705406400">- ensure we are building against openssl-1_1</changelog>
  <changelog author="pgajdos@suse.com" date="1713528000">- security update
- added patches
  fix CVE-2024-2756 [bsc#1222857], host/secure cookie bypass due to partial fix
  + php7-CVE-2024-2756.patch
  fix CVE-2024-3096 [bsc#1222858], password_verify can erroneously return true, opening ATO risk
  + php7-CVE-2024-3096.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-5458 [bsc#1226073], filter bypass in filter_var FILTER_VALIDATE_URL
  + php7-CVE-2024-5458.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728648000">- security update
- added patches
  fix CVE-2024-8925 [bsc#1231360], erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed
  + php7-CVE-2024-8925.patch
  fix CVE-2024-8927 [bsc#1231358], cgi.force_redirect configuration is bypassable due to an environment variable collision
  + php7-CVE-2024-8927.patch
  fix CVE-2024-9026 [bsc#1231382], pollution of worker output logs in PHP-FPM
  + php7-CVE-2024-9026.patch</changelog>
</package>
<package pkgid="fcc0e2676a48c808fc3b350c75071dd9aba143aa5bfbcd8df5bdda47c0b29e41" name="apache2-mod_php7" arch="x86_64">
  <version epoch="0" ver="7.4.33" rel="150400.4.40.1"/>
  <changelog author="pgajdos@suse.com" date="1632744000">- previous version updates fixes also:
  CVE-2020-7068,CVE-2020-7069,CVE-2020-7070,CVE-2020-7071,
  CVE-2021-21702,CVE-2021-21704,CVE-2021-21705
  bsc#1175223,bsc#1177351,bsc#1177352,bsc#1180706,
  bsc#1182049,bsc#1188035,bsc#1188037</changelog>
  <changelog author="suse+build@de-korte.org" date="1634904000">- updated to 7.4.25: This is a security release (CVE-2021-21703)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.25</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1654862400">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655467200">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
- fixes [bsc#1203867] and [bsc#1203870]
- deleted patches
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
  <changelog author="pgajdos@suse.com" date="1673265600">- security update
- added patches
  fix CVE-2022-31631 [bsc#1206958], Due to an integer overflow PDO:quote() may return unquoted string
  + php7-CVE-2022-31631.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1676635200">- security update
- added patches
  fix CVE-2023-0568 [bsc#1208366], NULL byte off-by-one in php_check_specific_open_basedir
  + php7-CVE-2023-0568.patch
  fix CVE-2023-0662 [bsc#1208367], DoS vulnerability when parsing multipart request body
  + php7-CVE-2023-0662.patch
  https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 [bsc#1208388]
  + php7-crypt-possible-buffer-overread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678104000">- ensure extension=mysqlnd will be called before extension=mysqli
  [bsc#1205162]</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- fix potential buffer overflow [bsc#1208199]
- modified patches
  % php-systzdata-v19.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1679400000">- security update
- added patches
  fix CVE-2022-4900 [bsc#1209537], potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable
  + php7-CVE-2022-4900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1686830400">- security update
- added patches
  fix CVE-2023-3247 [bsc#1212349], Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
  + php7-CVE-2023-3247.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692792000">- security update
- added patches
  fix CVE-2023-3823 [bsc#1214106], XML loading external entity without being enabled
  + php7-CVE-2023-3823.patch
  fix CVE-2023-3824 [bsc#1214103], buffer overflows in phar_dir_read()
  + php7-CVE-2023-3824.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1705406400">- ensure we are building against openssl-1_1</changelog>
  <changelog author="pgajdos@suse.com" date="1713528000">- security update
- added patches
  fix CVE-2024-2756 [bsc#1222857], host/secure cookie bypass due to partial fix
  + php7-CVE-2024-2756.patch
  fix CVE-2024-3096 [bsc#1222858], password_verify can erroneously return true, opening ATO risk
  + php7-CVE-2024-3096.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-5458 [bsc#1226073], filter bypass in filter_var FILTER_VALIDATE_URL
  + php7-CVE-2024-5458.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728648000">- security update
- added patches
  fix CVE-2024-8925 [bsc#1231360], erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed
  + php7-CVE-2024-8925.patch
  fix CVE-2024-8927 [bsc#1231358], cgi.force_redirect configuration is bypassable due to an environment variable collision
  + php7-CVE-2024-8927.patch
  fix CVE-2024-9026 [bsc#1231382], pollution of worker output logs in PHP-FPM
  + php7-CVE-2024-9026.patch</changelog>
</package>
<package pkgid="8e30a4e0c9855a4f9accc15d5963acc6702bf219cc2ad6bdf5d36d5bb3840408" name="apache2-mod_php7" arch="aarch64">
  <version epoch="0" ver="7.4.33" rel="150400.4.43.1"/>
  <changelog author="suse+build@de-korte.org" date="1634904000">- updated to 7.4.25: This is a security release (CVE-2021-21703)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.25</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1654862400">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655467200">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
- fixes [bsc#1203867] and [bsc#1203870]
- deleted patches
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
  <changelog author="pgajdos@suse.com" date="1673265600">- security update
- added patches
  fix CVE-2022-31631 [bsc#1206958], Due to an integer overflow PDO:quote() may return unquoted string
  + php7-CVE-2022-31631.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1676635200">- security update
- added patches
  fix CVE-2023-0568 [bsc#1208366], NULL byte off-by-one in php_check_specific_open_basedir
  + php7-CVE-2023-0568.patch
  fix CVE-2023-0662 [bsc#1208367], DoS vulnerability when parsing multipart request body
  + php7-CVE-2023-0662.patch
  https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 [bsc#1208388]
  + php7-crypt-possible-buffer-overread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678104000">- ensure extension=mysqlnd will be called before extension=mysqli
  [bsc#1205162]</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- fix potential buffer overflow [bsc#1208199]
- modified patches
  % php-systzdata-v19.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1679400000">- security update
- added patches
  fix CVE-2022-4900 [bsc#1209537], potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable
  + php7-CVE-2022-4900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1686830400">- security update
- added patches
  fix CVE-2023-3247 [bsc#1212349], Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
  + php7-CVE-2023-3247.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692792000">- security update
- added patches
  fix CVE-2023-3823 [bsc#1214106], XML loading external entity without being enabled
  + php7-CVE-2023-3823.patch
  fix CVE-2023-3824 [bsc#1214103], buffer overflows in phar_dir_read()
  + php7-CVE-2023-3824.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1705406400">- ensure we are building against openssl-1_1</changelog>
  <changelog author="pgajdos@suse.com" date="1713528000">- security update
- added patches
  fix CVE-2024-2756 [bsc#1222857], host/secure cookie bypass due to partial fix
  + php7-CVE-2024-2756.patch
  fix CVE-2024-3096 [bsc#1222858], password_verify can erroneously return true, opening ATO risk
  + php7-CVE-2024-3096.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-5458 [bsc#1226073], filter bypass in filter_var FILTER_VALIDATE_URL
  + php7-CVE-2024-5458.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728648000">- security update
- added patches
  fix CVE-2024-8925 [bsc#1231360], erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed
  + php7-CVE-2024-8925.patch
  fix CVE-2024-8927 [bsc#1231358], cgi.force_redirect configuration is bypassable due to an environment variable collision
  + php7-CVE-2024-8927.patch
  fix CVE-2024-9026 [bsc#1231382], pollution of worker output logs in PHP-FPM
  + php7-CVE-2024-9026.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1732622400">- security update
- added patches
  fix CVE-2024-11233 [bsc#1233702], single-byte buffer overread due to missing bounds check when processing input with convert.quoted-printable-decode filters
  + php7-CVE-2024-11233.patch
  fix CVE-2024-11234 [bsc#1233703], configuring streams with a proxy and the 'request_fulluri' context option might allow for CRLF injection in URIs
  + php7-CVE-2024-11234.patch
  fix CVE-2024-8929 [bsc#1233651], In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests ...
  + php7-CVE-2024-8929.patch</changelog>
</package>
<package pkgid="cf22a49187cedbcb538229750ab3eaea234fd0ea62fa3880733fce97492dffef" name="apache2-mod_php7" arch="ppc64le">
  <version epoch="0" ver="7.4.33" rel="150400.4.43.1"/>
  <changelog author="suse+build@de-korte.org" date="1634904000">- updated to 7.4.25: This is a security release (CVE-2021-21703)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.25</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1654862400">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655467200">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
- fixes [bsc#1203867] and [bsc#1203870]
- deleted patches
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
  <changelog author="pgajdos@suse.com" date="1673265600">- security update
- added patches
  fix CVE-2022-31631 [bsc#1206958], Due to an integer overflow PDO:quote() may return unquoted string
  + php7-CVE-2022-31631.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1676635200">- security update
- added patches
  fix CVE-2023-0568 [bsc#1208366], NULL byte off-by-one in php_check_specific_open_basedir
  + php7-CVE-2023-0568.patch
  fix CVE-2023-0662 [bsc#1208367], DoS vulnerability when parsing multipart request body
  + php7-CVE-2023-0662.patch
  https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 [bsc#1208388]
  + php7-crypt-possible-buffer-overread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678104000">- ensure extension=mysqlnd will be called before extension=mysqli
  [bsc#1205162]</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- fix potential buffer overflow [bsc#1208199]
- modified patches
  % php-systzdata-v19.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1679400000">- security update
- added patches
  fix CVE-2022-4900 [bsc#1209537], potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable
  + php7-CVE-2022-4900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1686830400">- security update
- added patches
  fix CVE-2023-3247 [bsc#1212349], Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
  + php7-CVE-2023-3247.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692792000">- security update
- added patches
  fix CVE-2023-3823 [bsc#1214106], XML loading external entity without being enabled
  + php7-CVE-2023-3823.patch
  fix CVE-2023-3824 [bsc#1214103], buffer overflows in phar_dir_read()
  + php7-CVE-2023-3824.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1705406400">- ensure we are building against openssl-1_1</changelog>
  <changelog author="pgajdos@suse.com" date="1713528000">- security update
- added patches
  fix CVE-2024-2756 [bsc#1222857], host/secure cookie bypass due to partial fix
  + php7-CVE-2024-2756.patch
  fix CVE-2024-3096 [bsc#1222858], password_verify can erroneously return true, opening ATO risk
  + php7-CVE-2024-3096.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-5458 [bsc#1226073], filter bypass in filter_var FILTER_VALIDATE_URL
  + php7-CVE-2024-5458.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728648000">- security update
- added patches
  fix CVE-2024-8925 [bsc#1231360], erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed
  + php7-CVE-2024-8925.patch
  fix CVE-2024-8927 [bsc#1231358], cgi.force_redirect configuration is bypassable due to an environment variable collision
  + php7-CVE-2024-8927.patch
  fix CVE-2024-9026 [bsc#1231382], pollution of worker output logs in PHP-FPM
  + php7-CVE-2024-9026.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1732622400">- security update
- added patches
  fix CVE-2024-11233 [bsc#1233702], single-byte buffer overread due to missing bounds check when processing input with convert.quoted-printable-decode filters
  + php7-CVE-2024-11233.patch
  fix CVE-2024-11234 [bsc#1233703], configuring streams with a proxy and the 'request_fulluri' context option might allow for CRLF injection in URIs
  + php7-CVE-2024-11234.patch
  fix CVE-2024-8929 [bsc#1233651], In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests ...
  + php7-CVE-2024-8929.patch</changelog>
</package>
<package pkgid="ab5df9064304a26341ee6eaf406bc4cf5df8f82b829ad025cdd130c2629fd6d1" name="apache2-mod_php7" arch="s390x">
  <version epoch="0" ver="7.4.33" rel="150400.4.43.1"/>
  <changelog author="suse+build@de-korte.org" date="1634904000">- updated to 7.4.25: This is a security release (CVE-2021-21703)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.25</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1654862400">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655467200">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
- fixes [bsc#1203867] and [bsc#1203870]
- deleted patches
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
  <changelog author="pgajdos@suse.com" date="1673265600">- security update
- added patches
  fix CVE-2022-31631 [bsc#1206958], Due to an integer overflow PDO:quote() may return unquoted string
  + php7-CVE-2022-31631.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1676635200">- security update
- added patches
  fix CVE-2023-0568 [bsc#1208366], NULL byte off-by-one in php_check_specific_open_basedir
  + php7-CVE-2023-0568.patch
  fix CVE-2023-0662 [bsc#1208367], DoS vulnerability when parsing multipart request body
  + php7-CVE-2023-0662.patch
  https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 [bsc#1208388]
  + php7-crypt-possible-buffer-overread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678104000">- ensure extension=mysqlnd will be called before extension=mysqli
  [bsc#1205162]</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- fix potential buffer overflow [bsc#1208199]
- modified patches
  % php-systzdata-v19.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1679400000">- security update
- added patches
  fix CVE-2022-4900 [bsc#1209537], potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable
  + php7-CVE-2022-4900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1686830400">- security update
- added patches
  fix CVE-2023-3247 [bsc#1212349], Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
  + php7-CVE-2023-3247.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692792000">- security update
- added patches
  fix CVE-2023-3823 [bsc#1214106], XML loading external entity without being enabled
  + php7-CVE-2023-3823.patch
  fix CVE-2023-3824 [bsc#1214103], buffer overflows in phar_dir_read()
  + php7-CVE-2023-3824.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1705406400">- ensure we are building against openssl-1_1</changelog>
  <changelog author="pgajdos@suse.com" date="1713528000">- security update
- added patches
  fix CVE-2024-2756 [bsc#1222857], host/secure cookie bypass due to partial fix
  + php7-CVE-2024-2756.patch
  fix CVE-2024-3096 [bsc#1222858], password_verify can erroneously return true, opening ATO risk
  + php7-CVE-2024-3096.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-5458 [bsc#1226073], filter bypass in filter_var FILTER_VALIDATE_URL
  + php7-CVE-2024-5458.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728648000">- security update
- added patches
  fix CVE-2024-8925 [bsc#1231360], erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed
  + php7-CVE-2024-8925.patch
  fix CVE-2024-8927 [bsc#1231358], cgi.force_redirect configuration is bypassable due to an environment variable collision
  + php7-CVE-2024-8927.patch
  fix CVE-2024-9026 [bsc#1231382], pollution of worker output logs in PHP-FPM
  + php7-CVE-2024-9026.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1732622400">- security update
- added patches
  fix CVE-2024-11233 [bsc#1233702], single-byte buffer overread due to missing bounds check when processing input with convert.quoted-printable-decode filters
  + php7-CVE-2024-11233.patch
  fix CVE-2024-11234 [bsc#1233703], configuring streams with a proxy and the 'request_fulluri' context option might allow for CRLF injection in URIs
  + php7-CVE-2024-11234.patch
  fix CVE-2024-8929 [bsc#1233651], In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests ...
  + php7-CVE-2024-8929.patch</changelog>
</package>
<package pkgid="bf7612eadd13893367ad4228fab646e2a91ee2c5f41d9b557f1fa9530ca76ce5" name="apache2-mod_php7" arch="src">
  <version epoch="0" ver="7.4.33" rel="150400.4.43.1"/>
  <changelog author="suse+build@de-korte.org" date="1634904000">- updated to 7.4.25: This is a security release (CVE-2021-21703)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.25</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1654862400">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655467200">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
- fixes [bsc#1203867] and [bsc#1203870]
- deleted patches
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
  <changelog author="pgajdos@suse.com" date="1673265600">- security update
- added patches
  fix CVE-2022-31631 [bsc#1206958], Due to an integer overflow PDO:quote() may return unquoted string
  + php7-CVE-2022-31631.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1676635200">- security update
- added patches
  fix CVE-2023-0568 [bsc#1208366], NULL byte off-by-one in php_check_specific_open_basedir
  + php7-CVE-2023-0568.patch
  fix CVE-2023-0662 [bsc#1208367], DoS vulnerability when parsing multipart request body
  + php7-CVE-2023-0662.patch
  https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 [bsc#1208388]
  + php7-crypt-possible-buffer-overread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678104000">- ensure extension=mysqlnd will be called before extension=mysqli
  [bsc#1205162]</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- fix potential buffer overflow [bsc#1208199]
- modified patches
  % php-systzdata-v19.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1679400000">- security update
- added patches
  fix CVE-2022-4900 [bsc#1209537], potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable
  + php7-CVE-2022-4900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1686830400">- security update
- added patches
  fix CVE-2023-3247 [bsc#1212349], Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
  + php7-CVE-2023-3247.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692792000">- security update
- added patches
  fix CVE-2023-3823 [bsc#1214106], XML loading external entity without being enabled
  + php7-CVE-2023-3823.patch
  fix CVE-2023-3824 [bsc#1214103], buffer overflows in phar_dir_read()
  + php7-CVE-2023-3824.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1705406400">- ensure we are building against openssl-1_1</changelog>
  <changelog author="pgajdos@suse.com" date="1713528000">- security update
- added patches
  fix CVE-2024-2756 [bsc#1222857], host/secure cookie bypass due to partial fix
  + php7-CVE-2024-2756.patch
  fix CVE-2024-3096 [bsc#1222858], password_verify can erroneously return true, opening ATO risk
  + php7-CVE-2024-3096.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-5458 [bsc#1226073], filter bypass in filter_var FILTER_VALIDATE_URL
  + php7-CVE-2024-5458.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728648000">- security update
- added patches
  fix CVE-2024-8925 [bsc#1231360], erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed
  + php7-CVE-2024-8925.patch
  fix CVE-2024-8927 [bsc#1231358], cgi.force_redirect configuration is bypassable due to an environment variable collision
  + php7-CVE-2024-8927.patch
  fix CVE-2024-9026 [bsc#1231382], pollution of worker output logs in PHP-FPM
  + php7-CVE-2024-9026.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1732622400">- security update
- added patches
  fix CVE-2024-11233 [bsc#1233702], single-byte buffer overread due to missing bounds check when processing input with convert.quoted-printable-decode filters
  + php7-CVE-2024-11233.patch
  fix CVE-2024-11234 [bsc#1233703], configuring streams with a proxy and the 'request_fulluri' context option might allow for CRLF injection in URIs
  + php7-CVE-2024-11234.patch
  fix CVE-2024-8929 [bsc#1233651], In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests ...
  + php7-CVE-2024-8929.patch</changelog>
</package>
<package pkgid="90f5129049be3767199f4c846f6b3f16293525137386295a5c5ade906c425574" name="apache2-mod_php7" arch="x86_64">
  <version epoch="0" ver="7.4.33" rel="150400.4.43.1"/>
  <changelog author="suse+build@de-korte.org" date="1634904000">- updated to 7.4.25: This is a security release (CVE-2021-21703)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.25</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1654862400">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655467200">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
- fixes [bsc#1203867] and [bsc#1203870]
- deleted patches
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
  <changelog author="pgajdos@suse.com" date="1673265600">- security update
- added patches
  fix CVE-2022-31631 [bsc#1206958], Due to an integer overflow PDO:quote() may return unquoted string
  + php7-CVE-2022-31631.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1676635200">- security update
- added patches
  fix CVE-2023-0568 [bsc#1208366], NULL byte off-by-one in php_check_specific_open_basedir
  + php7-CVE-2023-0568.patch
  fix CVE-2023-0662 [bsc#1208367], DoS vulnerability when parsing multipart request body
  + php7-CVE-2023-0662.patch
  https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 [bsc#1208388]
  + php7-crypt-possible-buffer-overread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678104000">- ensure extension=mysqlnd will be called before extension=mysqli
  [bsc#1205162]</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- fix potential buffer overflow [bsc#1208199]
- modified patches
  % php-systzdata-v19.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1679400000">- security update
- added patches
  fix CVE-2022-4900 [bsc#1209537], potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable
  + php7-CVE-2022-4900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1686830400">- security update
- added patches
  fix CVE-2023-3247 [bsc#1212349], Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
  + php7-CVE-2023-3247.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692792000">- security update
- added patches
  fix CVE-2023-3823 [bsc#1214106], XML loading external entity without being enabled
  + php7-CVE-2023-3823.patch
  fix CVE-2023-3824 [bsc#1214103], buffer overflows in phar_dir_read()
  + php7-CVE-2023-3824.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1705406400">- ensure we are building against openssl-1_1</changelog>
  <changelog author="pgajdos@suse.com" date="1713528000">- security update
- added patches
  fix CVE-2024-2756 [bsc#1222857], host/secure cookie bypass due to partial fix
  + php7-CVE-2024-2756.patch
  fix CVE-2024-3096 [bsc#1222858], password_verify can erroneously return true, opening ATO risk
  + php7-CVE-2024-3096.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-5458 [bsc#1226073], filter bypass in filter_var FILTER_VALIDATE_URL
  + php7-CVE-2024-5458.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728648000">- security update
- added patches
  fix CVE-2024-8925 [bsc#1231360], erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed
  + php7-CVE-2024-8925.patch
  fix CVE-2024-8927 [bsc#1231358], cgi.force_redirect configuration is bypassable due to an environment variable collision
  + php7-CVE-2024-8927.patch
  fix CVE-2024-9026 [bsc#1231382], pollution of worker output logs in PHP-FPM
  + php7-CVE-2024-9026.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1732622400">- security update
- added patches
  fix CVE-2024-11233 [bsc#1233702], single-byte buffer overread due to missing bounds check when processing input with convert.quoted-printable-decode filters
  + php7-CVE-2024-11233.patch
  fix CVE-2024-11234 [bsc#1233703], configuring streams with a proxy and the 'request_fulluri' context option might allow for CRLF injection in URIs
  + php7-CVE-2024-11234.patch
  fix CVE-2024-8929 [bsc#1233651], In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests ...
  + php7-CVE-2024-8929.patch</changelog>
</package>
<package pkgid="5ba1eff14a74cb12f3fdf58ef097b53258e7b0e00390835e3777e4e9c0b6ca81" name="apache2-mod_php8" arch="aarch64">
  <version epoch="0" ver="8.2.20" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1684843200">- also MIT license (systzdata patch, ext/date/lib/parse_posix.c)
  [https://build.suse.de/request/show/298230]</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- repack the tarball temporarily [bsc#1211648]</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 8.1.20
  * This is a security release.
  * https://www.php.net/ChangeLog-8.php#8.1.20
- force to repack tarball after update
  https://github.com/php/php-src/issues/11300
- session.save_path set to /var/lib/php8/sessions in mod_php8.conf
  and www.conf php-fpm pool example
- modified sources
  % mod_php8.conf
- added sources
  + repack.sh
  + php-unicode-allow-redistribution.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687435200">- version update to 8.2.7
  * Readonly classes
  * Disjunctive Normal Form (DNF) Types
  * Allow null, false, and true as stand-alone types
  * New "Random" extension
  * Constants in traits
  * Deprecate dynamic properties
  * for details, see
    https://www.php.net/releases/8.2/en.php
    https://www.php.net/manual/en/migration82.php
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)
  % php-date-regenerate-lexers.patch (refreshed)
  % php-ini.patch (refreshed)
  % php-systzdata-v23.patch (refreshed)
- CVE-2023-3247 [bsc#1212349]</changelog>
  <changelog author="pgajdos@suse.com" date="1689595200">- version update to 8.2.8
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.8
- modified patches
  % php-sort-filelist-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 8.2.9
  * This is a security release.
  * Fixes CVE-2023-3824 [bsc#1214103] and CVE-2023-3823 [bsc#1214106]
  * https://www.php.net/ChangeLog-8.php#8.2.9
- deleted patches
  - php-unicode-allow-redistribution.patch (upstreamed)
- deleted sources
  - repack.sh (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- version update to 8.2.10
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.10</changelog>
  <changelog author="bwiedemann@suse.com" date="1693569601">- Use %make_build macro</changelog>
  <changelog author="pgajdos@suse.com" date="1695729600">- add missing references to rpm changelog
- 15sp4 only:
  [bsc#1200772], [jsc#SLE-24723] add pecl, pear
  [jsc#SLE-23639] version update</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 8.2.11
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.11</changelog>
  <changelog author="pgajdos@suse.com" date="1698321600">- version update to 8.2.12
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.12</changelog>
  <changelog author="pgajdos@suse.com" date="1700827200">- version update to 8.2.13
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.13</changelog>
  <changelog author="pgajdos@suse.com" date="1704196800">- version update to 8.2.14
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.14</changelog>
  <changelog author="pgajdos@suse.com" date="1705579200">- version update to 8.2.15
  * This is a bug fix release.
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1708084800">- version update to 8.2.16
  * This is a bug fix release.
- modified patches
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pmonreal@suse.com" date="1709726400">- Use the system default cipher list instead of hardcoded values
  by using crypto-policies. [bsc#1211301]
  * Use the --with-system-ciphers configure option.</changelog>
  <changelog author="pgajdos@suse.com" date="1710849600">- version update to 8.2.17
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1712923200">- version update to 8.2.18
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1715256000">- version update to 8.2.19
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1717761600">- version update to 8.2.20
  * This is a security release.</changelog>
</package>
<package pkgid="73b14a08542b8529a0ac94694b6d30b478ccd5e51c3a49478db650b68d3873a6" name="apache2-mod_php8" arch="ppc64le">
  <version epoch="0" ver="8.2.20" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1684843200">- also MIT license (systzdata patch, ext/date/lib/parse_posix.c)
  [https://build.suse.de/request/show/298230]</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- repack the tarball temporarily [bsc#1211648]</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 8.1.20
  * This is a security release.
  * https://www.php.net/ChangeLog-8.php#8.1.20
- force to repack tarball after update
  https://github.com/php/php-src/issues/11300
- session.save_path set to /var/lib/php8/sessions in mod_php8.conf
  and www.conf php-fpm pool example
- modified sources
  % mod_php8.conf
- added sources
  + repack.sh
  + php-unicode-allow-redistribution.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687435200">- version update to 8.2.7
  * Readonly classes
  * Disjunctive Normal Form (DNF) Types
  * Allow null, false, and true as stand-alone types
  * New "Random" extension
  * Constants in traits
  * Deprecate dynamic properties
  * for details, see
    https://www.php.net/releases/8.2/en.php
    https://www.php.net/manual/en/migration82.php
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)
  % php-date-regenerate-lexers.patch (refreshed)
  % php-ini.patch (refreshed)
  % php-systzdata-v23.patch (refreshed)
- CVE-2023-3247 [bsc#1212349]</changelog>
  <changelog author="pgajdos@suse.com" date="1689595200">- version update to 8.2.8
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.8
- modified patches
  % php-sort-filelist-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 8.2.9
  * This is a security release.
  * Fixes CVE-2023-3824 [bsc#1214103] and CVE-2023-3823 [bsc#1214106]
  * https://www.php.net/ChangeLog-8.php#8.2.9
- deleted patches
  - php-unicode-allow-redistribution.patch (upstreamed)
- deleted sources
  - repack.sh (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- version update to 8.2.10
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.10</changelog>
  <changelog author="bwiedemann@suse.com" date="1693569601">- Use %make_build macro</changelog>
  <changelog author="pgajdos@suse.com" date="1695729600">- add missing references to rpm changelog
- 15sp4 only:
  [bsc#1200772], [jsc#SLE-24723] add pecl, pear
  [jsc#SLE-23639] version update</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 8.2.11
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.11</changelog>
  <changelog author="pgajdos@suse.com" date="1698321600">- version update to 8.2.12
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.12</changelog>
  <changelog author="pgajdos@suse.com" date="1700827200">- version update to 8.2.13
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.13</changelog>
  <changelog author="pgajdos@suse.com" date="1704196800">- version update to 8.2.14
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.14</changelog>
  <changelog author="pgajdos@suse.com" date="1705579200">- version update to 8.2.15
  * This is a bug fix release.
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1708084800">- version update to 8.2.16
  * This is a bug fix release.
- modified patches
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pmonreal@suse.com" date="1709726400">- Use the system default cipher list instead of hardcoded values
  by using crypto-policies. [bsc#1211301]
  * Use the --with-system-ciphers configure option.</changelog>
  <changelog author="pgajdos@suse.com" date="1710849600">- version update to 8.2.17
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1712923200">- version update to 8.2.18
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1715256000">- version update to 8.2.19
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1717761600">- version update to 8.2.20
  * This is a security release.</changelog>
</package>
<package pkgid="d228c687953c059724e9bdde294f87b18d3ce5efe81e938265791c963d20c268" name="apache2-mod_php8" arch="s390x">
  <version epoch="0" ver="8.2.20" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1684843200">- also MIT license (systzdata patch, ext/date/lib/parse_posix.c)
  [https://build.suse.de/request/show/298230]</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- repack the tarball temporarily [bsc#1211648]</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 8.1.20
  * This is a security release.
  * https://www.php.net/ChangeLog-8.php#8.1.20
- force to repack tarball after update
  https://github.com/php/php-src/issues/11300
- session.save_path set to /var/lib/php8/sessions in mod_php8.conf
  and www.conf php-fpm pool example
- modified sources
  % mod_php8.conf
- added sources
  + repack.sh
  + php-unicode-allow-redistribution.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687435200">- version update to 8.2.7
  * Readonly classes
  * Disjunctive Normal Form (DNF) Types
  * Allow null, false, and true as stand-alone types
  * New "Random" extension
  * Constants in traits
  * Deprecate dynamic properties
  * for details, see
    https://www.php.net/releases/8.2/en.php
    https://www.php.net/manual/en/migration82.php
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)
  % php-date-regenerate-lexers.patch (refreshed)
  % php-ini.patch (refreshed)
  % php-systzdata-v23.patch (refreshed)
- CVE-2023-3247 [bsc#1212349]</changelog>
  <changelog author="pgajdos@suse.com" date="1689595200">- version update to 8.2.8
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.8
- modified patches
  % php-sort-filelist-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 8.2.9
  * This is a security release.
  * Fixes CVE-2023-3824 [bsc#1214103] and CVE-2023-3823 [bsc#1214106]
  * https://www.php.net/ChangeLog-8.php#8.2.9
- deleted patches
  - php-unicode-allow-redistribution.patch (upstreamed)
- deleted sources
  - repack.sh (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- version update to 8.2.10
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.10</changelog>
  <changelog author="bwiedemann@suse.com" date="1693569601">- Use %make_build macro</changelog>
  <changelog author="pgajdos@suse.com" date="1695729600">- add missing references to rpm changelog
- 15sp4 only:
  [bsc#1200772], [jsc#SLE-24723] add pecl, pear
  [jsc#SLE-23639] version update</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 8.2.11
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.11</changelog>
  <changelog author="pgajdos@suse.com" date="1698321600">- version update to 8.2.12
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.12</changelog>
  <changelog author="pgajdos@suse.com" date="1700827200">- version update to 8.2.13
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.13</changelog>
  <changelog author="pgajdos@suse.com" date="1704196800">- version update to 8.2.14
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.14</changelog>
  <changelog author="pgajdos@suse.com" date="1705579200">- version update to 8.2.15
  * This is a bug fix release.
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1708084800">- version update to 8.2.16
  * This is a bug fix release.
- modified patches
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pmonreal@suse.com" date="1709726400">- Use the system default cipher list instead of hardcoded values
  by using crypto-policies. [bsc#1211301]
  * Use the --with-system-ciphers configure option.</changelog>
  <changelog author="pgajdos@suse.com" date="1710849600">- version update to 8.2.17
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1712923200">- version update to 8.2.18
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1715256000">- version update to 8.2.19
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1717761600">- version update to 8.2.20
  * This is a security release.</changelog>
</package>
<package pkgid="15d8ce51c9c37fe3e6dc2923e1c1c3b11118278816694003bb727b9cd8036f06" name="apache2-mod_php8" arch="src">
  <version epoch="0" ver="8.2.20" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1684843200">- also MIT license (systzdata patch, ext/date/lib/parse_posix.c)
  [https://build.suse.de/request/show/298230]</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- repack the tarball temporarily [bsc#1211648]</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 8.1.20
  * This is a security release.
  * https://www.php.net/ChangeLog-8.php#8.1.20
- force to repack tarball after update
  https://github.com/php/php-src/issues/11300
- session.save_path set to /var/lib/php8/sessions in mod_php8.conf
  and www.conf php-fpm pool example
- modified sources
  % mod_php8.conf
- added sources
  + repack.sh
  + php-unicode-allow-redistribution.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687435200">- version update to 8.2.7
  * Readonly classes
  * Disjunctive Normal Form (DNF) Types
  * Allow null, false, and true as stand-alone types
  * New "Random" extension
  * Constants in traits
  * Deprecate dynamic properties
  * for details, see
    https://www.php.net/releases/8.2/en.php
    https://www.php.net/manual/en/migration82.php
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)
  % php-date-regenerate-lexers.patch (refreshed)
  % php-ini.patch (refreshed)
  % php-systzdata-v23.patch (refreshed)
- CVE-2023-3247 [bsc#1212349]</changelog>
  <changelog author="pgajdos@suse.com" date="1689595200">- version update to 8.2.8
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.8
- modified patches
  % php-sort-filelist-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 8.2.9
  * This is a security release.
  * Fixes CVE-2023-3824 [bsc#1214103] and CVE-2023-3823 [bsc#1214106]
  * https://www.php.net/ChangeLog-8.php#8.2.9
- deleted patches
  - php-unicode-allow-redistribution.patch (upstreamed)
- deleted sources
  - repack.sh (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- version update to 8.2.10
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.10</changelog>
  <changelog author="bwiedemann@suse.com" date="1693569601">- Use %make_build macro</changelog>
  <changelog author="pgajdos@suse.com" date="1695729600">- add missing references to rpm changelog
- 15sp4 only:
  [bsc#1200772], [jsc#SLE-24723] add pecl, pear
  [jsc#SLE-23639] version update</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 8.2.11
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.11</changelog>
  <changelog author="pgajdos@suse.com" date="1698321600">- version update to 8.2.12
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.12</changelog>
  <changelog author="pgajdos@suse.com" date="1700827200">- version update to 8.2.13
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.13</changelog>
  <changelog author="pgajdos@suse.com" date="1704196800">- version update to 8.2.14
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.14</changelog>
  <changelog author="pgajdos@suse.com" date="1705579200">- version update to 8.2.15
  * This is a bug fix release.
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1708084800">- version update to 8.2.16
  * This is a bug fix release.
- modified patches
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pmonreal@suse.com" date="1709726400">- Use the system default cipher list instead of hardcoded values
  by using crypto-policies. [bsc#1211301]
  * Use the --with-system-ciphers configure option.</changelog>
  <changelog author="pgajdos@suse.com" date="1710849600">- version update to 8.2.17
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1712923200">- version update to 8.2.18
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1715256000">- version update to 8.2.19
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1717761600">- version update to 8.2.20
  * This is a security release.</changelog>
</package>
<package pkgid="3cb2f46bbc1e0f9e9889e38318f271a36f1b0df07cece7177253dc5c54db6324" name="apache2-mod_php8" arch="x86_64">
  <version epoch="0" ver="8.2.20" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1684843200">- also MIT license (systzdata patch, ext/date/lib/parse_posix.c)
  [https://build.suse.de/request/show/298230]</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- repack the tarball temporarily [bsc#1211648]</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 8.1.20
  * This is a security release.
  * https://www.php.net/ChangeLog-8.php#8.1.20
- force to repack tarball after update
  https://github.com/php/php-src/issues/11300
- session.save_path set to /var/lib/php8/sessions in mod_php8.conf
  and www.conf php-fpm pool example
- modified sources
  % mod_php8.conf
- added sources
  + repack.sh
  + php-unicode-allow-redistribution.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687435200">- version update to 8.2.7
  * Readonly classes
  * Disjunctive Normal Form (DNF) Types
  * Allow null, false, and true as stand-alone types
  * New "Random" extension
  * Constants in traits
  * Deprecate dynamic properties
  * for details, see
    https://www.php.net/releases/8.2/en.php
    https://www.php.net/manual/en/migration82.php
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)
  % php-date-regenerate-lexers.patch (refreshed)
  % php-ini.patch (refreshed)
  % php-systzdata-v23.patch (refreshed)
- CVE-2023-3247 [bsc#1212349]</changelog>
  <changelog author="pgajdos@suse.com" date="1689595200">- version update to 8.2.8
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.8
- modified patches
  % php-sort-filelist-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 8.2.9
  * This is a security release.
  * Fixes CVE-2023-3824 [bsc#1214103] and CVE-2023-3823 [bsc#1214106]
  * https://www.php.net/ChangeLog-8.php#8.2.9
- deleted patches
  - php-unicode-allow-redistribution.patch (upstreamed)
- deleted sources
  - repack.sh (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- version update to 8.2.10
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.10</changelog>
  <changelog author="bwiedemann@suse.com" date="1693569601">- Use %make_build macro</changelog>
  <changelog author="pgajdos@suse.com" date="1695729600">- add missing references to rpm changelog
- 15sp4 only:
  [bsc#1200772], [jsc#SLE-24723] add pecl, pear
  [jsc#SLE-23639] version update</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 8.2.11
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.11</changelog>
  <changelog author="pgajdos@suse.com" date="1698321600">- version update to 8.2.12
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.12</changelog>
  <changelog author="pgajdos@suse.com" date="1700827200">- version update to 8.2.13
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.13</changelog>
  <changelog author="pgajdos@suse.com" date="1704196800">- version update to 8.2.14
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.14</changelog>
  <changelog author="pgajdos@suse.com" date="1705579200">- version update to 8.2.15
  * This is a bug fix release.
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1708084800">- version update to 8.2.16
  * This is a bug fix release.
- modified patches
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pmonreal@suse.com" date="1709726400">- Use the system default cipher list instead of hardcoded values
  by using crypto-policies. [bsc#1211301]
  * Use the --with-system-ciphers configure option.</changelog>
  <changelog author="pgajdos@suse.com" date="1710849600">- version update to 8.2.17
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1712923200">- version update to 8.2.18
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1715256000">- version update to 8.2.19
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1717761600">- version update to 8.2.20
  * This is a security release.</changelog>
</package>
<package pkgid="373c185fac1b852311b7cc04fb8fa21befa1b1ad9ba9e4ff01acc4a91724cddc" name="apache2-mod_php8" arch="aarch64">
  <version epoch="0" ver="8.2.24" rel="150600.3.6.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- repack the tarball temporarily [bsc#1211648]</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 8.1.20
  * This is a security release.
  * https://www.php.net/ChangeLog-8.php#8.1.20
- force to repack tarball after update
  https://github.com/php/php-src/issues/11300
- session.save_path set to /var/lib/php8/sessions in mod_php8.conf
  and www.conf php-fpm pool example
- modified sources
  % mod_php8.conf
- added sources
  + repack.sh
  + php-unicode-allow-redistribution.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687435200">- version update to 8.2.7
  * Readonly classes
  * Disjunctive Normal Form (DNF) Types
  * Allow null, false, and true as stand-alone types
  * New "Random" extension
  * Constants in traits
  * Deprecate dynamic properties
  * for details, see
    https://www.php.net/releases/8.2/en.php
    https://www.php.net/manual/en/migration82.php
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)
  % php-date-regenerate-lexers.patch (refreshed)
  % php-ini.patch (refreshed)
  % php-systzdata-v23.patch (refreshed)
- CVE-2023-3247 [bsc#1212349]</changelog>
  <changelog author="pgajdos@suse.com" date="1689595200">- version update to 8.2.8
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.8
- modified patches
  % php-sort-filelist-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 8.2.9
  * This is a security release.
  * Fixes CVE-2023-3824 [bsc#1214103] and CVE-2023-3823 [bsc#1214106]
  * https://www.php.net/ChangeLog-8.php#8.2.9
- deleted patches
  - php-unicode-allow-redistribution.patch (upstreamed)
- deleted sources
  - repack.sh (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- version update to 8.2.10
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.10</changelog>
  <changelog author="bwiedemann@suse.com" date="1693569601">- Use %make_build macro</changelog>
  <changelog author="pgajdos@suse.com" date="1695729600">- add missing references to rpm changelog
- 15sp4 only:
  [bsc#1200772], [jsc#SLE-24723] add pecl, pear
  [jsc#SLE-23639] version update</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 8.2.11
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.11</changelog>
  <changelog author="pgajdos@suse.com" date="1698321600">- version update to 8.2.12
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.12</changelog>
  <changelog author="pgajdos@suse.com" date="1700827200">- version update to 8.2.13
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.13</changelog>
  <changelog author="pgajdos@suse.com" date="1704196800">- version update to 8.2.14
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.14</changelog>
  <changelog author="pgajdos@suse.com" date="1705579200">- version update to 8.2.15
  * This is a bug fix release.
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1708084800">- version update to 8.2.16
  * This is a bug fix release.
- modified patches
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pmonreal@suse.com" date="1709726400">- Use the system default cipher list instead of hardcoded values
  by using crypto-policies. [bsc#1211301]
  * Use the --with-system-ciphers configure option.</changelog>
  <changelog author="pgajdos@suse.com" date="1710849600">- version update to 8.2.17
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1712923200">- version update to 8.2.18
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1715256000">- version update to 8.2.19
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1717761600">- version update to 8.2.20
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1728648000">- version update to 8.2.24 [bsc#1231358], [bsc#1231382], [bsc#1231360]
    CGI:
    Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
    Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)
    Core:
    Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer).
    Fixed bug GH-15515 (Configure error grep illegal option q).
    Fixed bug GH-15514 (Configure error: genif.sh: syntax error).
    Fixed bug GH-15565 (--disable-ipv6 during compilation produces error EAI_SYSTEM not found).
    Fixed bug GH-15587 (CRC32 API build error on arm 32-bit).
    Fixed bug GH-15330 (Do not scan generator frames more than once).
    Fixed uninitialized lineno in constant AST of internal enums.
    Curl:
    FIxed bug GH-15547 (curl_multi_select overflow on timeout argument).
    DOM:
    Fixed bug GH-15551 (Segmentation fault (access null pointer) in ext/dom/xml_common.h).
    Fileinfo:
    Fixed bug GH-15752 (Incorrect error message for finfo_file with an empty filename argument).
    FPM:
    Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
    MySQLnd:
    Fixed bug GH-15432 (Heap corruption when querying a vector).
    Opcache:
    Fixed bug GH-15661 (Access null pointer in Zend/Optimizer/zend_inference.c).
    Fixed bug GH-15658 (Segmentation fault in Zend/zend_vm_execute.h).
    SAPI:
    Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
    SOAP:
    Fixed bug #73182 (PHP SOAPClient does not support stream context HTTP headers in array form).
    Standard:
    Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c).
    Streams:
    Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated).
- modified patches
  % php-systzdata-v23.patch (refreshed)</changelog>
</package>
<package pkgid="7d5c7d9f6bc12b3c2044da8aef58a2f7534336eb9ef964216bee63531efc10b5" name="apache2-mod_php8" arch="ppc64le">
  <version epoch="0" ver="8.2.24" rel="150600.3.6.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- repack the tarball temporarily [bsc#1211648]</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 8.1.20
  * This is a security release.
  * https://www.php.net/ChangeLog-8.php#8.1.20
- force to repack tarball after update
  https://github.com/php/php-src/issues/11300
- session.save_path set to /var/lib/php8/sessions in mod_php8.conf
  and www.conf php-fpm pool example
- modified sources
  % mod_php8.conf
- added sources
  + repack.sh
  + php-unicode-allow-redistribution.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687435200">- version update to 8.2.7
  * Readonly classes
  * Disjunctive Normal Form (DNF) Types
  * Allow null, false, and true as stand-alone types
  * New "Random" extension
  * Constants in traits
  * Deprecate dynamic properties
  * for details, see
    https://www.php.net/releases/8.2/en.php
    https://www.php.net/manual/en/migration82.php
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)
  % php-date-regenerate-lexers.patch (refreshed)
  % php-ini.patch (refreshed)
  % php-systzdata-v23.patch (refreshed)
- CVE-2023-3247 [bsc#1212349]</changelog>
  <changelog author="pgajdos@suse.com" date="1689595200">- version update to 8.2.8
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.8
- modified patches
  % php-sort-filelist-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 8.2.9
  * This is a security release.
  * Fixes CVE-2023-3824 [bsc#1214103] and CVE-2023-3823 [bsc#1214106]
  * https://www.php.net/ChangeLog-8.php#8.2.9
- deleted patches
  - php-unicode-allow-redistribution.patch (upstreamed)
- deleted sources
  - repack.sh (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- version update to 8.2.10
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.10</changelog>
  <changelog author="bwiedemann@suse.com" date="1693569601">- Use %make_build macro</changelog>
  <changelog author="pgajdos@suse.com" date="1695729600">- add missing references to rpm changelog
- 15sp4 only:
  [bsc#1200772], [jsc#SLE-24723] add pecl, pear
  [jsc#SLE-23639] version update</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 8.2.11
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.11</changelog>
  <changelog author="pgajdos@suse.com" date="1698321600">- version update to 8.2.12
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.12</changelog>
  <changelog author="pgajdos@suse.com" date="1700827200">- version update to 8.2.13
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.13</changelog>
  <changelog author="pgajdos@suse.com" date="1704196800">- version update to 8.2.14
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.14</changelog>
  <changelog author="pgajdos@suse.com" date="1705579200">- version update to 8.2.15
  * This is a bug fix release.
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1708084800">- version update to 8.2.16
  * This is a bug fix release.
- modified patches
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pmonreal@suse.com" date="1709726400">- Use the system default cipher list instead of hardcoded values
  by using crypto-policies. [bsc#1211301]
  * Use the --with-system-ciphers configure option.</changelog>
  <changelog author="pgajdos@suse.com" date="1710849600">- version update to 8.2.17
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1712923200">- version update to 8.2.18
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1715256000">- version update to 8.2.19
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1717761600">- version update to 8.2.20
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1728648000">- version update to 8.2.24 [bsc#1231358], [bsc#1231382], [bsc#1231360]
    CGI:
    Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
    Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)
    Core:
    Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer).
    Fixed bug GH-15515 (Configure error grep illegal option q).
    Fixed bug GH-15514 (Configure error: genif.sh: syntax error).
    Fixed bug GH-15565 (--disable-ipv6 during compilation produces error EAI_SYSTEM not found).
    Fixed bug GH-15587 (CRC32 API build error on arm 32-bit).
    Fixed bug GH-15330 (Do not scan generator frames more than once).
    Fixed uninitialized lineno in constant AST of internal enums.
    Curl:
    FIxed bug GH-15547 (curl_multi_select overflow on timeout argument).
    DOM:
    Fixed bug GH-15551 (Segmentation fault (access null pointer) in ext/dom/xml_common.h).
    Fileinfo:
    Fixed bug GH-15752 (Incorrect error message for finfo_file with an empty filename argument).
    FPM:
    Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
    MySQLnd:
    Fixed bug GH-15432 (Heap corruption when querying a vector).
    Opcache:
    Fixed bug GH-15661 (Access null pointer in Zend/Optimizer/zend_inference.c).
    Fixed bug GH-15658 (Segmentation fault in Zend/zend_vm_execute.h).
    SAPI:
    Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
    SOAP:
    Fixed bug #73182 (PHP SOAPClient does not support stream context HTTP headers in array form).
    Standard:
    Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c).
    Streams:
    Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated).
- modified patches
  % php-systzdata-v23.patch (refreshed)</changelog>
</package>
<package pkgid="c4a81d0a2415ca0e7e49644751f3f11cb7f05619cfcebcfa4bc30fdf5057b9c4" name="apache2-mod_php8" arch="s390x">
  <version epoch="0" ver="8.2.24" rel="150600.3.6.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- repack the tarball temporarily [bsc#1211648]</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 8.1.20
  * This is a security release.
  * https://www.php.net/ChangeLog-8.php#8.1.20
- force to repack tarball after update
  https://github.com/php/php-src/issues/11300
- session.save_path set to /var/lib/php8/sessions in mod_php8.conf
  and www.conf php-fpm pool example
- modified sources
  % mod_php8.conf
- added sources
  + repack.sh
  + php-unicode-allow-redistribution.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687435200">- version update to 8.2.7
  * Readonly classes
  * Disjunctive Normal Form (DNF) Types
  * Allow null, false, and true as stand-alone types
  * New "Random" extension
  * Constants in traits
  * Deprecate dynamic properties
  * for details, see
    https://www.php.net/releases/8.2/en.php
    https://www.php.net/manual/en/migration82.php
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)
  % php-date-regenerate-lexers.patch (refreshed)
  % php-ini.patch (refreshed)
  % php-systzdata-v23.patch (refreshed)
- CVE-2023-3247 [bsc#1212349]</changelog>
  <changelog author="pgajdos@suse.com" date="1689595200">- version update to 8.2.8
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.8
- modified patches
  % php-sort-filelist-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 8.2.9
  * This is a security release.
  * Fixes CVE-2023-3824 [bsc#1214103] and CVE-2023-3823 [bsc#1214106]
  * https://www.php.net/ChangeLog-8.php#8.2.9
- deleted patches
  - php-unicode-allow-redistribution.patch (upstreamed)
- deleted sources
  - repack.sh (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- version update to 8.2.10
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.10</changelog>
  <changelog author="bwiedemann@suse.com" date="1693569601">- Use %make_build macro</changelog>
  <changelog author="pgajdos@suse.com" date="1695729600">- add missing references to rpm changelog
- 15sp4 only:
  [bsc#1200772], [jsc#SLE-24723] add pecl, pear
  [jsc#SLE-23639] version update</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 8.2.11
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.11</changelog>
  <changelog author="pgajdos@suse.com" date="1698321600">- version update to 8.2.12
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.12</changelog>
  <changelog author="pgajdos@suse.com" date="1700827200">- version update to 8.2.13
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.13</changelog>
  <changelog author="pgajdos@suse.com" date="1704196800">- version update to 8.2.14
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.14</changelog>
  <changelog author="pgajdos@suse.com" date="1705579200">- version update to 8.2.15
  * This is a bug fix release.
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1708084800">- version update to 8.2.16
  * This is a bug fix release.
- modified patches
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pmonreal@suse.com" date="1709726400">- Use the system default cipher list instead of hardcoded values
  by using crypto-policies. [bsc#1211301]
  * Use the --with-system-ciphers configure option.</changelog>
  <changelog author="pgajdos@suse.com" date="1710849600">- version update to 8.2.17
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1712923200">- version update to 8.2.18
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1715256000">- version update to 8.2.19
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1717761600">- version update to 8.2.20
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1728648000">- version update to 8.2.24 [bsc#1231358], [bsc#1231382], [bsc#1231360]
    CGI:
    Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
    Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)
    Core:
    Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer).
    Fixed bug GH-15515 (Configure error grep illegal option q).
    Fixed bug GH-15514 (Configure error: genif.sh: syntax error).
    Fixed bug GH-15565 (--disable-ipv6 during compilation produces error EAI_SYSTEM not found).
    Fixed bug GH-15587 (CRC32 API build error on arm 32-bit).
    Fixed bug GH-15330 (Do not scan generator frames more than once).
    Fixed uninitialized lineno in constant AST of internal enums.
    Curl:
    FIxed bug GH-15547 (curl_multi_select overflow on timeout argument).
    DOM:
    Fixed bug GH-15551 (Segmentation fault (access null pointer) in ext/dom/xml_common.h).
    Fileinfo:
    Fixed bug GH-15752 (Incorrect error message for finfo_file with an empty filename argument).
    FPM:
    Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
    MySQLnd:
    Fixed bug GH-15432 (Heap corruption when querying a vector).
    Opcache:
    Fixed bug GH-15661 (Access null pointer in Zend/Optimizer/zend_inference.c).
    Fixed bug GH-15658 (Segmentation fault in Zend/zend_vm_execute.h).
    SAPI:
    Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
    SOAP:
    Fixed bug #73182 (PHP SOAPClient does not support stream context HTTP headers in array form).
    Standard:
    Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c).
    Streams:
    Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated).
- modified patches
  % php-systzdata-v23.patch (refreshed)</changelog>
</package>
<package pkgid="affd74de208dd2980bc1fa8b08628d5f08716b34b6f80cf71801d8f16a14b85a" name="apache2-mod_php8" arch="src">
  <version epoch="0" ver="8.2.24" rel="150600.3.6.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- repack the tarball temporarily [bsc#1211648]</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 8.1.20
  * This is a security release.
  * https://www.php.net/ChangeLog-8.php#8.1.20
- force to repack tarball after update
  https://github.com/php/php-src/issues/11300
- session.save_path set to /var/lib/php8/sessions in mod_php8.conf
  and www.conf php-fpm pool example
- modified sources
  % mod_php8.conf
- added sources
  + repack.sh
  + php-unicode-allow-redistribution.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687435200">- version update to 8.2.7
  * Readonly classes
  * Disjunctive Normal Form (DNF) Types
  * Allow null, false, and true as stand-alone types
  * New "Random" extension
  * Constants in traits
  * Deprecate dynamic properties
  * for details, see
    https://www.php.net/releases/8.2/en.php
    https://www.php.net/manual/en/migration82.php
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)
  % php-date-regenerate-lexers.patch (refreshed)
  % php-ini.patch (refreshed)
  % php-systzdata-v23.patch (refreshed)
- CVE-2023-3247 [bsc#1212349]</changelog>
  <changelog author="pgajdos@suse.com" date="1689595200">- version update to 8.2.8
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.8
- modified patches
  % php-sort-filelist-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 8.2.9
  * This is a security release.
  * Fixes CVE-2023-3824 [bsc#1214103] and CVE-2023-3823 [bsc#1214106]
  * https://www.php.net/ChangeLog-8.php#8.2.9
- deleted patches
  - php-unicode-allow-redistribution.patch (upstreamed)
- deleted sources
  - repack.sh (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- version update to 8.2.10
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.10</changelog>
  <changelog author="bwiedemann@suse.com" date="1693569601">- Use %make_build macro</changelog>
  <changelog author="pgajdos@suse.com" date="1695729600">- add missing references to rpm changelog
- 15sp4 only:
  [bsc#1200772], [jsc#SLE-24723] add pecl, pear
  [jsc#SLE-23639] version update</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 8.2.11
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.11</changelog>
  <changelog author="pgajdos@suse.com" date="1698321600">- version update to 8.2.12
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.12</changelog>
  <changelog author="pgajdos@suse.com" date="1700827200">- version update to 8.2.13
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.13</changelog>
  <changelog author="pgajdos@suse.com" date="1704196800">- version update to 8.2.14
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.14</changelog>
  <changelog author="pgajdos@suse.com" date="1705579200">- version update to 8.2.15
  * This is a bug fix release.
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1708084800">- version update to 8.2.16
  * This is a bug fix release.
- modified patches
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pmonreal@suse.com" date="1709726400">- Use the system default cipher list instead of hardcoded values
  by using crypto-policies. [bsc#1211301]
  * Use the --with-system-ciphers configure option.</changelog>
  <changelog author="pgajdos@suse.com" date="1710849600">- version update to 8.2.17
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1712923200">- version update to 8.2.18
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1715256000">- version update to 8.2.19
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1717761600">- version update to 8.2.20
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1728648000">- version update to 8.2.24 [bsc#1231358], [bsc#1231382], [bsc#1231360]
    CGI:
    Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
    Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)
    Core:
    Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer).
    Fixed bug GH-15515 (Configure error grep illegal option q).
    Fixed bug GH-15514 (Configure error: genif.sh: syntax error).
    Fixed bug GH-15565 (--disable-ipv6 during compilation produces error EAI_SYSTEM not found).
    Fixed bug GH-15587 (CRC32 API build error on arm 32-bit).
    Fixed bug GH-15330 (Do not scan generator frames more than once).
    Fixed uninitialized lineno in constant AST of internal enums.
    Curl:
    FIxed bug GH-15547 (curl_multi_select overflow on timeout argument).
    DOM:
    Fixed bug GH-15551 (Segmentation fault (access null pointer) in ext/dom/xml_common.h).
    Fileinfo:
    Fixed bug GH-15752 (Incorrect error message for finfo_file with an empty filename argument).
    FPM:
    Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
    MySQLnd:
    Fixed bug GH-15432 (Heap corruption when querying a vector).
    Opcache:
    Fixed bug GH-15661 (Access null pointer in Zend/Optimizer/zend_inference.c).
    Fixed bug GH-15658 (Segmentation fault in Zend/zend_vm_execute.h).
    SAPI:
    Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
    SOAP:
    Fixed bug #73182 (PHP SOAPClient does not support stream context HTTP headers in array form).
    Standard:
    Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c).
    Streams:
    Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated).
- modified patches
  % php-systzdata-v23.patch (refreshed)</changelog>
</package>
<package pkgid="ec3202ec5513605523924791b3c2fa82de0797ecc4ec28ab127a22112d27a45f" name="apache2-mod_php8" arch="x86_64">
  <version epoch="0" ver="8.2.24" rel="150600.3.6.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- repack the tarball temporarily [bsc#1211648]</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 8.1.20
  * This is a security release.
  * https://www.php.net/ChangeLog-8.php#8.1.20
- force to repack tarball after update
  https://github.com/php/php-src/issues/11300
- session.save_path set to /var/lib/php8/sessions in mod_php8.conf
  and www.conf php-fpm pool example
- modified sources
  % mod_php8.conf
- added sources
  + repack.sh
  + php-unicode-allow-redistribution.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687435200">- version update to 8.2.7
  * Readonly classes
  * Disjunctive Normal Form (DNF) Types
  * Allow null, false, and true as stand-alone types
  * New "Random" extension
  * Constants in traits
  * Deprecate dynamic properties
  * for details, see
    https://www.php.net/releases/8.2/en.php
    https://www.php.net/manual/en/migration82.php
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)
  % php-date-regenerate-lexers.patch (refreshed)
  % php-ini.patch (refreshed)
  % php-systzdata-v23.patch (refreshed)
- CVE-2023-3247 [bsc#1212349]</changelog>
  <changelog author="pgajdos@suse.com" date="1689595200">- version update to 8.2.8
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.8
- modified patches
  % php-sort-filelist-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 8.2.9
  * This is a security release.
  * Fixes CVE-2023-3824 [bsc#1214103] and CVE-2023-3823 [bsc#1214106]
  * https://www.php.net/ChangeLog-8.php#8.2.9
- deleted patches
  - php-unicode-allow-redistribution.patch (upstreamed)
- deleted sources
  - repack.sh (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- version update to 8.2.10
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.10</changelog>
  <changelog author="bwiedemann@suse.com" date="1693569601">- Use %make_build macro</changelog>
  <changelog author="pgajdos@suse.com" date="1695729600">- add missing references to rpm changelog
- 15sp4 only:
  [bsc#1200772], [jsc#SLE-24723] add pecl, pear
  [jsc#SLE-23639] version update</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 8.2.11
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.11</changelog>
  <changelog author="pgajdos@suse.com" date="1698321600">- version update to 8.2.12
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.12</changelog>
  <changelog author="pgajdos@suse.com" date="1700827200">- version update to 8.2.13
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.13</changelog>
  <changelog author="pgajdos@suse.com" date="1704196800">- version update to 8.2.14
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.14</changelog>
  <changelog author="pgajdos@suse.com" date="1705579200">- version update to 8.2.15
  * This is a bug fix release.
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1708084800">- version update to 8.2.16
  * This is a bug fix release.
- modified patches
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pmonreal@suse.com" date="1709726400">- Use the system default cipher list instead of hardcoded values
  by using crypto-policies. [bsc#1211301]
  * Use the --with-system-ciphers configure option.</changelog>
  <changelog author="pgajdos@suse.com" date="1710849600">- version update to 8.2.17
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1712923200">- version update to 8.2.18
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1715256000">- version update to 8.2.19
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1717761600">- version update to 8.2.20
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1728648000">- version update to 8.2.24 [bsc#1231358], [bsc#1231382], [bsc#1231360]
    CGI:
    Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
    Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)
    Core:
    Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer).
    Fixed bug GH-15515 (Configure error grep illegal option q).
    Fixed bug GH-15514 (Configure error: genif.sh: syntax error).
    Fixed bug GH-15565 (--disable-ipv6 during compilation produces error EAI_SYSTEM not found).
    Fixed bug GH-15587 (CRC32 API build error on arm 32-bit).
    Fixed bug GH-15330 (Do not scan generator frames more than once).
    Fixed uninitialized lineno in constant AST of internal enums.
    Curl:
    FIxed bug GH-15547 (curl_multi_select overflow on timeout argument).
    DOM:
    Fixed bug GH-15551 (Segmentation fault (access null pointer) in ext/dom/xml_common.h).
    Fileinfo:
    Fixed bug GH-15752 (Incorrect error message for finfo_file with an empty filename argument).
    FPM:
    Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
    MySQLnd:
    Fixed bug GH-15432 (Heap corruption when querying a vector).
    Opcache:
    Fixed bug GH-15661 (Access null pointer in Zend/Optimizer/zend_inference.c).
    Fixed bug GH-15658 (Segmentation fault in Zend/zend_vm_execute.h).
    SAPI:
    Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
    SOAP:
    Fixed bug #73182 (PHP SOAPClient does not support stream context HTTP headers in array form).
    Standard:
    Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c).
    Streams:
    Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated).
- modified patches
  % php-systzdata-v23.patch (refreshed)</changelog>
</package>
<package pkgid="84396e84a91defce4bdb6d30badcbb8363aff713248d11c66d4ae9bb91436788" name="apache2-mod_php8" arch="aarch64">
  <version epoch="0" ver="8.2.26" rel="150600.3.9.1"/>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 8.1.20
  * This is a security release.
  * https://www.php.net/ChangeLog-8.php#8.1.20
- force to repack tarball after update
  https://github.com/php/php-src/issues/11300
- session.save_path set to /var/lib/php8/sessions in mod_php8.conf
  and www.conf php-fpm pool example
- modified sources
  % mod_php8.conf
- added sources
  + repack.sh
  + php-unicode-allow-redistribution.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687435200">- version update to 8.2.7
  * Readonly classes
  * Disjunctive Normal Form (DNF) Types
  * Allow null, false, and true as stand-alone types
  * New "Random" extension
  * Constants in traits
  * Deprecate dynamic properties
  * for details, see
    https://www.php.net/releases/8.2/en.php
    https://www.php.net/manual/en/migration82.php
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)
  % php-date-regenerate-lexers.patch (refreshed)
  % php-ini.patch (refreshed)
  % php-systzdata-v23.patch (refreshed)
- CVE-2023-3247 [bsc#1212349]</changelog>
  <changelog author="pgajdos@suse.com" date="1689595200">- version update to 8.2.8
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.8
- modified patches
  % php-sort-filelist-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 8.2.9
  * This is a security release.
  * Fixes CVE-2023-3824 [bsc#1214103] and CVE-2023-3823 [bsc#1214106]
  * https://www.php.net/ChangeLog-8.php#8.2.9
- deleted patches
  - php-unicode-allow-redistribution.patch (upstreamed)
- deleted sources
  - repack.sh (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- version update to 8.2.10
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.10</changelog>
  <changelog author="bwiedemann@suse.com" date="1693569601">- Use %make_build macro</changelog>
  <changelog author="pgajdos@suse.com" date="1695729600">- add missing references to rpm changelog
- 15sp4 only:
  [bsc#1200772], [jsc#SLE-24723] add pecl, pear
  [jsc#SLE-23639] version update</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 8.2.11
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.11</changelog>
  <changelog author="pgajdos@suse.com" date="1698321600">- version update to 8.2.12
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.12</changelog>
  <changelog author="pgajdos@suse.com" date="1700827200">- version update to 8.2.13
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.13</changelog>
  <changelog author="pgajdos@suse.com" date="1704196800">- version update to 8.2.14
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.14</changelog>
  <changelog author="pgajdos@suse.com" date="1705579200">- version update to 8.2.15
  * This is a bug fix release.
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1708084800">- version update to 8.2.16
  * This is a bug fix release.
- modified patches
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pmonreal@suse.com" date="1709726400">- Use the system default cipher list instead of hardcoded values
  by using crypto-policies. [bsc#1211301]
  * Use the --with-system-ciphers configure option.</changelog>
  <changelog author="pgajdos@suse.com" date="1710849600">- version update to 8.2.17
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1712923200">- version update to 8.2.18
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1715256000">- version update to 8.2.19
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1717761600">- version update to 8.2.20
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1728648000">- version update to 8.2.24 [bsc#1231358], [bsc#1231382], [bsc#1231360]
    CGI:
    Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
    Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)
    Core:
    Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer).
    Fixed bug GH-15515 (Configure error grep illegal option q).
    Fixed bug GH-15514 (Configure error: genif.sh: syntax error).
    Fixed bug GH-15565 (--disable-ipv6 during compilation produces error EAI_SYSTEM not found).
    Fixed bug GH-15587 (CRC32 API build error on arm 32-bit).
    Fixed bug GH-15330 (Do not scan generator frames more than once).
    Fixed uninitialized lineno in constant AST of internal enums.
    Curl:
    FIxed bug GH-15547 (curl_multi_select overflow on timeout argument).
    DOM:
    Fixed bug GH-15551 (Segmentation fault (access null pointer) in ext/dom/xml_common.h).
    Fileinfo:
    Fixed bug GH-15752 (Incorrect error message for finfo_file with an empty filename argument).
    FPM:
    Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
    MySQLnd:
    Fixed bug GH-15432 (Heap corruption when querying a vector).
    Opcache:
    Fixed bug GH-15661 (Access null pointer in Zend/Optimizer/zend_inference.c).
    Fixed bug GH-15658 (Segmentation fault in Zend/zend_vm_execute.h).
    SAPI:
    Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
    SOAP:
    Fixed bug #73182 (PHP SOAPClient does not support stream context HTTP headers in array form).
    Standard:
    Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c).
    Streams:
    Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated).
- modified patches
  % php-systzdata-v23.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1732536000">- version update to 8.2.26 [bsc#1233651] [bsc#1233703] [bsc#1233702]
    CLI:
    Fixed bug GH-16373 (Shebang is not skipped for router script in cli-server started through shebang).
    Fixed bug GHSA-4w77-75f9-2c8w (Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface).
    COM:
    Fixed out of bound writes to SafeArray data.
    Core:
    Fixed bug GH-16168 (php 8.1 and earlier crash immediately when compiled with Xcode 16 clang on macOS 15).
    Fixed bug GH-16371 (Assertion failure in Zend/zend_weakrefs.c:646).
    Fixed bug GH-16515 (Incorrect propagation of ZEND_ACC_RETURN_REFERENCE for call trampoline).
    Fixed bug GH-16509 (Incorrect line number in function redeclaration error).
    Fixed bug GH-16508 (Incorrect line number in inheritance errors of delayed early bound classes).
    Fixed bug GH-16648 (Use-after-free during array sorting).
    Curl:
    Fixed bug GH-16302 (CurlMultiHandle holds a reference to CurlHandle if curl_multi_add_handle fails).
    Date:
    Fixed bug GH-16454 (Unhandled INF in date_sunset() with tiny $utcOffset).
    Fixed bug GH-16037 (Assertion failure in ext/date/php_date.c).
    Fixed bug GH-14732 (date_sun_info() fails for non-finite values).
    DBA:
    Fixed bug GH-16390 (dba_open() can segfault for "pathless" streams).
    DOM:
    Fixed bug GH-16316 (DOMXPath breaks when not initialized properly).
    Fixed bug GH-16473 (dom_import_simplexml stub is wrong).
    Fixed bug GH-16533 (Segfault when adding attribute to parent that is not an element).
    Fixed bug GH-16535 (UAF when using document as a child).
    Fixed bug GH-16593 (Assertion failure in DOM-&gt;replaceChild).
    Fixed bug GH-16595 (Another UAF in DOM -&gt; cloneNode).
    EXIF:
    Fixed bug GH-16409 (Segfault in exif_thumbnail when not dealing with a real file).
    FFI:
    Fixed bug GH-16397 (Segmentation fault when comparing FFI object).
    Filter:
    Fixed bug GH-16523 (FILTER_FLAG_HOSTNAME accepts ending hyphen).
    FPM:
    Fixed bug GH-16628 (FPM logs are getting corrupted with this log statement).
    GD:
    Fixed bug GH-16334 (imageaffine overflow on matrix elements).
    Fixed bug GH-16427 (Unchecked libavif return values).
    Fixed bug GH-16559 (UBSan abort in ext/gd/libgd/gd_interpolation.c:1007).
    GMP:
    Fixed floating point exception bug with gmp_pow when using large exposant values. (David Carlier).
    Fixed bug GH-16411 (gmp_export() can cause overflow).
    Fixed bug GH-16501 (gmp_random_bits() can cause overflow).
    Fixed gmp_pow() overflow bug with large base/exponents.
    Fixed segfaults and other issues related to operator overloading with GMP objects.
    LDAP:
    Fixed bug GHSA-g665-fm4p-vhff (OOB access in ldap_escape). (CVE-2024-8932)
    MBstring:
    Fixed bug GH-16361 (mb_substr overflow on start/length arguments).
    MySQLnd:
    Fixed bug GHSA-h35g-vwh6-m678 (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
    OpenSSL:
    Fixed bug GH-16357 (openssl may modify member types of certificate arrays).
    Fixed bug GH-16433 (Large values for openssl_csr_sign() $days overflow).
    Fix various memory leaks on error conditions in openssl_x509_parse().
    PDO DBLIB:
    Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
    PDO Firebird:
    Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
    PDO ODBC:
    Fixed bug GH-16450 (PDO_ODBC can inject garbage into field values).
    Phar:
    Fixed bug GH-16406 (Assertion failure in ext/phar/phar.c:2808).
    PHPDBG:
    Fixed bug GH-16174 (Empty string is an invalid expression for ev).
    Reflection:
    Fixed bug GH-16601 (Memory leak in Reflection constructors).
    Session:
    Fixed bug GH-16385 (Unexpected null returned by session_set_cookie_params).
    Fixed bug GH-16290 (overflow on cookie_lifetime ini value).
    SOAP:
    Fixed bug GH-16429 (Segmentation fault access null pointer in SoapClient).
    Sockets:
    Fixed bug with overflow socket_recvfrom $length argument.
    SPL:
    Fixed bug GH-16337 (Use-after-free in SplHeap).
    Fixed bug GH-16464 (Use-after-free in SplDoublyLinkedList::offsetSet()).
    Fixed bug GH-16479 (Use-after-free in SplObjectStorage::setInfo()).
    Fixed bug GH-16478 (Use-after-free in SplFixedArray::unset()).
    Fixed bug GH-16588 (UAF in Observer-&gt;serialize).
    Fix GH-16477 (Segmentation fault when calling __debugInfo() after failed SplFileObject::__constructor).
    Fixed bug GH-16589 (UAF in SplDoublyLinked-&gt;serialize()).
    Fixed bug GH-14687 (segfault on SplObjectIterator instance).
    Fixed bug GH-16604 (Memory leaks in SPL constructors).
    Fixed bug GH-16646 (UAF in ArrayObject::unset() and ArrayObject::exchangeArray()).
    Standard:
    Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with bail enabled).
    Streams:
    Fixed bug GHSA-c5f2-jwm7-mmq2 (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
    Fixed bug GHSA-r977-prxv-hc43 (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
    SysVMsg:
    Fixed bug GH-16592 (msg_send() crashes when a type does not properly serialized).
    SysVShm:
    Fixed bug GH-16591 (Assertion error in shm_put_var).
    XMLReader:
    Fixed bug GH-16292 (Segmentation fault in ext/xmlreader/php_xmlreader.c).
    Zlib:
    Fixed bug GH-16326 (Memory management is broken for bad dictionaries.) (cmb)
- version update to 8.2.25
    Calendar:
    Fixed GH-16240: jdtounix overflow on argument value.
    Fixed GH-16241: easter_days/easter_date overflow on year argument.
    Fixed GH-16263: jddayofweek overflow.
    Fixed GH-16234: jewishtojd overflow.
    CLI:
    Fixed bug GH-16137: duplicate http headers when set several times by the client.
    Core:
    Fixed bug GH-15712: zend_strtod overflow with precision INI set on large value.
    Fixed bug GH-15905 (Assertion failure for TRACK_VARS_SERVER).
    Fixed bug GH-15907 (Failed assertion when promoting Serialize deprecation to exception).
    Fixed bug GH-15851 (Segfault when printing backtrace during cleanup of nested generator frame).
    Fixed bug GH-15866 (Core dumped in Zend/zend_generators.c).
    Fixed bug GH-16188 (Assertion failure in Zend/zend_exceptions.c).
    Fixed bug GH-16233 (Observer segfault when calling user function in internal function via trampoline).
    Date:
    Fixed bug GH-15582: Crash when not calling parent constructor of DateTimeZone.
    Fixed regression where signs after the first one were ignored while parsing a signed integer, with the DateTimeInterface::modify() function.
    DOM:
    Fixed bug GH-16039 (Segmentation fault (access null pointer) in ext/dom/parentnode/tree.c).
    Fixed bug GH-16151 (Assertion failure in ext/dom/parentnode/tree.c).
    GD:
    Fixed bug GH-16232 (bitshift overflow on wbmp file content reading / fix backport from upstream).
    Fixed bug GH-12264 (overflow/underflow on imagerotate degrees value) (David Carlier)
    Fixed bug GH-16274 (imagescale underflow on RBG channels / fix backport from upstream).
    LDAP:
    Fixed bug GH-16032 (Various NULL pointer dereferencements in ldap_modify_batch()).
    Fixed bug GH-16101 (Segfault in ldap_list(), ldap_read(), and ldap_search() when LDAPs array is not a list).
    Fix GH-16132 (php_ldap_do_modify() attempts to free pointer not allocated by ZMM.).
    Fix GH-16136 (Memory leak in php_ldap_do_modify() when entry is not a proper dictionary).
    MBString:
    Fixed bug GH-16261 (Reference invariant broken in mb_convert_variables()).
    OpenSSL:
    Fixed stub for openssl_csr_new.
    PCRE:
    Fixed bug GH-16189 (underflow on offset argument).
    Fixed bug GH-16184 (UBSan address overflowed in ext/pcre/php_pcre.c).
    PHPDBG:
    Fixed bug GH-15901 (phpdbg: Assertion failure on i funcs).
    Fixed bug GH-16181 (phpdbg: exit in exception handler reports fatal error).
    Reflection:
    Fixed bug GH-16187 (Assertion failure in ext/reflection/php_reflection.c).
    SAPI:
    Fixed bug GH-15395 (php-fpm: zend_mm_heap corrupted with cgi-fcgi request).
    SimpleXML:
    Fixed bug GH-15837 (Segmentation fault in ext/simplexml/simplexml.c).
    Sockets:
    Fixed bug GH-16267 (socket_strerror overflow on errno argument).
    SOAP:
    Fixed bug #62900 (Wrong namespace on xsd import error message).
    Fixed bug GH-16237 (Segmentation fault when cloning SoapServer).
    Fix Soap leaking http_msg on error.
    Fixed bug GH-16256 (Assertion failure in ext/soap/php_encoding.c:460).
    Fixed bug GH-16259 (Soap segfault when classmap instantiation fails).
    Standard:
    Fixed bug GH-15613 (overflow on unpack call hex string repeater).
    Fixed bug GH-15937 (overflow on stream timeout option value).
    Fixed bug GH-16053 (Assertion failure in Zend/zend_hash.c).
    Streams:
    Fixed bugs GH-15908 and GH-15026 (leak / assertion failure in streams.c).
    Fixed bug GH-15980 (Signed integer overflow in main/streams/streams.c).
    TSRM:
    Prevent closing of unrelated handles.
    XML:
    Fixed bug GH-15868 (Assertion failure in xml_parse_into_struct after exception).</changelog>
</package>
<package pkgid="1fb52b6ea027b82efb59f1403621c64ed5b32c3dad5f1bbb2cb3f9b81f579c12" name="apache2-mod_php8" arch="ppc64le">
  <version epoch="0" ver="8.2.26" rel="150600.3.9.1"/>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 8.1.20
  * This is a security release.
  * https://www.php.net/ChangeLog-8.php#8.1.20
- force to repack tarball after update
  https://github.com/php/php-src/issues/11300
- session.save_path set to /var/lib/php8/sessions in mod_php8.conf
  and www.conf php-fpm pool example
- modified sources
  % mod_php8.conf
- added sources
  + repack.sh
  + php-unicode-allow-redistribution.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687435200">- version update to 8.2.7
  * Readonly classes
  * Disjunctive Normal Form (DNF) Types
  * Allow null, false, and true as stand-alone types
  * New "Random" extension
  * Constants in traits
  * Deprecate dynamic properties
  * for details, see
    https://www.php.net/releases/8.2/en.php
    https://www.php.net/manual/en/migration82.php
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)
  % php-date-regenerate-lexers.patch (refreshed)
  % php-ini.patch (refreshed)
  % php-systzdata-v23.patch (refreshed)
- CVE-2023-3247 [bsc#1212349]</changelog>
  <changelog author="pgajdos@suse.com" date="1689595200">- version update to 8.2.8
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.8
- modified patches
  % php-sort-filelist-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 8.2.9
  * This is a security release.
  * Fixes CVE-2023-3824 [bsc#1214103] and CVE-2023-3823 [bsc#1214106]
  * https://www.php.net/ChangeLog-8.php#8.2.9
- deleted patches
  - php-unicode-allow-redistribution.patch (upstreamed)
- deleted sources
  - repack.sh (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- version update to 8.2.10
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.10</changelog>
  <changelog author="bwiedemann@suse.com" date="1693569601">- Use %make_build macro</changelog>
  <changelog author="pgajdos@suse.com" date="1695729600">- add missing references to rpm changelog
- 15sp4 only:
  [bsc#1200772], [jsc#SLE-24723] add pecl, pear
  [jsc#SLE-23639] version update</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 8.2.11
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.11</changelog>
  <changelog author="pgajdos@suse.com" date="1698321600">- version update to 8.2.12
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.12</changelog>
  <changelog author="pgajdos@suse.com" date="1700827200">- version update to 8.2.13
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.13</changelog>
  <changelog author="pgajdos@suse.com" date="1704196800">- version update to 8.2.14
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.14</changelog>
  <changelog author="pgajdos@suse.com" date="1705579200">- version update to 8.2.15
  * This is a bug fix release.
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1708084800">- version update to 8.2.16
  * This is a bug fix release.
- modified patches
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pmonreal@suse.com" date="1709726400">- Use the system default cipher list instead of hardcoded values
  by using crypto-policies. [bsc#1211301]
  * Use the --with-system-ciphers configure option.</changelog>
  <changelog author="pgajdos@suse.com" date="1710849600">- version update to 8.2.17
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1712923200">- version update to 8.2.18
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1715256000">- version update to 8.2.19
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1717761600">- version update to 8.2.20
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1728648000">- version update to 8.2.24 [bsc#1231358], [bsc#1231382], [bsc#1231360]
    CGI:
    Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
    Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)
    Core:
    Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer).
    Fixed bug GH-15515 (Configure error grep illegal option q).
    Fixed bug GH-15514 (Configure error: genif.sh: syntax error).
    Fixed bug GH-15565 (--disable-ipv6 during compilation produces error EAI_SYSTEM not found).
    Fixed bug GH-15587 (CRC32 API build error on arm 32-bit).
    Fixed bug GH-15330 (Do not scan generator frames more than once).
    Fixed uninitialized lineno in constant AST of internal enums.
    Curl:
    FIxed bug GH-15547 (curl_multi_select overflow on timeout argument).
    DOM:
    Fixed bug GH-15551 (Segmentation fault (access null pointer) in ext/dom/xml_common.h).
    Fileinfo:
    Fixed bug GH-15752 (Incorrect error message for finfo_file with an empty filename argument).
    FPM:
    Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
    MySQLnd:
    Fixed bug GH-15432 (Heap corruption when querying a vector).
    Opcache:
    Fixed bug GH-15661 (Access null pointer in Zend/Optimizer/zend_inference.c).
    Fixed bug GH-15658 (Segmentation fault in Zend/zend_vm_execute.h).
    SAPI:
    Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
    SOAP:
    Fixed bug #73182 (PHP SOAPClient does not support stream context HTTP headers in array form).
    Standard:
    Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c).
    Streams:
    Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated).
- modified patches
  % php-systzdata-v23.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1732536000">- version update to 8.2.26 [bsc#1233651] [bsc#1233703] [bsc#1233702]
    CLI:
    Fixed bug GH-16373 (Shebang is not skipped for router script in cli-server started through shebang).
    Fixed bug GHSA-4w77-75f9-2c8w (Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface).
    COM:
    Fixed out of bound writes to SafeArray data.
    Core:
    Fixed bug GH-16168 (php 8.1 and earlier crash immediately when compiled with Xcode 16 clang on macOS 15).
    Fixed bug GH-16371 (Assertion failure in Zend/zend_weakrefs.c:646).
    Fixed bug GH-16515 (Incorrect propagation of ZEND_ACC_RETURN_REFERENCE for call trampoline).
    Fixed bug GH-16509 (Incorrect line number in function redeclaration error).
    Fixed bug GH-16508 (Incorrect line number in inheritance errors of delayed early bound classes).
    Fixed bug GH-16648 (Use-after-free during array sorting).
    Curl:
    Fixed bug GH-16302 (CurlMultiHandle holds a reference to CurlHandle if curl_multi_add_handle fails).
    Date:
    Fixed bug GH-16454 (Unhandled INF in date_sunset() with tiny $utcOffset).
    Fixed bug GH-16037 (Assertion failure in ext/date/php_date.c).
    Fixed bug GH-14732 (date_sun_info() fails for non-finite values).
    DBA:
    Fixed bug GH-16390 (dba_open() can segfault for "pathless" streams).
    DOM:
    Fixed bug GH-16316 (DOMXPath breaks when not initialized properly).
    Fixed bug GH-16473 (dom_import_simplexml stub is wrong).
    Fixed bug GH-16533 (Segfault when adding attribute to parent that is not an element).
    Fixed bug GH-16535 (UAF when using document as a child).
    Fixed bug GH-16593 (Assertion failure in DOM-&gt;replaceChild).
    Fixed bug GH-16595 (Another UAF in DOM -&gt; cloneNode).
    EXIF:
    Fixed bug GH-16409 (Segfault in exif_thumbnail when not dealing with a real file).
    FFI:
    Fixed bug GH-16397 (Segmentation fault when comparing FFI object).
    Filter:
    Fixed bug GH-16523 (FILTER_FLAG_HOSTNAME accepts ending hyphen).
    FPM:
    Fixed bug GH-16628 (FPM logs are getting corrupted with this log statement).
    GD:
    Fixed bug GH-16334 (imageaffine overflow on matrix elements).
    Fixed bug GH-16427 (Unchecked libavif return values).
    Fixed bug GH-16559 (UBSan abort in ext/gd/libgd/gd_interpolation.c:1007).
    GMP:
    Fixed floating point exception bug with gmp_pow when using large exposant values. (David Carlier).
    Fixed bug GH-16411 (gmp_export() can cause overflow).
    Fixed bug GH-16501 (gmp_random_bits() can cause overflow).
    Fixed gmp_pow() overflow bug with large base/exponents.
    Fixed segfaults and other issues related to operator overloading with GMP objects.
    LDAP:
    Fixed bug GHSA-g665-fm4p-vhff (OOB access in ldap_escape). (CVE-2024-8932)
    MBstring:
    Fixed bug GH-16361 (mb_substr overflow on start/length arguments).
    MySQLnd:
    Fixed bug GHSA-h35g-vwh6-m678 (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
    OpenSSL:
    Fixed bug GH-16357 (openssl may modify member types of certificate arrays).
    Fixed bug GH-16433 (Large values for openssl_csr_sign() $days overflow).
    Fix various memory leaks on error conditions in openssl_x509_parse().
    PDO DBLIB:
    Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
    PDO Firebird:
    Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
    PDO ODBC:
    Fixed bug GH-16450 (PDO_ODBC can inject garbage into field values).
    Phar:
    Fixed bug GH-16406 (Assertion failure in ext/phar/phar.c:2808).
    PHPDBG:
    Fixed bug GH-16174 (Empty string is an invalid expression for ev).
    Reflection:
    Fixed bug GH-16601 (Memory leak in Reflection constructors).
    Session:
    Fixed bug GH-16385 (Unexpected null returned by session_set_cookie_params).
    Fixed bug GH-16290 (overflow on cookie_lifetime ini value).
    SOAP:
    Fixed bug GH-16429 (Segmentation fault access null pointer in SoapClient).
    Sockets:
    Fixed bug with overflow socket_recvfrom $length argument.
    SPL:
    Fixed bug GH-16337 (Use-after-free in SplHeap).
    Fixed bug GH-16464 (Use-after-free in SplDoublyLinkedList::offsetSet()).
    Fixed bug GH-16479 (Use-after-free in SplObjectStorage::setInfo()).
    Fixed bug GH-16478 (Use-after-free in SplFixedArray::unset()).
    Fixed bug GH-16588 (UAF in Observer-&gt;serialize).
    Fix GH-16477 (Segmentation fault when calling __debugInfo() after failed SplFileObject::__constructor).
    Fixed bug GH-16589 (UAF in SplDoublyLinked-&gt;serialize()).
    Fixed bug GH-14687 (segfault on SplObjectIterator instance).
    Fixed bug GH-16604 (Memory leaks in SPL constructors).
    Fixed bug GH-16646 (UAF in ArrayObject::unset() and ArrayObject::exchangeArray()).
    Standard:
    Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with bail enabled).
    Streams:
    Fixed bug GHSA-c5f2-jwm7-mmq2 (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
    Fixed bug GHSA-r977-prxv-hc43 (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
    SysVMsg:
    Fixed bug GH-16592 (msg_send() crashes when a type does not properly serialized).
    SysVShm:
    Fixed bug GH-16591 (Assertion error in shm_put_var).
    XMLReader:
    Fixed bug GH-16292 (Segmentation fault in ext/xmlreader/php_xmlreader.c).
    Zlib:
    Fixed bug GH-16326 (Memory management is broken for bad dictionaries.) (cmb)
- version update to 8.2.25
    Calendar:
    Fixed GH-16240: jdtounix overflow on argument value.
    Fixed GH-16241: easter_days/easter_date overflow on year argument.
    Fixed GH-16263: jddayofweek overflow.
    Fixed GH-16234: jewishtojd overflow.
    CLI:
    Fixed bug GH-16137: duplicate http headers when set several times by the client.
    Core:
    Fixed bug GH-15712: zend_strtod overflow with precision INI set on large value.
    Fixed bug GH-15905 (Assertion failure for TRACK_VARS_SERVER).
    Fixed bug GH-15907 (Failed assertion when promoting Serialize deprecation to exception).
    Fixed bug GH-15851 (Segfault when printing backtrace during cleanup of nested generator frame).
    Fixed bug GH-15866 (Core dumped in Zend/zend_generators.c).
    Fixed bug GH-16188 (Assertion failure in Zend/zend_exceptions.c).
    Fixed bug GH-16233 (Observer segfault when calling user function in internal function via trampoline).
    Date:
    Fixed bug GH-15582: Crash when not calling parent constructor of DateTimeZone.
    Fixed regression where signs after the first one were ignored while parsing a signed integer, with the DateTimeInterface::modify() function.
    DOM:
    Fixed bug GH-16039 (Segmentation fault (access null pointer) in ext/dom/parentnode/tree.c).
    Fixed bug GH-16151 (Assertion failure in ext/dom/parentnode/tree.c).
    GD:
    Fixed bug GH-16232 (bitshift overflow on wbmp file content reading / fix backport from upstream).
    Fixed bug GH-12264 (overflow/underflow on imagerotate degrees value) (David Carlier)
    Fixed bug GH-16274 (imagescale underflow on RBG channels / fix backport from upstream).
    LDAP:
    Fixed bug GH-16032 (Various NULL pointer dereferencements in ldap_modify_batch()).
    Fixed bug GH-16101 (Segfault in ldap_list(), ldap_read(), and ldap_search() when LDAPs array is not a list).
    Fix GH-16132 (php_ldap_do_modify() attempts to free pointer not allocated by ZMM.).
    Fix GH-16136 (Memory leak in php_ldap_do_modify() when entry is not a proper dictionary).
    MBString:
    Fixed bug GH-16261 (Reference invariant broken in mb_convert_variables()).
    OpenSSL:
    Fixed stub for openssl_csr_new.
    PCRE:
    Fixed bug GH-16189 (underflow on offset argument).
    Fixed bug GH-16184 (UBSan address overflowed in ext/pcre/php_pcre.c).
    PHPDBG:
    Fixed bug GH-15901 (phpdbg: Assertion failure on i funcs).
    Fixed bug GH-16181 (phpdbg: exit in exception handler reports fatal error).
    Reflection:
    Fixed bug GH-16187 (Assertion failure in ext/reflection/php_reflection.c).
    SAPI:
    Fixed bug GH-15395 (php-fpm: zend_mm_heap corrupted with cgi-fcgi request).
    SimpleXML:
    Fixed bug GH-15837 (Segmentation fault in ext/simplexml/simplexml.c).
    Sockets:
    Fixed bug GH-16267 (socket_strerror overflow on errno argument).
    SOAP:
    Fixed bug #62900 (Wrong namespace on xsd import error message).
    Fixed bug GH-16237 (Segmentation fault when cloning SoapServer).
    Fix Soap leaking http_msg on error.
    Fixed bug GH-16256 (Assertion failure in ext/soap/php_encoding.c:460).
    Fixed bug GH-16259 (Soap segfault when classmap instantiation fails).
    Standard:
    Fixed bug GH-15613 (overflow on unpack call hex string repeater).
    Fixed bug GH-15937 (overflow on stream timeout option value).
    Fixed bug GH-16053 (Assertion failure in Zend/zend_hash.c).
    Streams:
    Fixed bugs GH-15908 and GH-15026 (leak / assertion failure in streams.c).
    Fixed bug GH-15980 (Signed integer overflow in main/streams/streams.c).
    TSRM:
    Prevent closing of unrelated handles.
    XML:
    Fixed bug GH-15868 (Assertion failure in xml_parse_into_struct after exception).</changelog>
</package>
<package pkgid="958b3b340e5b69e4a8c2f7960bc6f107f35c7b1dbd8eb9dd84aeb77ed2f40f1e" name="apache2-mod_php8" arch="s390x">
  <version epoch="0" ver="8.2.26" rel="150600.3.9.1"/>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 8.1.20
  * This is a security release.
  * https://www.php.net/ChangeLog-8.php#8.1.20
- force to repack tarball after update
  https://github.com/php/php-src/issues/11300
- session.save_path set to /var/lib/php8/sessions in mod_php8.conf
  and www.conf php-fpm pool example
- modified sources
  % mod_php8.conf
- added sources
  + repack.sh
  + php-unicode-allow-redistribution.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687435200">- version update to 8.2.7
  * Readonly classes
  * Disjunctive Normal Form (DNF) Types
  * Allow null, false, and true as stand-alone types
  * New "Random" extension
  * Constants in traits
  * Deprecate dynamic properties
  * for details, see
    https://www.php.net/releases/8.2/en.php
    https://www.php.net/manual/en/migration82.php
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)
  % php-date-regenerate-lexers.patch (refreshed)
  % php-ini.patch (refreshed)
  % php-systzdata-v23.patch (refreshed)
- CVE-2023-3247 [bsc#1212349]</changelog>
  <changelog author="pgajdos@suse.com" date="1689595200">- version update to 8.2.8
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.8
- modified patches
  % php-sort-filelist-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 8.2.9
  * This is a security release.
  * Fixes CVE-2023-3824 [bsc#1214103] and CVE-2023-3823 [bsc#1214106]
  * https://www.php.net/ChangeLog-8.php#8.2.9
- deleted patches
  - php-unicode-allow-redistribution.patch (upstreamed)
- deleted sources
  - repack.sh (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- version update to 8.2.10
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.10</changelog>
  <changelog author="bwiedemann@suse.com" date="1693569601">- Use %make_build macro</changelog>
  <changelog author="pgajdos@suse.com" date="1695729600">- add missing references to rpm changelog
- 15sp4 only:
  [bsc#1200772], [jsc#SLE-24723] add pecl, pear
  [jsc#SLE-23639] version update</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 8.2.11
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.11</changelog>
  <changelog author="pgajdos@suse.com" date="1698321600">- version update to 8.2.12
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.12</changelog>
  <changelog author="pgajdos@suse.com" date="1700827200">- version update to 8.2.13
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.13</changelog>
  <changelog author="pgajdos@suse.com" date="1704196800">- version update to 8.2.14
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.14</changelog>
  <changelog author="pgajdos@suse.com" date="1705579200">- version update to 8.2.15
  * This is a bug fix release.
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1708084800">- version update to 8.2.16
  * This is a bug fix release.
- modified patches
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pmonreal@suse.com" date="1709726400">- Use the system default cipher list instead of hardcoded values
  by using crypto-policies. [bsc#1211301]
  * Use the --with-system-ciphers configure option.</changelog>
  <changelog author="pgajdos@suse.com" date="1710849600">- version update to 8.2.17
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1712923200">- version update to 8.2.18
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1715256000">- version update to 8.2.19
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1717761600">- version update to 8.2.20
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1728648000">- version update to 8.2.24 [bsc#1231358], [bsc#1231382], [bsc#1231360]
    CGI:
    Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
    Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)
    Core:
    Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer).
    Fixed bug GH-15515 (Configure error grep illegal option q).
    Fixed bug GH-15514 (Configure error: genif.sh: syntax error).
    Fixed bug GH-15565 (--disable-ipv6 during compilation produces error EAI_SYSTEM not found).
    Fixed bug GH-15587 (CRC32 API build error on arm 32-bit).
    Fixed bug GH-15330 (Do not scan generator frames more than once).
    Fixed uninitialized lineno in constant AST of internal enums.
    Curl:
    FIxed bug GH-15547 (curl_multi_select overflow on timeout argument).
    DOM:
    Fixed bug GH-15551 (Segmentation fault (access null pointer) in ext/dom/xml_common.h).
    Fileinfo:
    Fixed bug GH-15752 (Incorrect error message for finfo_file with an empty filename argument).
    FPM:
    Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
    MySQLnd:
    Fixed bug GH-15432 (Heap corruption when querying a vector).
    Opcache:
    Fixed bug GH-15661 (Access null pointer in Zend/Optimizer/zend_inference.c).
    Fixed bug GH-15658 (Segmentation fault in Zend/zend_vm_execute.h).
    SAPI:
    Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
    SOAP:
    Fixed bug #73182 (PHP SOAPClient does not support stream context HTTP headers in array form).
    Standard:
    Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c).
    Streams:
    Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated).
- modified patches
  % php-systzdata-v23.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1732536000">- version update to 8.2.26 [bsc#1233651] [bsc#1233703] [bsc#1233702]
    CLI:
    Fixed bug GH-16373 (Shebang is not skipped for router script in cli-server started through shebang).
    Fixed bug GHSA-4w77-75f9-2c8w (Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface).
    COM:
    Fixed out of bound writes to SafeArray data.
    Core:
    Fixed bug GH-16168 (php 8.1 and earlier crash immediately when compiled with Xcode 16 clang on macOS 15).
    Fixed bug GH-16371 (Assertion failure in Zend/zend_weakrefs.c:646).
    Fixed bug GH-16515 (Incorrect propagation of ZEND_ACC_RETURN_REFERENCE for call trampoline).
    Fixed bug GH-16509 (Incorrect line number in function redeclaration error).
    Fixed bug GH-16508 (Incorrect line number in inheritance errors of delayed early bound classes).
    Fixed bug GH-16648 (Use-after-free during array sorting).
    Curl:
    Fixed bug GH-16302 (CurlMultiHandle holds a reference to CurlHandle if curl_multi_add_handle fails).
    Date:
    Fixed bug GH-16454 (Unhandled INF in date_sunset() with tiny $utcOffset).
    Fixed bug GH-16037 (Assertion failure in ext/date/php_date.c).
    Fixed bug GH-14732 (date_sun_info() fails for non-finite values).
    DBA:
    Fixed bug GH-16390 (dba_open() can segfault for "pathless" streams).
    DOM:
    Fixed bug GH-16316 (DOMXPath breaks when not initialized properly).
    Fixed bug GH-16473 (dom_import_simplexml stub is wrong).
    Fixed bug GH-16533 (Segfault when adding attribute to parent that is not an element).
    Fixed bug GH-16535 (UAF when using document as a child).
    Fixed bug GH-16593 (Assertion failure in DOM-&gt;replaceChild).
    Fixed bug GH-16595 (Another UAF in DOM -&gt; cloneNode).
    EXIF:
    Fixed bug GH-16409 (Segfault in exif_thumbnail when not dealing with a real file).
    FFI:
    Fixed bug GH-16397 (Segmentation fault when comparing FFI object).
    Filter:
    Fixed bug GH-16523 (FILTER_FLAG_HOSTNAME accepts ending hyphen).
    FPM:
    Fixed bug GH-16628 (FPM logs are getting corrupted with this log statement).
    GD:
    Fixed bug GH-16334 (imageaffine overflow on matrix elements).
    Fixed bug GH-16427 (Unchecked libavif return values).
    Fixed bug GH-16559 (UBSan abort in ext/gd/libgd/gd_interpolation.c:1007).
    GMP:
    Fixed floating point exception bug with gmp_pow when using large exposant values. (David Carlier).
    Fixed bug GH-16411 (gmp_export() can cause overflow).
    Fixed bug GH-16501 (gmp_random_bits() can cause overflow).
    Fixed gmp_pow() overflow bug with large base/exponents.
    Fixed segfaults and other issues related to operator overloading with GMP objects.
    LDAP:
    Fixed bug GHSA-g665-fm4p-vhff (OOB access in ldap_escape). (CVE-2024-8932)
    MBstring:
    Fixed bug GH-16361 (mb_substr overflow on start/length arguments).
    MySQLnd:
    Fixed bug GHSA-h35g-vwh6-m678 (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
    OpenSSL:
    Fixed bug GH-16357 (openssl may modify member types of certificate arrays).
    Fixed bug GH-16433 (Large values for openssl_csr_sign() $days overflow).
    Fix various memory leaks on error conditions in openssl_x509_parse().
    PDO DBLIB:
    Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
    PDO Firebird:
    Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
    PDO ODBC:
    Fixed bug GH-16450 (PDO_ODBC can inject garbage into field values).
    Phar:
    Fixed bug GH-16406 (Assertion failure in ext/phar/phar.c:2808).
    PHPDBG:
    Fixed bug GH-16174 (Empty string is an invalid expression for ev).
    Reflection:
    Fixed bug GH-16601 (Memory leak in Reflection constructors).
    Session:
    Fixed bug GH-16385 (Unexpected null returned by session_set_cookie_params).
    Fixed bug GH-16290 (overflow on cookie_lifetime ini value).
    SOAP:
    Fixed bug GH-16429 (Segmentation fault access null pointer in SoapClient).
    Sockets:
    Fixed bug with overflow socket_recvfrom $length argument.
    SPL:
    Fixed bug GH-16337 (Use-after-free in SplHeap).
    Fixed bug GH-16464 (Use-after-free in SplDoublyLinkedList::offsetSet()).
    Fixed bug GH-16479 (Use-after-free in SplObjectStorage::setInfo()).
    Fixed bug GH-16478 (Use-after-free in SplFixedArray::unset()).
    Fixed bug GH-16588 (UAF in Observer-&gt;serialize).
    Fix GH-16477 (Segmentation fault when calling __debugInfo() after failed SplFileObject::__constructor).
    Fixed bug GH-16589 (UAF in SplDoublyLinked-&gt;serialize()).
    Fixed bug GH-14687 (segfault on SplObjectIterator instance).
    Fixed bug GH-16604 (Memory leaks in SPL constructors).
    Fixed bug GH-16646 (UAF in ArrayObject::unset() and ArrayObject::exchangeArray()).
    Standard:
    Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with bail enabled).
    Streams:
    Fixed bug GHSA-c5f2-jwm7-mmq2 (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
    Fixed bug GHSA-r977-prxv-hc43 (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
    SysVMsg:
    Fixed bug GH-16592 (msg_send() crashes when a type does not properly serialized).
    SysVShm:
    Fixed bug GH-16591 (Assertion error in shm_put_var).
    XMLReader:
    Fixed bug GH-16292 (Segmentation fault in ext/xmlreader/php_xmlreader.c).
    Zlib:
    Fixed bug GH-16326 (Memory management is broken for bad dictionaries.) (cmb)
- version update to 8.2.25
    Calendar:
    Fixed GH-16240: jdtounix overflow on argument value.
    Fixed GH-16241: easter_days/easter_date overflow on year argument.
    Fixed GH-16263: jddayofweek overflow.
    Fixed GH-16234: jewishtojd overflow.
    CLI:
    Fixed bug GH-16137: duplicate http headers when set several times by the client.
    Core:
    Fixed bug GH-15712: zend_strtod overflow with precision INI set on large value.
    Fixed bug GH-15905 (Assertion failure for TRACK_VARS_SERVER).
    Fixed bug GH-15907 (Failed assertion when promoting Serialize deprecation to exception).
    Fixed bug GH-15851 (Segfault when printing backtrace during cleanup of nested generator frame).
    Fixed bug GH-15866 (Core dumped in Zend/zend_generators.c).
    Fixed bug GH-16188 (Assertion failure in Zend/zend_exceptions.c).
    Fixed bug GH-16233 (Observer segfault when calling user function in internal function via trampoline).
    Date:
    Fixed bug GH-15582: Crash when not calling parent constructor of DateTimeZone.
    Fixed regression where signs after the first one were ignored while parsing a signed integer, with the DateTimeInterface::modify() function.
    DOM:
    Fixed bug GH-16039 (Segmentation fault (access null pointer) in ext/dom/parentnode/tree.c).
    Fixed bug GH-16151 (Assertion failure in ext/dom/parentnode/tree.c).
    GD:
    Fixed bug GH-16232 (bitshift overflow on wbmp file content reading / fix backport from upstream).
    Fixed bug GH-12264 (overflow/underflow on imagerotate degrees value) (David Carlier)
    Fixed bug GH-16274 (imagescale underflow on RBG channels / fix backport from upstream).
    LDAP:
    Fixed bug GH-16032 (Various NULL pointer dereferencements in ldap_modify_batch()).
    Fixed bug GH-16101 (Segfault in ldap_list(), ldap_read(), and ldap_search() when LDAPs array is not a list).
    Fix GH-16132 (php_ldap_do_modify() attempts to free pointer not allocated by ZMM.).
    Fix GH-16136 (Memory leak in php_ldap_do_modify() when entry is not a proper dictionary).
    MBString:
    Fixed bug GH-16261 (Reference invariant broken in mb_convert_variables()).
    OpenSSL:
    Fixed stub for openssl_csr_new.
    PCRE:
    Fixed bug GH-16189 (underflow on offset argument).
    Fixed bug GH-16184 (UBSan address overflowed in ext/pcre/php_pcre.c).
    PHPDBG:
    Fixed bug GH-15901 (phpdbg: Assertion failure on i funcs).
    Fixed bug GH-16181 (phpdbg: exit in exception handler reports fatal error).
    Reflection:
    Fixed bug GH-16187 (Assertion failure in ext/reflection/php_reflection.c).
    SAPI:
    Fixed bug GH-15395 (php-fpm: zend_mm_heap corrupted with cgi-fcgi request).
    SimpleXML:
    Fixed bug GH-15837 (Segmentation fault in ext/simplexml/simplexml.c).
    Sockets:
    Fixed bug GH-16267 (socket_strerror overflow on errno argument).
    SOAP:
    Fixed bug #62900 (Wrong namespace on xsd import error message).
    Fixed bug GH-16237 (Segmentation fault when cloning SoapServer).
    Fix Soap leaking http_msg on error.
    Fixed bug GH-16256 (Assertion failure in ext/soap/php_encoding.c:460).
    Fixed bug GH-16259 (Soap segfault when classmap instantiation fails).
    Standard:
    Fixed bug GH-15613 (overflow on unpack call hex string repeater).
    Fixed bug GH-15937 (overflow on stream timeout option value).
    Fixed bug GH-16053 (Assertion failure in Zend/zend_hash.c).
    Streams:
    Fixed bugs GH-15908 and GH-15026 (leak / assertion failure in streams.c).
    Fixed bug GH-15980 (Signed integer overflow in main/streams/streams.c).
    TSRM:
    Prevent closing of unrelated handles.
    XML:
    Fixed bug GH-15868 (Assertion failure in xml_parse_into_struct after exception).</changelog>
</package>
<package pkgid="7f90f2c653bd8b6bfdf13e7161e0f6a5fd33017426bbf303bf30be88e6604e8d" name="apache2-mod_php8" arch="src">
  <version epoch="0" ver="8.2.26" rel="150600.3.9.1"/>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 8.1.20
  * This is a security release.
  * https://www.php.net/ChangeLog-8.php#8.1.20
- force to repack tarball after update
  https://github.com/php/php-src/issues/11300
- session.save_path set to /var/lib/php8/sessions in mod_php8.conf
  and www.conf php-fpm pool example
- modified sources
  % mod_php8.conf
- added sources
  + repack.sh
  + php-unicode-allow-redistribution.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687435200">- version update to 8.2.7
  * Readonly classes
  * Disjunctive Normal Form (DNF) Types
  * Allow null, false, and true as stand-alone types
  * New "Random" extension
  * Constants in traits
  * Deprecate dynamic properties
  * for details, see
    https://www.php.net/releases/8.2/en.php
    https://www.php.net/manual/en/migration82.php
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)
  % php-date-regenerate-lexers.patch (refreshed)
  % php-ini.patch (refreshed)
  % php-systzdata-v23.patch (refreshed)
- CVE-2023-3247 [bsc#1212349]</changelog>
  <changelog author="pgajdos@suse.com" date="1689595200">- version update to 8.2.8
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.8
- modified patches
  % php-sort-filelist-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 8.2.9
  * This is a security release.
  * Fixes CVE-2023-3824 [bsc#1214103] and CVE-2023-3823 [bsc#1214106]
  * https://www.php.net/ChangeLog-8.php#8.2.9
- deleted patches
  - php-unicode-allow-redistribution.patch (upstreamed)
- deleted sources
  - repack.sh (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- version update to 8.2.10
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.10</changelog>
  <changelog author="bwiedemann@suse.com" date="1693569601">- Use %make_build macro</changelog>
  <changelog author="pgajdos@suse.com" date="1695729600">- add missing references to rpm changelog
- 15sp4 only:
  [bsc#1200772], [jsc#SLE-24723] add pecl, pear
  [jsc#SLE-23639] version update</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 8.2.11
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.11</changelog>
  <changelog author="pgajdos@suse.com" date="1698321600">- version update to 8.2.12
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.12</changelog>
  <changelog author="pgajdos@suse.com" date="1700827200">- version update to 8.2.13
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.13</changelog>
  <changelog author="pgajdos@suse.com" date="1704196800">- version update to 8.2.14
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.14</changelog>
  <changelog author="pgajdos@suse.com" date="1705579200">- version update to 8.2.15
  * This is a bug fix release.
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1708084800">- version update to 8.2.16
  * This is a bug fix release.
- modified patches
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pmonreal@suse.com" date="1709726400">- Use the system default cipher list instead of hardcoded values
  by using crypto-policies. [bsc#1211301]
  * Use the --with-system-ciphers configure option.</changelog>
  <changelog author="pgajdos@suse.com" date="1710849600">- version update to 8.2.17
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1712923200">- version update to 8.2.18
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1715256000">- version update to 8.2.19
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1717761600">- version update to 8.2.20
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1728648000">- version update to 8.2.24 [bsc#1231358], [bsc#1231382], [bsc#1231360]
    CGI:
    Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
    Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)
    Core:
    Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer).
    Fixed bug GH-15515 (Configure error grep illegal option q).
    Fixed bug GH-15514 (Configure error: genif.sh: syntax error).
    Fixed bug GH-15565 (--disable-ipv6 during compilation produces error EAI_SYSTEM not found).
    Fixed bug GH-15587 (CRC32 API build error on arm 32-bit).
    Fixed bug GH-15330 (Do not scan generator frames more than once).
    Fixed uninitialized lineno in constant AST of internal enums.
    Curl:
    FIxed bug GH-15547 (curl_multi_select overflow on timeout argument).
    DOM:
    Fixed bug GH-15551 (Segmentation fault (access null pointer) in ext/dom/xml_common.h).
    Fileinfo:
    Fixed bug GH-15752 (Incorrect error message for finfo_file with an empty filename argument).
    FPM:
    Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
    MySQLnd:
    Fixed bug GH-15432 (Heap corruption when querying a vector).
    Opcache:
    Fixed bug GH-15661 (Access null pointer in Zend/Optimizer/zend_inference.c).
    Fixed bug GH-15658 (Segmentation fault in Zend/zend_vm_execute.h).
    SAPI:
    Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
    SOAP:
    Fixed bug #73182 (PHP SOAPClient does not support stream context HTTP headers in array form).
    Standard:
    Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c).
    Streams:
    Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated).
- modified patches
  % php-systzdata-v23.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1732536000">- version update to 8.2.26 [bsc#1233651] [bsc#1233703] [bsc#1233702]
    CLI:
    Fixed bug GH-16373 (Shebang is not skipped for router script in cli-server started through shebang).
    Fixed bug GHSA-4w77-75f9-2c8w (Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface).
    COM:
    Fixed out of bound writes to SafeArray data.
    Core:
    Fixed bug GH-16168 (php 8.1 and earlier crash immediately when compiled with Xcode 16 clang on macOS 15).
    Fixed bug GH-16371 (Assertion failure in Zend/zend_weakrefs.c:646).
    Fixed bug GH-16515 (Incorrect propagation of ZEND_ACC_RETURN_REFERENCE for call trampoline).
    Fixed bug GH-16509 (Incorrect line number in function redeclaration error).
    Fixed bug GH-16508 (Incorrect line number in inheritance errors of delayed early bound classes).
    Fixed bug GH-16648 (Use-after-free during array sorting).
    Curl:
    Fixed bug GH-16302 (CurlMultiHandle holds a reference to CurlHandle if curl_multi_add_handle fails).
    Date:
    Fixed bug GH-16454 (Unhandled INF in date_sunset() with tiny $utcOffset).
    Fixed bug GH-16037 (Assertion failure in ext/date/php_date.c).
    Fixed bug GH-14732 (date_sun_info() fails for non-finite values).
    DBA:
    Fixed bug GH-16390 (dba_open() can segfault for "pathless" streams).
    DOM:
    Fixed bug GH-16316 (DOMXPath breaks when not initialized properly).
    Fixed bug GH-16473 (dom_import_simplexml stub is wrong).
    Fixed bug GH-16533 (Segfault when adding attribute to parent that is not an element).
    Fixed bug GH-16535 (UAF when using document as a child).
    Fixed bug GH-16593 (Assertion failure in DOM-&gt;replaceChild).
    Fixed bug GH-16595 (Another UAF in DOM -&gt; cloneNode).
    EXIF:
    Fixed bug GH-16409 (Segfault in exif_thumbnail when not dealing with a real file).
    FFI:
    Fixed bug GH-16397 (Segmentation fault when comparing FFI object).
    Filter:
    Fixed bug GH-16523 (FILTER_FLAG_HOSTNAME accepts ending hyphen).
    FPM:
    Fixed bug GH-16628 (FPM logs are getting corrupted with this log statement).
    GD:
    Fixed bug GH-16334 (imageaffine overflow on matrix elements).
    Fixed bug GH-16427 (Unchecked libavif return values).
    Fixed bug GH-16559 (UBSan abort in ext/gd/libgd/gd_interpolation.c:1007).
    GMP:
    Fixed floating point exception bug with gmp_pow when using large exposant values. (David Carlier).
    Fixed bug GH-16411 (gmp_export() can cause overflow).
    Fixed bug GH-16501 (gmp_random_bits() can cause overflow).
    Fixed gmp_pow() overflow bug with large base/exponents.
    Fixed segfaults and other issues related to operator overloading with GMP objects.
    LDAP:
    Fixed bug GHSA-g665-fm4p-vhff (OOB access in ldap_escape). (CVE-2024-8932)
    MBstring:
    Fixed bug GH-16361 (mb_substr overflow on start/length arguments).
    MySQLnd:
    Fixed bug GHSA-h35g-vwh6-m678 (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
    OpenSSL:
    Fixed bug GH-16357 (openssl may modify member types of certificate arrays).
    Fixed bug GH-16433 (Large values for openssl_csr_sign() $days overflow).
    Fix various memory leaks on error conditions in openssl_x509_parse().
    PDO DBLIB:
    Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
    PDO Firebird:
    Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
    PDO ODBC:
    Fixed bug GH-16450 (PDO_ODBC can inject garbage into field values).
    Phar:
    Fixed bug GH-16406 (Assertion failure in ext/phar/phar.c:2808).
    PHPDBG:
    Fixed bug GH-16174 (Empty string is an invalid expression for ev).
    Reflection:
    Fixed bug GH-16601 (Memory leak in Reflection constructors).
    Session:
    Fixed bug GH-16385 (Unexpected null returned by session_set_cookie_params).
    Fixed bug GH-16290 (overflow on cookie_lifetime ini value).
    SOAP:
    Fixed bug GH-16429 (Segmentation fault access null pointer in SoapClient).
    Sockets:
    Fixed bug with overflow socket_recvfrom $length argument.
    SPL:
    Fixed bug GH-16337 (Use-after-free in SplHeap).
    Fixed bug GH-16464 (Use-after-free in SplDoublyLinkedList::offsetSet()).
    Fixed bug GH-16479 (Use-after-free in SplObjectStorage::setInfo()).
    Fixed bug GH-16478 (Use-after-free in SplFixedArray::unset()).
    Fixed bug GH-16588 (UAF in Observer-&gt;serialize).
    Fix GH-16477 (Segmentation fault when calling __debugInfo() after failed SplFileObject::__constructor).
    Fixed bug GH-16589 (UAF in SplDoublyLinked-&gt;serialize()).
    Fixed bug GH-14687 (segfault on SplObjectIterator instance).
    Fixed bug GH-16604 (Memory leaks in SPL constructors).
    Fixed bug GH-16646 (UAF in ArrayObject::unset() and ArrayObject::exchangeArray()).
    Standard:
    Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with bail enabled).
    Streams:
    Fixed bug GHSA-c5f2-jwm7-mmq2 (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
    Fixed bug GHSA-r977-prxv-hc43 (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
    SysVMsg:
    Fixed bug GH-16592 (msg_send() crashes when a type does not properly serialized).
    SysVShm:
    Fixed bug GH-16591 (Assertion error in shm_put_var).
    XMLReader:
    Fixed bug GH-16292 (Segmentation fault in ext/xmlreader/php_xmlreader.c).
    Zlib:
    Fixed bug GH-16326 (Memory management is broken for bad dictionaries.) (cmb)
- version update to 8.2.25
    Calendar:
    Fixed GH-16240: jdtounix overflow on argument value.
    Fixed GH-16241: easter_days/easter_date overflow on year argument.
    Fixed GH-16263: jddayofweek overflow.
    Fixed GH-16234: jewishtojd overflow.
    CLI:
    Fixed bug GH-16137: duplicate http headers when set several times by the client.
    Core:
    Fixed bug GH-15712: zend_strtod overflow with precision INI set on large value.
    Fixed bug GH-15905 (Assertion failure for TRACK_VARS_SERVER).
    Fixed bug GH-15907 (Failed assertion when promoting Serialize deprecation to exception).
    Fixed bug GH-15851 (Segfault when printing backtrace during cleanup of nested generator frame).
    Fixed bug GH-15866 (Core dumped in Zend/zend_generators.c).
    Fixed bug GH-16188 (Assertion failure in Zend/zend_exceptions.c).
    Fixed bug GH-16233 (Observer segfault when calling user function in internal function via trampoline).
    Date:
    Fixed bug GH-15582: Crash when not calling parent constructor of DateTimeZone.
    Fixed regression where signs after the first one were ignored while parsing a signed integer, with the DateTimeInterface::modify() function.
    DOM:
    Fixed bug GH-16039 (Segmentation fault (access null pointer) in ext/dom/parentnode/tree.c).
    Fixed bug GH-16151 (Assertion failure in ext/dom/parentnode/tree.c).
    GD:
    Fixed bug GH-16232 (bitshift overflow on wbmp file content reading / fix backport from upstream).
    Fixed bug GH-12264 (overflow/underflow on imagerotate degrees value) (David Carlier)
    Fixed bug GH-16274 (imagescale underflow on RBG channels / fix backport from upstream).
    LDAP:
    Fixed bug GH-16032 (Various NULL pointer dereferencements in ldap_modify_batch()).
    Fixed bug GH-16101 (Segfault in ldap_list(), ldap_read(), and ldap_search() when LDAPs array is not a list).
    Fix GH-16132 (php_ldap_do_modify() attempts to free pointer not allocated by ZMM.).
    Fix GH-16136 (Memory leak in php_ldap_do_modify() when entry is not a proper dictionary).
    MBString:
    Fixed bug GH-16261 (Reference invariant broken in mb_convert_variables()).
    OpenSSL:
    Fixed stub for openssl_csr_new.
    PCRE:
    Fixed bug GH-16189 (underflow on offset argument).
    Fixed bug GH-16184 (UBSan address overflowed in ext/pcre/php_pcre.c).
    PHPDBG:
    Fixed bug GH-15901 (phpdbg: Assertion failure on i funcs).
    Fixed bug GH-16181 (phpdbg: exit in exception handler reports fatal error).
    Reflection:
    Fixed bug GH-16187 (Assertion failure in ext/reflection/php_reflection.c).
    SAPI:
    Fixed bug GH-15395 (php-fpm: zend_mm_heap corrupted with cgi-fcgi request).
    SimpleXML:
    Fixed bug GH-15837 (Segmentation fault in ext/simplexml/simplexml.c).
    Sockets:
    Fixed bug GH-16267 (socket_strerror overflow on errno argument).
    SOAP:
    Fixed bug #62900 (Wrong namespace on xsd import error message).
    Fixed bug GH-16237 (Segmentation fault when cloning SoapServer).
    Fix Soap leaking http_msg on error.
    Fixed bug GH-16256 (Assertion failure in ext/soap/php_encoding.c:460).
    Fixed bug GH-16259 (Soap segfault when classmap instantiation fails).
    Standard:
    Fixed bug GH-15613 (overflow on unpack call hex string repeater).
    Fixed bug GH-15937 (overflow on stream timeout option value).
    Fixed bug GH-16053 (Assertion failure in Zend/zend_hash.c).
    Streams:
    Fixed bugs GH-15908 and GH-15026 (leak / assertion failure in streams.c).
    Fixed bug GH-15980 (Signed integer overflow in main/streams/streams.c).
    TSRM:
    Prevent closing of unrelated handles.
    XML:
    Fixed bug GH-15868 (Assertion failure in xml_parse_into_struct after exception).</changelog>
</package>
<package pkgid="dfc5165c4fe09ee596e4725eabe7e09ff2544fc00484cb99ffd4200dc46420c6" name="apache2-mod_php8" arch="x86_64">
  <version epoch="0" ver="8.2.26" rel="150600.3.9.1"/>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 8.1.20
  * This is a security release.
  * https://www.php.net/ChangeLog-8.php#8.1.20
- force to repack tarball after update
  https://github.com/php/php-src/issues/11300
- session.save_path set to /var/lib/php8/sessions in mod_php8.conf
  and www.conf php-fpm pool example
- modified sources
  % mod_php8.conf
- added sources
  + repack.sh
  + php-unicode-allow-redistribution.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687435200">- version update to 8.2.7
  * Readonly classes
  * Disjunctive Normal Form (DNF) Types
  * Allow null, false, and true as stand-alone types
  * New "Random" extension
  * Constants in traits
  * Deprecate dynamic properties
  * for details, see
    https://www.php.net/releases/8.2/en.php
    https://www.php.net/manual/en/migration82.php
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)
  % php-date-regenerate-lexers.patch (refreshed)
  % php-ini.patch (refreshed)
  % php-systzdata-v23.patch (refreshed)
- CVE-2023-3247 [bsc#1212349]</changelog>
  <changelog author="pgajdos@suse.com" date="1689595200">- version update to 8.2.8
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.8
- modified patches
  % php-sort-filelist-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 8.2.9
  * This is a security release.
  * Fixes CVE-2023-3824 [bsc#1214103] and CVE-2023-3823 [bsc#1214106]
  * https://www.php.net/ChangeLog-8.php#8.2.9
- deleted patches
  - php-unicode-allow-redistribution.patch (upstreamed)
- deleted sources
  - repack.sh (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- version update to 8.2.10
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.10</changelog>
  <changelog author="bwiedemann@suse.com" date="1693569601">- Use %make_build macro</changelog>
  <changelog author="pgajdos@suse.com" date="1695729600">- add missing references to rpm changelog
- 15sp4 only:
  [bsc#1200772], [jsc#SLE-24723] add pecl, pear
  [jsc#SLE-23639] version update</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 8.2.11
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.11</changelog>
  <changelog author="pgajdos@suse.com" date="1698321600">- version update to 8.2.12
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.12</changelog>
  <changelog author="pgajdos@suse.com" date="1700827200">- version update to 8.2.13
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.13</changelog>
  <changelog author="pgajdos@suse.com" date="1704196800">- version update to 8.2.14
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.14</changelog>
  <changelog author="pgajdos@suse.com" date="1705579200">- version update to 8.2.15
  * This is a bug fix release.
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1708084800">- version update to 8.2.16
  * This is a bug fix release.
- modified patches
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pmonreal@suse.com" date="1709726400">- Use the system default cipher list instead of hardcoded values
  by using crypto-policies. [bsc#1211301]
  * Use the --with-system-ciphers configure option.</changelog>
  <changelog author="pgajdos@suse.com" date="1710849600">- version update to 8.2.17
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1712923200">- version update to 8.2.18
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1715256000">- version update to 8.2.19
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1717761600">- version update to 8.2.20
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1728648000">- version update to 8.2.24 [bsc#1231358], [bsc#1231382], [bsc#1231360]
    CGI:
    Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
    Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)
    Core:
    Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer).
    Fixed bug GH-15515 (Configure error grep illegal option q).
    Fixed bug GH-15514 (Configure error: genif.sh: syntax error).
    Fixed bug GH-15565 (--disable-ipv6 during compilation produces error EAI_SYSTEM not found).
    Fixed bug GH-15587 (CRC32 API build error on arm 32-bit).
    Fixed bug GH-15330 (Do not scan generator frames more than once).
    Fixed uninitialized lineno in constant AST of internal enums.
    Curl:
    FIxed bug GH-15547 (curl_multi_select overflow on timeout argument).
    DOM:
    Fixed bug GH-15551 (Segmentation fault (access null pointer) in ext/dom/xml_common.h).
    Fileinfo:
    Fixed bug GH-15752 (Incorrect error message for finfo_file with an empty filename argument).
    FPM:
    Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
    MySQLnd:
    Fixed bug GH-15432 (Heap corruption when querying a vector).
    Opcache:
    Fixed bug GH-15661 (Access null pointer in Zend/Optimizer/zend_inference.c).
    Fixed bug GH-15658 (Segmentation fault in Zend/zend_vm_execute.h).
    SAPI:
    Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
    SOAP:
    Fixed bug #73182 (PHP SOAPClient does not support stream context HTTP headers in array form).
    Standard:
    Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c).
    Streams:
    Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated).
- modified patches
  % php-systzdata-v23.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1732536000">- version update to 8.2.26 [bsc#1233651] [bsc#1233703] [bsc#1233702]
    CLI:
    Fixed bug GH-16373 (Shebang is not skipped for router script in cli-server started through shebang).
    Fixed bug GHSA-4w77-75f9-2c8w (Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface).
    COM:
    Fixed out of bound writes to SafeArray data.
    Core:
    Fixed bug GH-16168 (php 8.1 and earlier crash immediately when compiled with Xcode 16 clang on macOS 15).
    Fixed bug GH-16371 (Assertion failure in Zend/zend_weakrefs.c:646).
    Fixed bug GH-16515 (Incorrect propagation of ZEND_ACC_RETURN_REFERENCE for call trampoline).
    Fixed bug GH-16509 (Incorrect line number in function redeclaration error).
    Fixed bug GH-16508 (Incorrect line number in inheritance errors of delayed early bound classes).
    Fixed bug GH-16648 (Use-after-free during array sorting).
    Curl:
    Fixed bug GH-16302 (CurlMultiHandle holds a reference to CurlHandle if curl_multi_add_handle fails).
    Date:
    Fixed bug GH-16454 (Unhandled INF in date_sunset() with tiny $utcOffset).
    Fixed bug GH-16037 (Assertion failure in ext/date/php_date.c).
    Fixed bug GH-14732 (date_sun_info() fails for non-finite values).
    DBA:
    Fixed bug GH-16390 (dba_open() can segfault for "pathless" streams).
    DOM:
    Fixed bug GH-16316 (DOMXPath breaks when not initialized properly).
    Fixed bug GH-16473 (dom_import_simplexml stub is wrong).
    Fixed bug GH-16533 (Segfault when adding attribute to parent that is not an element).
    Fixed bug GH-16535 (UAF when using document as a child).
    Fixed bug GH-16593 (Assertion failure in DOM-&gt;replaceChild).
    Fixed bug GH-16595 (Another UAF in DOM -&gt; cloneNode).
    EXIF:
    Fixed bug GH-16409 (Segfault in exif_thumbnail when not dealing with a real file).
    FFI:
    Fixed bug GH-16397 (Segmentation fault when comparing FFI object).
    Filter:
    Fixed bug GH-16523 (FILTER_FLAG_HOSTNAME accepts ending hyphen).
    FPM:
    Fixed bug GH-16628 (FPM logs are getting corrupted with this log statement).
    GD:
    Fixed bug GH-16334 (imageaffine overflow on matrix elements).
    Fixed bug GH-16427 (Unchecked libavif return values).
    Fixed bug GH-16559 (UBSan abort in ext/gd/libgd/gd_interpolation.c:1007).
    GMP:
    Fixed floating point exception bug with gmp_pow when using large exposant values. (David Carlier).
    Fixed bug GH-16411 (gmp_export() can cause overflow).
    Fixed bug GH-16501 (gmp_random_bits() can cause overflow).
    Fixed gmp_pow() overflow bug with large base/exponents.
    Fixed segfaults and other issues related to operator overloading with GMP objects.
    LDAP:
    Fixed bug GHSA-g665-fm4p-vhff (OOB access in ldap_escape). (CVE-2024-8932)
    MBstring:
    Fixed bug GH-16361 (mb_substr overflow on start/length arguments).
    MySQLnd:
    Fixed bug GHSA-h35g-vwh6-m678 (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
    OpenSSL:
    Fixed bug GH-16357 (openssl may modify member types of certificate arrays).
    Fixed bug GH-16433 (Large values for openssl_csr_sign() $days overflow).
    Fix various memory leaks on error conditions in openssl_x509_parse().
    PDO DBLIB:
    Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
    PDO Firebird:
    Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
    PDO ODBC:
    Fixed bug GH-16450 (PDO_ODBC can inject garbage into field values).
    Phar:
    Fixed bug GH-16406 (Assertion failure in ext/phar/phar.c:2808).
    PHPDBG:
    Fixed bug GH-16174 (Empty string is an invalid expression for ev).
    Reflection:
    Fixed bug GH-16601 (Memory leak in Reflection constructors).
    Session:
    Fixed bug GH-16385 (Unexpected null returned by session_set_cookie_params).
    Fixed bug GH-16290 (overflow on cookie_lifetime ini value).
    SOAP:
    Fixed bug GH-16429 (Segmentation fault access null pointer in SoapClient).
    Sockets:
    Fixed bug with overflow socket_recvfrom $length argument.
    SPL:
    Fixed bug GH-16337 (Use-after-free in SplHeap).
    Fixed bug GH-16464 (Use-after-free in SplDoublyLinkedList::offsetSet()).
    Fixed bug GH-16479 (Use-after-free in SplObjectStorage::setInfo()).
    Fixed bug GH-16478 (Use-after-free in SplFixedArray::unset()).
    Fixed bug GH-16588 (UAF in Observer-&gt;serialize).
    Fix GH-16477 (Segmentation fault when calling __debugInfo() after failed SplFileObject::__constructor).
    Fixed bug GH-16589 (UAF in SplDoublyLinked-&gt;serialize()).
    Fixed bug GH-14687 (segfault on SplObjectIterator instance).
    Fixed bug GH-16604 (Memory leaks in SPL constructors).
    Fixed bug GH-16646 (UAF in ArrayObject::unset() and ArrayObject::exchangeArray()).
    Standard:
    Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with bail enabled).
    Streams:
    Fixed bug GHSA-c5f2-jwm7-mmq2 (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
    Fixed bug GHSA-r977-prxv-hc43 (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
    SysVMsg:
    Fixed bug GH-16592 (msg_send() crashes when a type does not properly serialized).
    SysVShm:
    Fixed bug GH-16591 (Assertion error in shm_put_var).
    XMLReader:
    Fixed bug GH-16292 (Segmentation fault in ext/xmlreader/php_xmlreader.c).
    Zlib:
    Fixed bug GH-16326 (Memory management is broken for bad dictionaries.) (cmb)
- version update to 8.2.25
    Calendar:
    Fixed GH-16240: jdtounix overflow on argument value.
    Fixed GH-16241: easter_days/easter_date overflow on year argument.
    Fixed GH-16263: jddayofweek overflow.
    Fixed GH-16234: jewishtojd overflow.
    CLI:
    Fixed bug GH-16137: duplicate http headers when set several times by the client.
    Core:
    Fixed bug GH-15712: zend_strtod overflow with precision INI set on large value.
    Fixed bug GH-15905 (Assertion failure for TRACK_VARS_SERVER).
    Fixed bug GH-15907 (Failed assertion when promoting Serialize deprecation to exception).
    Fixed bug GH-15851 (Segfault when printing backtrace during cleanup of nested generator frame).
    Fixed bug GH-15866 (Core dumped in Zend/zend_generators.c).
    Fixed bug GH-16188 (Assertion failure in Zend/zend_exceptions.c).
    Fixed bug GH-16233 (Observer segfault when calling user function in internal function via trampoline).
    Date:
    Fixed bug GH-15582: Crash when not calling parent constructor of DateTimeZone.
    Fixed regression where signs after the first one were ignored while parsing a signed integer, with the DateTimeInterface::modify() function.
    DOM:
    Fixed bug GH-16039 (Segmentation fault (access null pointer) in ext/dom/parentnode/tree.c).
    Fixed bug GH-16151 (Assertion failure in ext/dom/parentnode/tree.c).
    GD:
    Fixed bug GH-16232 (bitshift overflow on wbmp file content reading / fix backport from upstream).
    Fixed bug GH-12264 (overflow/underflow on imagerotate degrees value) (David Carlier)
    Fixed bug GH-16274 (imagescale underflow on RBG channels / fix backport from upstream).
    LDAP:
    Fixed bug GH-16032 (Various NULL pointer dereferencements in ldap_modify_batch()).
    Fixed bug GH-16101 (Segfault in ldap_list(), ldap_read(), and ldap_search() when LDAPs array is not a list).
    Fix GH-16132 (php_ldap_do_modify() attempts to free pointer not allocated by ZMM.).
    Fix GH-16136 (Memory leak in php_ldap_do_modify() when entry is not a proper dictionary).
    MBString:
    Fixed bug GH-16261 (Reference invariant broken in mb_convert_variables()).
    OpenSSL:
    Fixed stub for openssl_csr_new.
    PCRE:
    Fixed bug GH-16189 (underflow on offset argument).
    Fixed bug GH-16184 (UBSan address overflowed in ext/pcre/php_pcre.c).
    PHPDBG:
    Fixed bug GH-15901 (phpdbg: Assertion failure on i funcs).
    Fixed bug GH-16181 (phpdbg: exit in exception handler reports fatal error).
    Reflection:
    Fixed bug GH-16187 (Assertion failure in ext/reflection/php_reflection.c).
    SAPI:
    Fixed bug GH-15395 (php-fpm: zend_mm_heap corrupted with cgi-fcgi request).
    SimpleXML:
    Fixed bug GH-15837 (Segmentation fault in ext/simplexml/simplexml.c).
    Sockets:
    Fixed bug GH-16267 (socket_strerror overflow on errno argument).
    SOAP:
    Fixed bug #62900 (Wrong namespace on xsd import error message).
    Fixed bug GH-16237 (Segmentation fault when cloning SoapServer).
    Fix Soap leaking http_msg on error.
    Fixed bug GH-16256 (Assertion failure in ext/soap/php_encoding.c:460).
    Fixed bug GH-16259 (Soap segfault when classmap instantiation fails).
    Standard:
    Fixed bug GH-15613 (overflow on unpack call hex string repeater).
    Fixed bug GH-15937 (overflow on stream timeout option value).
    Fixed bug GH-16053 (Assertion failure in Zend/zend_hash.c).
    Streams:
    Fixed bugs GH-15908 and GH-15026 (leak / assertion failure in streams.c).
    Fixed bug GH-15980 (Signed integer overflow in main/streams/streams.c).
    TSRM:
    Prevent closing of unrelated handles.
    XML:
    Fixed bug GH-15868 (Assertion failure in xml_parse_into_struct after exception).</changelog>
</package>
<package pkgid="c6e6960e1cb088ac2367ad9a1135dd8af5fd38197665bda0fc814ab3dc51b0d9" name="apache2-mod_uwsgi" arch="aarch64">
  <version epoch="0" ver="2.0.19.1" rel="150400.8.3.1"/>
  <changelog author="michael@stroeder.com" date="1524571200">- Require Apache 2.4.33 for Leap 15 and Tumbleweed
  because otherwise mod_proxy_uwsgi is not available (bsc#1090695)</changelog>
  <changelog author="jfunk@funktronics.ca" date="1527768000">- Don't create a /run directory for Apache on startup. It fails if Apache is
  not installed and sockets are defined per-application anyway (bnc#1082002)
- Fix broken build dependency on Leap 15</changelog>
  <changelog author="michael@stroeder.com" date="1531137600">- update to upstream release 2.0.17.1
  * Fixed memory leak in HTTPS_CLIENT_CERTIFICATE
  * TLSv1 is now disabled by default
  * Improved daemons throttle system
  * Add “secs” log formatting variable
  * Improved snprintf() usage to be OpenBSD-friendly
  * Improved glibc crypt/crypt_r management
  * Fixed websocket pong timeout check
  * Add the “License” classifier to setup.py
  * Add support for php user.ini
  * Official support for Python 3.7</changelog>
  <changelog author="jfunk@funktronics.ca" date="1532347200">- Work around missing include dir in glusterfs pkg-config</changelog>
  <changelog author="michael@stroeder.com" date="1533211200">- Trimmed package description</changelog>
  <changelog author="michael@stroeder.com" date="1549713600">- HTTPS URL for source
- update to upstream release 2.0.18
  * Fixed support for Python 3.7
  * Allow to use autoport (socket :0) with custom socket backlog
  * pyuwsgi ported to python3
  * pyuwsgi packages fixes
  * pyuwsginossl build configuration for building pyuwsgi without ssl support
  * Fix unix socket inheritance after reload on FreeBSD
  * Fix crashes with --wsgi-env-behavior=holy (#1950)
  * Fix invalid free in python plugin (#1942)
  * Fix compilation warnings with gcc-8 (#1819)
  * Fix spooler python references
  * Don't generate build warnings in systemd_logger
  * Fix segmentation fault during worker shutdown (#1651)</changelog>
  <changelog author="jfunk@funktronics.ca" date="1552737600">- Add patch uwsgi-2.0.18-postgresql-config.patch to use pkg-config
  instead of pg_config as it was removed in postgres11-devel</changelog>
  <changelog author="9+suse@cirno.systems" date="1556625600">- Fix systemd kill signal (uwsgi does not die on SIGTERM)
- Add reload command to systemd service</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="pgajdos@suse.com" date="1583755200">- disable geoip plugin [bsc#1156199]</changelog>
  <changelog author="jfunk@funktronics.ca" date="1589630400">- Fix greenlet dependency for Python 3
- Use explicit Python macros</changelog>
  <changelog author="jfunk@funktronics.ca" date="1591617600">- Fix duplicate uperl in psgi plugin with wth gcc 10 (uwsgi-2.0.18-psgi-fix-duplicate-uperl.patch)</changelog>
  <changelog author="asn@cryptomilk.org" date="1599652800">- Use %license for the LICENSE</changelog>
  <changelog author="asn@cryptomilk.org" date="1599652801">- Add systemd tmpfile.d config to create /run/uwsgi</changelog>
  <changelog author="dmueller@suse.com" date="1606392000">- update 2.0.19.1:
  * Reverted CGI chunked encoding support
  * Fixed bug with WSGI responses returning
  * Update travis to xenial (Terence D. Honles)
  * Fix segfault in logsocket plugin (Riccardo Magliocchetti, #2010)
  * Backport Coverity fixes from master (Riccardo Magliocchetti)
  * Fix Python 3.7 warnings (Orivej Desh)
  * Fix uwsgi.workers() leak in Python plugin (Arne Welzel, #2056)
  * Backport redislog plugin 32-bit build fixes (Riccardo Magliocchetti, #1828)
  * Fix stack overflow in core/rpc (Nicola Martino)
  * Fix build with spaces in the path (Arne Welzel, #1939)
  * Add missing initialization for zend_file_handle in php plugin (Arne Welzel)
  * Build Python 3.7 and 3.8 plugins in CI (Arne Welzel)
  * Add Trove classifiers for Python 3.7 and 3.8 (Hugo)
  * Graceful shutdown for vassals (Sponsored by guppyltd.com)
  * Improve yaml parsing with libyaml (Arne Welzel, #2097)
  * Add smart-daemon2 option to notify daemon of master reloading (Eduardo Felipe Castegnaro)
  * Do not chroot multiple times when root (Arne Welzel)
  * Support io.BytesIO with wsgi.file_wrapper (Arne Welzel, #1126)
  * Add websocket continuation frames support (Timi, #1350)
  * Fix compilation with gevent 1.5.0 (Vytautas Liuolia)
  * Fix PSGI plugin build with gcc 10 (Jorge Gallegos)
  * Get rid of paste.script dependency in pypy/python plugins (Thomas De Schampheleire)
  * Improve performance for santitizing file descriptors with cgi plugin (Natanael Copa, #2053)
  * Fix offload-threads with honour-range (Liss Tarnell)
  * Fix logging packet size length overflow (Pawel Marokwsi)
  * Fix possible deadlock in install (Jacob Tolar)
  * Fix parsing of http port for ipv6 (Cyril Baÿ)
  * Fix impossibility of determining the end of the chunked stream with psgi plugin (ols)
  * Fix parsing of http-socket port for ipv6 (Daniel Holth)
  * Add chunked request decoding to the CGI plugin (Robert Schindler)
  * Add add max-worker-lifetime-delta to reload workers with a delta (Marcin Lulek , #2020)
- remove uwsgi-2.0.18-psgi-fix-duplicate-uperl.patch (upstream)</changelog>
  <changelog author="pgajdos@suse.com" date="1606824000">- use system apache rpm macros</changelog>
  <changelog author="schwab@suse.de" date="1607688000">- Fix logic handling v8 plugin</changelog>
  <changelog author="pgajdos@suse.com" date="1633003200">- do not require python2, drop python plugin [bsc#1191174]</changelog>
  <changelog author="pgajdos@suse.com" date="1633608000">- greenlet and gevent plugins require uwsgi-python3 instead of
  uwsgi-python</changelog>
  <changelog author="pgajdos@suse.com" date="1730289600">- security update
- added patches
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + uwsgi-CVE-2024-24795.patch</changelog>
</package>
<package pkgid="fc2bac192bcdab1e6c8cfcbad9939aefd38b285aaa511b2b650575ccab87ff3a" name="apache2-mod_uwsgi" arch="ppc64le">
  <version epoch="0" ver="2.0.19.1" rel="150400.8.3.1"/>
  <changelog author="michael@stroeder.com" date="1524571200">- Require Apache 2.4.33 for Leap 15 and Tumbleweed
  because otherwise mod_proxy_uwsgi is not available (bsc#1090695)</changelog>
  <changelog author="jfunk@funktronics.ca" date="1527768000">- Don't create a /run directory for Apache on startup. It fails if Apache is
  not installed and sockets are defined per-application anyway (bnc#1082002)
- Fix broken build dependency on Leap 15</changelog>
  <changelog author="michael@stroeder.com" date="1531137600">- update to upstream release 2.0.17.1
  * Fixed memory leak in HTTPS_CLIENT_CERTIFICATE
  * TLSv1 is now disabled by default
  * Improved daemons throttle system
  * Add “secs” log formatting variable
  * Improved snprintf() usage to be OpenBSD-friendly
  * Improved glibc crypt/crypt_r management
  * Fixed websocket pong timeout check
  * Add the “License” classifier to setup.py
  * Add support for php user.ini
  * Official support for Python 3.7</changelog>
  <changelog author="jfunk@funktronics.ca" date="1532347200">- Work around missing include dir in glusterfs pkg-config</changelog>
  <changelog author="michael@stroeder.com" date="1533211200">- Trimmed package description</changelog>
  <changelog author="michael@stroeder.com" date="1549713600">- HTTPS URL for source
- update to upstream release 2.0.18
  * Fixed support for Python 3.7
  * Allow to use autoport (socket :0) with custom socket backlog
  * pyuwsgi ported to python3
  * pyuwsgi packages fixes
  * pyuwsginossl build configuration for building pyuwsgi without ssl support
  * Fix unix socket inheritance after reload on FreeBSD
  * Fix crashes with --wsgi-env-behavior=holy (#1950)
  * Fix invalid free in python plugin (#1942)
  * Fix compilation warnings with gcc-8 (#1819)
  * Fix spooler python references
  * Don't generate build warnings in systemd_logger
  * Fix segmentation fault during worker shutdown (#1651)</changelog>
  <changelog author="jfunk@funktronics.ca" date="1552737600">- Add patch uwsgi-2.0.18-postgresql-config.patch to use pkg-config
  instead of pg_config as it was removed in postgres11-devel</changelog>
  <changelog author="9+suse@cirno.systems" date="1556625600">- Fix systemd kill signal (uwsgi does not die on SIGTERM)
- Add reload command to systemd service</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="pgajdos@suse.com" date="1583755200">- disable geoip plugin [bsc#1156199]</changelog>
  <changelog author="jfunk@funktronics.ca" date="1589630400">- Fix greenlet dependency for Python 3
- Use explicit Python macros</changelog>
  <changelog author="jfunk@funktronics.ca" date="1591617600">- Fix duplicate uperl in psgi plugin with wth gcc 10 (uwsgi-2.0.18-psgi-fix-duplicate-uperl.patch)</changelog>
  <changelog author="asn@cryptomilk.org" date="1599652800">- Use %license for the LICENSE</changelog>
  <changelog author="asn@cryptomilk.org" date="1599652801">- Add systemd tmpfile.d config to create /run/uwsgi</changelog>
  <changelog author="dmueller@suse.com" date="1606392000">- update 2.0.19.1:
  * Reverted CGI chunked encoding support
  * Fixed bug with WSGI responses returning
  * Update travis to xenial (Terence D. Honles)
  * Fix segfault in logsocket plugin (Riccardo Magliocchetti, #2010)
  * Backport Coverity fixes from master (Riccardo Magliocchetti)
  * Fix Python 3.7 warnings (Orivej Desh)
  * Fix uwsgi.workers() leak in Python plugin (Arne Welzel, #2056)
  * Backport redislog plugin 32-bit build fixes (Riccardo Magliocchetti, #1828)
  * Fix stack overflow in core/rpc (Nicola Martino)
  * Fix build with spaces in the path (Arne Welzel, #1939)
  * Add missing initialization for zend_file_handle in php plugin (Arne Welzel)
  * Build Python 3.7 and 3.8 plugins in CI (Arne Welzel)
  * Add Trove classifiers for Python 3.7 and 3.8 (Hugo)
  * Graceful shutdown for vassals (Sponsored by guppyltd.com)
  * Improve yaml parsing with libyaml (Arne Welzel, #2097)
  * Add smart-daemon2 option to notify daemon of master reloading (Eduardo Felipe Castegnaro)
  * Do not chroot multiple times when root (Arne Welzel)
  * Support io.BytesIO with wsgi.file_wrapper (Arne Welzel, #1126)
  * Add websocket continuation frames support (Timi, #1350)
  * Fix compilation with gevent 1.5.0 (Vytautas Liuolia)
  * Fix PSGI plugin build with gcc 10 (Jorge Gallegos)
  * Get rid of paste.script dependency in pypy/python plugins (Thomas De Schampheleire)
  * Improve performance for santitizing file descriptors with cgi plugin (Natanael Copa, #2053)
  * Fix offload-threads with honour-range (Liss Tarnell)
  * Fix logging packet size length overflow (Pawel Marokwsi)
  * Fix possible deadlock in install (Jacob Tolar)
  * Fix parsing of http port for ipv6 (Cyril Baÿ)
  * Fix impossibility of determining the end of the chunked stream with psgi plugin (ols)
  * Fix parsing of http-socket port for ipv6 (Daniel Holth)
  * Add chunked request decoding to the CGI plugin (Robert Schindler)
  * Add add max-worker-lifetime-delta to reload workers with a delta (Marcin Lulek , #2020)
- remove uwsgi-2.0.18-psgi-fix-duplicate-uperl.patch (upstream)</changelog>
  <changelog author="pgajdos@suse.com" date="1606824000">- use system apache rpm macros</changelog>
  <changelog author="schwab@suse.de" date="1607688000">- Fix logic handling v8 plugin</changelog>
  <changelog author="pgajdos@suse.com" date="1633003200">- do not require python2, drop python plugin [bsc#1191174]</changelog>
  <changelog author="pgajdos@suse.com" date="1633608000">- greenlet and gevent plugins require uwsgi-python3 instead of
  uwsgi-python</changelog>
  <changelog author="pgajdos@suse.com" date="1730289600">- security update
- added patches
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + uwsgi-CVE-2024-24795.patch</changelog>
</package>
<package pkgid="bac64ff0ee3e1d5f1fe78115e0e04c603f2aef7da9ef639343024f2d022b22de" name="apache2-mod_uwsgi" arch="s390x">
  <version epoch="0" ver="2.0.19.1" rel="150400.8.3.1"/>
  <changelog author="michael@stroeder.com" date="1524571200">- Require Apache 2.4.33 for Leap 15 and Tumbleweed
  because otherwise mod_proxy_uwsgi is not available (bsc#1090695)</changelog>
  <changelog author="jfunk@funktronics.ca" date="1527768000">- Don't create a /run directory for Apache on startup. It fails if Apache is
  not installed and sockets are defined per-application anyway (bnc#1082002)
- Fix broken build dependency on Leap 15</changelog>
  <changelog author="michael@stroeder.com" date="1531137600">- update to upstream release 2.0.17.1
  * Fixed memory leak in HTTPS_CLIENT_CERTIFICATE
  * TLSv1 is now disabled by default
  * Improved daemons throttle system
  * Add “secs” log formatting variable
  * Improved snprintf() usage to be OpenBSD-friendly
  * Improved glibc crypt/crypt_r management
  * Fixed websocket pong timeout check
  * Add the “License” classifier to setup.py
  * Add support for php user.ini
  * Official support for Python 3.7</changelog>
  <changelog author="jfunk@funktronics.ca" date="1532347200">- Work around missing include dir in glusterfs pkg-config</changelog>
  <changelog author="michael@stroeder.com" date="1533211200">- Trimmed package description</changelog>
  <changelog author="michael@stroeder.com" date="1549713600">- HTTPS URL for source
- update to upstream release 2.0.18
  * Fixed support for Python 3.7
  * Allow to use autoport (socket :0) with custom socket backlog
  * pyuwsgi ported to python3
  * pyuwsgi packages fixes
  * pyuwsginossl build configuration for building pyuwsgi without ssl support
  * Fix unix socket inheritance after reload on FreeBSD
  * Fix crashes with --wsgi-env-behavior=holy (#1950)
  * Fix invalid free in python plugin (#1942)
  * Fix compilation warnings with gcc-8 (#1819)
  * Fix spooler python references
  * Don't generate build warnings in systemd_logger
  * Fix segmentation fault during worker shutdown (#1651)</changelog>
  <changelog author="jfunk@funktronics.ca" date="1552737600">- Add patch uwsgi-2.0.18-postgresql-config.patch to use pkg-config
  instead of pg_config as it was removed in postgres11-devel</changelog>
  <changelog author="9+suse@cirno.systems" date="1556625600">- Fix systemd kill signal (uwsgi does not die on SIGTERM)
- Add reload command to systemd service</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="pgajdos@suse.com" date="1583755200">- disable geoip plugin [bsc#1156199]</changelog>
  <changelog author="jfunk@funktronics.ca" date="1589630400">- Fix greenlet dependency for Python 3
- Use explicit Python macros</changelog>
  <changelog author="jfunk@funktronics.ca" date="1591617600">- Fix duplicate uperl in psgi plugin with wth gcc 10 (uwsgi-2.0.18-psgi-fix-duplicate-uperl.patch)</changelog>
  <changelog author="asn@cryptomilk.org" date="1599652800">- Use %license for the LICENSE</changelog>
  <changelog author="asn@cryptomilk.org" date="1599652801">- Add systemd tmpfile.d config to create /run/uwsgi</changelog>
  <changelog author="dmueller@suse.com" date="1606392000">- update 2.0.19.1:
  * Reverted CGI chunked encoding support
  * Fixed bug with WSGI responses returning
  * Update travis to xenial (Terence D. Honles)
  * Fix segfault in logsocket plugin (Riccardo Magliocchetti, #2010)
  * Backport Coverity fixes from master (Riccardo Magliocchetti)
  * Fix Python 3.7 warnings (Orivej Desh)
  * Fix uwsgi.workers() leak in Python plugin (Arne Welzel, #2056)
  * Backport redislog plugin 32-bit build fixes (Riccardo Magliocchetti, #1828)
  * Fix stack overflow in core/rpc (Nicola Martino)
  * Fix build with spaces in the path (Arne Welzel, #1939)
  * Add missing initialization for zend_file_handle in php plugin (Arne Welzel)
  * Build Python 3.7 and 3.8 plugins in CI (Arne Welzel)
  * Add Trove classifiers for Python 3.7 and 3.8 (Hugo)
  * Graceful shutdown for vassals (Sponsored by guppyltd.com)
  * Improve yaml parsing with libyaml (Arne Welzel, #2097)
  * Add smart-daemon2 option to notify daemon of master reloading (Eduardo Felipe Castegnaro)
  * Do not chroot multiple times when root (Arne Welzel)
  * Support io.BytesIO with wsgi.file_wrapper (Arne Welzel, #1126)
  * Add websocket continuation frames support (Timi, #1350)
  * Fix compilation with gevent 1.5.0 (Vytautas Liuolia)
  * Fix PSGI plugin build with gcc 10 (Jorge Gallegos)
  * Get rid of paste.script dependency in pypy/python plugins (Thomas De Schampheleire)
  * Improve performance for santitizing file descriptors with cgi plugin (Natanael Copa, #2053)
  * Fix offload-threads with honour-range (Liss Tarnell)
  * Fix logging packet size length overflow (Pawel Marokwsi)
  * Fix possible deadlock in install (Jacob Tolar)
  * Fix parsing of http port for ipv6 (Cyril Baÿ)
  * Fix impossibility of determining the end of the chunked stream with psgi plugin (ols)
  * Fix parsing of http-socket port for ipv6 (Daniel Holth)
  * Add chunked request decoding to the CGI plugin (Robert Schindler)
  * Add add max-worker-lifetime-delta to reload workers with a delta (Marcin Lulek , #2020)
- remove uwsgi-2.0.18-psgi-fix-duplicate-uperl.patch (upstream)</changelog>
  <changelog author="pgajdos@suse.com" date="1606824000">- use system apache rpm macros</changelog>
  <changelog author="schwab@suse.de" date="1607688000">- Fix logic handling v8 plugin</changelog>
  <changelog author="pgajdos@suse.com" date="1633003200">- do not require python2, drop python plugin [bsc#1191174]</changelog>
  <changelog author="pgajdos@suse.com" date="1633608000">- greenlet and gevent plugins require uwsgi-python3 instead of
  uwsgi-python</changelog>
  <changelog author="pgajdos@suse.com" date="1730289600">- security update
- added patches
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + uwsgi-CVE-2024-24795.patch</changelog>
</package>
<package pkgid="9dfbcb88b06eb86822b1f0bcebdb260139084823e21473895ebd5f8885f5fe9b" name="apache2-mod_uwsgi" arch="x86_64">
  <version epoch="0" ver="2.0.19.1" rel="150400.8.3.1"/>
  <changelog author="michael@stroeder.com" date="1524571200">- Require Apache 2.4.33 for Leap 15 and Tumbleweed
  because otherwise mod_proxy_uwsgi is not available (bsc#1090695)</changelog>
  <changelog author="jfunk@funktronics.ca" date="1527768000">- Don't create a /run directory for Apache on startup. It fails if Apache is
  not installed and sockets are defined per-application anyway (bnc#1082002)
- Fix broken build dependency on Leap 15</changelog>
  <changelog author="michael@stroeder.com" date="1531137600">- update to upstream release 2.0.17.1
  * Fixed memory leak in HTTPS_CLIENT_CERTIFICATE
  * TLSv1 is now disabled by default
  * Improved daemons throttle system
  * Add “secs” log formatting variable
  * Improved snprintf() usage to be OpenBSD-friendly
  * Improved glibc crypt/crypt_r management
  * Fixed websocket pong timeout check
  * Add the “License” classifier to setup.py
  * Add support for php user.ini
  * Official support for Python 3.7</changelog>
  <changelog author="jfunk@funktronics.ca" date="1532347200">- Work around missing include dir in glusterfs pkg-config</changelog>
  <changelog author="michael@stroeder.com" date="1533211200">- Trimmed package description</changelog>
  <changelog author="michael@stroeder.com" date="1549713600">- HTTPS URL for source
- update to upstream release 2.0.18
  * Fixed support for Python 3.7
  * Allow to use autoport (socket :0) with custom socket backlog
  * pyuwsgi ported to python3
  * pyuwsgi packages fixes
  * pyuwsginossl build configuration for building pyuwsgi without ssl support
  * Fix unix socket inheritance after reload on FreeBSD
  * Fix crashes with --wsgi-env-behavior=holy (#1950)
  * Fix invalid free in python plugin (#1942)
  * Fix compilation warnings with gcc-8 (#1819)
  * Fix spooler python references
  * Don't generate build warnings in systemd_logger
  * Fix segmentation fault during worker shutdown (#1651)</changelog>
  <changelog author="jfunk@funktronics.ca" date="1552737600">- Add patch uwsgi-2.0.18-postgresql-config.patch to use pkg-config
  instead of pg_config as it was removed in postgres11-devel</changelog>
  <changelog author="9+suse@cirno.systems" date="1556625600">- Fix systemd kill signal (uwsgi does not die on SIGTERM)
- Add reload command to systemd service</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="pgajdos@suse.com" date="1583755200">- disable geoip plugin [bsc#1156199]</changelog>
  <changelog author="jfunk@funktronics.ca" date="1589630400">- Fix greenlet dependency for Python 3
- Use explicit Python macros</changelog>
  <changelog author="jfunk@funktronics.ca" date="1591617600">- Fix duplicate uperl in psgi plugin with wth gcc 10 (uwsgi-2.0.18-psgi-fix-duplicate-uperl.patch)</changelog>
  <changelog author="asn@cryptomilk.org" date="1599652800">- Use %license for the LICENSE</changelog>
  <changelog author="asn@cryptomilk.org" date="1599652801">- Add systemd tmpfile.d config to create /run/uwsgi</changelog>
  <changelog author="dmueller@suse.com" date="1606392000">- update 2.0.19.1:
  * Reverted CGI chunked encoding support
  * Fixed bug with WSGI responses returning
  * Update travis to xenial (Terence D. Honles)
  * Fix segfault in logsocket plugin (Riccardo Magliocchetti, #2010)
  * Backport Coverity fixes from master (Riccardo Magliocchetti)
  * Fix Python 3.7 warnings (Orivej Desh)
  * Fix uwsgi.workers() leak in Python plugin (Arne Welzel, #2056)
  * Backport redislog plugin 32-bit build fixes (Riccardo Magliocchetti, #1828)
  * Fix stack overflow in core/rpc (Nicola Martino)
  * Fix build with spaces in the path (Arne Welzel, #1939)
  * Add missing initialization for zend_file_handle in php plugin (Arne Welzel)
  * Build Python 3.7 and 3.8 plugins in CI (Arne Welzel)
  * Add Trove classifiers for Python 3.7 and 3.8 (Hugo)
  * Graceful shutdown for vassals (Sponsored by guppyltd.com)
  * Improve yaml parsing with libyaml (Arne Welzel, #2097)
  * Add smart-daemon2 option to notify daemon of master reloading (Eduardo Felipe Castegnaro)
  * Do not chroot multiple times when root (Arne Welzel)
  * Support io.BytesIO with wsgi.file_wrapper (Arne Welzel, #1126)
  * Add websocket continuation frames support (Timi, #1350)
  * Fix compilation with gevent 1.5.0 (Vytautas Liuolia)
  * Fix PSGI plugin build with gcc 10 (Jorge Gallegos)
  * Get rid of paste.script dependency in pypy/python plugins (Thomas De Schampheleire)
  * Improve performance for santitizing file descriptors with cgi plugin (Natanael Copa, #2053)
  * Fix offload-threads with honour-range (Liss Tarnell)
  * Fix logging packet size length overflow (Pawel Marokwsi)
  * Fix possible deadlock in install (Jacob Tolar)
  * Fix parsing of http port for ipv6 (Cyril Baÿ)
  * Fix impossibility of determining the end of the chunked stream with psgi plugin (ols)
  * Fix parsing of http-socket port for ipv6 (Daniel Holth)
  * Add chunked request decoding to the CGI plugin (Robert Schindler)
  * Add add max-worker-lifetime-delta to reload workers with a delta (Marcin Lulek , #2020)
- remove uwsgi-2.0.18-psgi-fix-duplicate-uperl.patch (upstream)</changelog>
  <changelog author="pgajdos@suse.com" date="1606824000">- use system apache rpm macros</changelog>
  <changelog author="schwab@suse.de" date="1607688000">- Fix logic handling v8 plugin</changelog>
  <changelog author="pgajdos@suse.com" date="1633003200">- do not require python2, drop python plugin [bsc#1191174]</changelog>
  <changelog author="pgajdos@suse.com" date="1633608000">- greenlet and gevent plugins require uwsgi-python3 instead of
  uwsgi-python</changelog>
  <changelog author="pgajdos@suse.com" date="1730289600">- security update
- added patches
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + uwsgi-CVE-2024-24795.patch</changelog>
</package>
<package pkgid="6e25bf738b38e53b20a1a7387236a57303328cf6ab6e80bd9dd804f0ccebac08" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="d2f7a4324cf0ff564a253ce91edc9408bf08ef782c02449b7d6c8532f051af30" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="7a2414e55a8bebfe4bc736b770381fe8712c7e53d2f98e7b9cd405c33afc6e61" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="6a34ef30dba324734ea427d327dd3f0710fa2e300f3c6cc08d31dbc439cc748a" name="apache2-prefork" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="5032d2b1b10eb7263d2cfb456986f6a4091f9143b1e367c4f01a12cb58e1fd1f" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="b85636e6a09996b99f7e7dbe059aafdbd144fc71d3d8eab659f9e1dd96fb9355" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="0f35ea8c22fe40a7dfd015d6ed5d444da1248155ecc7c8ae252cac9d394759d6" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="00c11c2bc71f759330642465ce0fba84d6d332f56f5e929ccba31b532276a2f5" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="91ce02e4d983ff563c4a6c67c6f86bc9f8fe26f41452d77c972cc0baaa01d35b" name="apache2-prefork" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="dd733512bca30fbf80764f997d03c64527cf9712678aa91359fd2c2eeba3e7fd" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="fe9051e2840ac1fbb49b5eb6d14a5861cc0b883fab63cdc224b6c34188e3cc8f" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="961496a57bff7a3e6193ee089bd8e56191e7a9d929660c08c69f3115d470eba0" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="547b2c1738d11d9b8d1af0c77511b03e180f02361c619ad409fbfb8970bf6377" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="8e0d10659f1d155a4a1c4eb8de6eb444784945b676930cd782898f42ab8d4713" name="apache2-prefork" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="df6c116da89c23ca854349e4fe8e86b3ad5a9197b9669b8c2d33329582d062e6" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="1caea75b1e90d358c7d306d5c24a2295824999b62fb56cb5cf1cdbf3131efa3b" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="da6dbb550aa26b4de335e46880648ee3be6b9239f33a5c8ed2b6911ead869e91" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="5ccfcecf3502a2419381306e63e38ca6abfa5d1cf6e98ef9117c10d56662ff52" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="da9a590cd95ff01f2f9364dc674d7b84a368bee4ca144245591d608853f80788" name="apache2-prefork" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="c783fdcc3d745981a93e4f1f37c5900c4b16e113b87f5cc4f257a181e24a754c" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="d27c8cf557fb3d14b39c1dee194a7a0b354bc4c3d8ce3a94aeab1e15664a184e" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="c47abb09cbdcee35c99abc1ce3dd884bc2d4f61e3f11c2df99e4bb52bae153da" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="5d3c6fd81228614733af99000aaa5d8205381e218c2919d143f8cd23dfa35035" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="1e8f4c34fcc167c0dcd6fab23f45824b84ce847dd5104fd923fcee3f5eb81233" name="apache2-prefork" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="77e64128b95b291fcdc9d6ac75aaf4fc33f60e0c9776dcb51b6bfb541ba2de19" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="7c0bd73eff38078e9ebe517417ad5ffc74b04e9a37c4e2575bb9f6a498dc9f54" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="81a16f77bbdaa0ab9ec37a0fedef5453e2ec4d75a7bf25208819efb2cd9d2da3" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="cd78c6b4ff51a64591d00e964683ba5092c679a3849504bdc8d3e15a279b83e0" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="68bb0d8cd8e45293cfcd6cf1281b3a118ed3c6981e95bfe609365de6065cfdb4" name="apache2-prefork" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="ec22b75e50852b2a307de1c6fd0595237abe83b8d674ee20890e2568c5f9cab1" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="8545bbdf1abe13de15d108aa93282ae0cf16ce442837916df24b1a6e64a26204" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="4f1b08be218d12b5810272c608636353df165818a3e0967713c3770651a0b70b" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="40dbb9dff0e317489c38f1487173aa0e7a2b543587be18a62888d73e8136b870" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="54f207aaacc185b2de481016468ee1803226b17822a99da476c446ee53d5d3e6" name="apache2-prefork" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="d88e39711cbe67e6648bf2e81ac30ba76d68ca0833a8ede79792cf89d2fe160f" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="5c04e3700eac46695a8fc1221f74caf62b42b9b7cca6df8f304edd02bddec3ca" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="04a8d12875979c7b6718428aa3fb09365dd6bf3752fadebbbf419045ab9b6598" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="44d594709e2351d7d4ec7cb9cdf8e6e42950f91377585559a135995d9534f0db" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="224cf38f7d5359cf0d1549bde2dd70af4c07f135afd2be058fe96d00010db238" name="apache2-utils" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="dfea0b38ec45adfc766b2446e1578289764dd590575ef03d96403cb53eedc423" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="964fbba0c70ac65026a010cff1ceb214cab67a3bdea975258e33c55ba846da32" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="2c7793cf792fcbf1e9c46dca8aa5d5e743c1dd73f247aa5865eedb2372ebed52" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="61458cd8676e14c65953a7faca9528c077bae85248dfaaa160ffa7e7e4eac9cf" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="90f4ba98371e8f1ad39502a6abf3fd33b074152e1711abe8090e4471357cc36b" name="apache2-utils" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="1603e046e45cdf52c413493bbb272c87d2e3a4d5ded15239355e31f8ca4c61a0" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="0d7a2aec0fdb275581845b893302d7a5ee63f1aa437e983510868f88520ea6be" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="48bfcdd0f9ed1860e29f2655397b727c8efe92b86a4b37e648ab4e7e4effdd83" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="ce1c28331a234e0207098878f13f8226adc7cf83964044c5aa692b82deb79316" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="a1af6af59ff36685f4d2c29ee548c30ec00491df26a3a3a540988157c26e8ba5" name="apache2-utils" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="631cb909174aa18e85a20b8a78c84879f0417d57d3cda1872aeb4ccfde3b98f6" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="1189716273fcf2d38666661b913bc5b202f637e40296b1c37c3cfdc7664420ca" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="bf5262701d32a8ef39ec68606a98c72156ec1cd286e09e78389c3b2a83bf1741" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="4113c0b9b2068ead0e166d82f92e181d6198a94b123e07959885043910eb932d" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="af7eb83fa68815966ef3fe7b98cd9c57813ae3cae2481604835e5f780ccbb209" name="apache2-utils" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="84acd613df0c41d123a75778f92f1efe79d212b9576ca85373cb8b209a70d9cb" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="be1ef16756e098579769e22edb4ef2eaa0774e7fa67f31fc7b721b510129cd80" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="f302bb33b0b705c197a4c67791ee5fe34177736df17240fd75616d716a2056b4" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="3c3ac1117cc0e0b09a7c5ac80aa3136c60323e805330cfae339a340726dd7d72" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="9fec4820503cf987597f53e74bfb113e971aaed726602754f6885ae8f7f08354" name="apache2-utils" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="721fb3fcaed96747d6c7afda37fe05722092cfb21f041d2be4230e7a4896bda6" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="fbedcf3c24ed930ca224932812bc143d934568ae6a407aa9eaf34bf3ea334b27" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="1e0d00a25ddacc263f6dfbf1c29ddd11353897d8ce62f20d496a0d6dbec418df" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="9fedeff7299705ca16bb250136f2073670c5b3d250b173c721f1358a786766ba" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="28ae75d83b4decfeeb68a6886167cb0eee7aebba8a33f027363841562089a4e7" name="apache2-utils" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="feb27f065f37dc1a607bd2333c2b29f81b2ab3cf8f78d9c8d279b8f86ebd69a1" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="aab3fb1f5cf97de499c27bb61382d7547aba780bf7644d25237383c7df2034f4" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="63068febfc25e1c162aedfb8faf3d1854f0efd9648a4235056728df021fae4f0" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="740e3b92b6fe6daaaca7f0992323ec8b0ff293b6ea366f4ff00de0f085ffe82e" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="9b7c2c4cb2214eb8d35639da88a682a154c9420615b3772c6334a9b0c27a11d4" name="apache2-utils" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="91dc0b9bd759df2c3ca6b61cfa5a10d89a63e7b7cc07bbe475c58e983243b838" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="44935b0644efd1d4b3c12573054ea0e5389ec556dccf79079c94e646c3d0a6dd" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="d7c67bfcf1032e63dd2bbccae358ba5829c6c8d423e2130d45e03e293eded569" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="4b85dc672bce07349c4ceb285fccaa8692a855aade0d2144326fa4d6b19e5843" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="7b5936f6f4e6e87773e4b7a257005e3697dccdfeef74f29e790085a6870b3a43" name="apache2-worker" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="a213bb89087f6ad7a33083ddab40903f9b3889e876b270e0ff2deeadfdc9c86c" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="1aeed45aa3e63fbb675a939cac5ad12fc09d94ce519dc25d22cae365cb5523e7" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="55c6a60e867395e038c3cfe50d35c4238197011836afb6e7d2b7cc92ca14cb35" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="aba8939de85b70c396421af174793c047c6065ed33f6be913d8e631eb232c1ac" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="4c512c6d38bd0a64fec4d91fad90fa8d6318f441473cbeb8412bc69e0b75592f" name="apache2-worker" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="df2cb9c37adc1e0f850a47451cb6e10e39fc9dad756f1dc5706262810f098bf2" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="a3d99b5d822ac834fc9c787c11301454793b1ba3fa592cb0f3b78ca3749fad27" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="3e27dc8e301ca6773f995517f298da845fff3beae19f64785d5824f4adb2e4f3" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="ff601e7a981c7156be8b7c4e7eb6c52cadd3811e5f9b791edb3efe6626add93b" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="4d547be5141f18ca976f59f2ab6961191720373843ea55df719147fed3121240" name="apache2-worker" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="89caeaa159677f59a51497a1ac178ce76fe9042a8cb3bc4a3dda749742ccc070" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="1038e7c71f5bf430a96ddeaae79193f892e6338c3f866041166681b702e32a74" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="2025accf5ceaf6c171882ea8b0430e7d346a610df4c07d850b49fffa1fc1be0b" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="30eb08e060f343c98655833e5fc3e311b3102d42841713395ee2388c1d9c8eb8" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="fd97b8a6d0b5925854b4b128373a78a7d28a4b37febfa919dbaa1da48beb7605" name="apache2-worker" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="37bc6b2737afa02ab2371c9ad9dee43074e8d778bd939a340ff3d7ba464c156c" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="2219070896162ffb365713d0d07ff23b0f3ea272880fdb1b9115deed6d07e21e" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="6e1cb945e7e587159a70ec68590d1ae5272b330ca6f32529e80bca21533fdb58" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="a939fae8b7e544435d637eda1c57cd508f5bbb4f7f27237c3e1a6fbbf8ce0fec" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="d7333a8a8c80c161c6b9b29433d923f414d1b567fb9456d56f51cb552ac0495c" name="apache2-worker" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="cc69b32e6169f45f005caef8c59d47b2dec31612db77c54d0ee583a7027183c1" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="f94099fe6963011f966b7ac44fc46b7d3f1466325cdbcae504616b915c052baa" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="b22d0ef518c74436179935bbccd0aaee109fa51251d71a1eeb48c78fa208c998" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="16ba9c6aacb1f0548c851c96795d0c97b3f6822ee090a92a567776e97fe47ee8" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="483677221d7482734693fa90f4446342e35ad49ae9b6675202a3c7725d6cb6e1" name="apache2-worker" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="d0bff62eb8cbc819354ea996bc05929e6f3e1c4872c07abc22239c890925bf7a" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="c7f57b2674f172891fe2d72f6de2699dbc4bab50ed23220c1cdf64c1e04c2cf5" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="a24e08c3e85334d25ddb78ed9e55a659b2a3c596406fca348e9dd8da18a191fe" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="4aef1ef2f7759fb97590af4a21d41e7a1b531867d019bb8180c3c9428a013cf7" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="f18f1214e2a7ca3d2a39ba681e9418c45e546f4db0a205e0e7e8718ba80bd28c" name="apache2-worker" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="8beaac6c86baeea4ea8fca0bcb24efb7307405c0ceee7461f41b88b6c0544ecc" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="fc9b9fc24bb3c8fff08cf7b52ddaa492c061a502399ae3b20d999e5d62ff687a" name="apiguardian" arch="noarch">
  <version epoch="0" ver="1.1.2" rel="150200.3.10.2"/>
  <changelog author="fstrba@suse.com" date="1549022400">- Initial package of apiguardian 1.0.0
- Add apiguardian-build.xml file to be able to build with ant</changelog>
  <changelog author="fstrba@suse.com" date="1648036800">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1714392000">- Upgrade to upstream version 1.1.2
  * Fixes:
    + Javadoc 1.8 cannot link to the published 1.1.0 API
    documentation
    + Add LICENSE/NOTICE to the generated jar
    + Allow @API to be declared at the package level
    + Explain usage of Status.DEPRECATED
    + Include OSGi metadata in manifest</changelog>
</package>
<package pkgid="283dd182aa308409de99fccc4d51b4988349ecd4c488a43a99ce7c43cb9207d8" name="apiguardian" arch="src">
  <version epoch="0" ver="1.1.2" rel="150200.3.10.2"/>
  <changelog author="fstrba@suse.com" date="1549022400">- Initial package of apiguardian 1.0.0
- Add apiguardian-build.xml file to be able to build with ant</changelog>
  <changelog author="fstrba@suse.com" date="1648036800">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1714392000">- Upgrade to upstream version 1.1.2
  * Fixes:
    + Javadoc 1.8 cannot link to the published 1.1.0 API
    documentation
    + Add LICENSE/NOTICE to the generated jar
    + Allow @API to be declared at the package level
    + Explain usage of Status.DEPRECATED
    + Include OSGi metadata in manifest</changelog>
</package>
<package pkgid="44935e5b916c34db94ad9fa5722477964718e7f97a1c4c800d4ef65bcce70b14" name="apiguardian-javadoc" arch="noarch">
  <version epoch="0" ver="1.1.2" rel="150200.3.10.2"/>
  <changelog author="fstrba@suse.com" date="1549022400">- Initial package of apiguardian 1.0.0
- Add apiguardian-build.xml file to be able to build with ant</changelog>
  <changelog author="fstrba@suse.com" date="1648036800">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1714392000">- Upgrade to upstream version 1.1.2
  * Fixes:
    + Javadoc 1.8 cannot link to the published 1.1.0 API
    documentation
    + Add LICENSE/NOTICE to the generated jar
    + Allow @API to be declared at the package level
    + Explain usage of Status.DEPRECATED
    + Include OSGi metadata in manifest</changelog>
</package>
<package pkgid="6b0f25843e6cae3ebb1bda35f21097aac26506b2b5c5a83584b418ac1e49d8a1" name="appstream-qt5-devel" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="e5eef23dcd1f4e94054faa06d39ec0b003e574c2923717655c8836136f7693c0" name="appstream-qt5-devel" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="fc4c5f6165eafc37ec6ca27f582237da496c4108024ef9b7b47073ff690f956f" name="appstream-qt5-devel" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="009c48ce15bf1fc2374bb6f9362cf074e3cbb4873cad54f63607bc9226027d4b" name="appstream-qt5-devel" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="1f7799cc1f15a8af7a3f3dc592da2fc988b84537a5ccdb197a7e2c82e83ec538" name="appstream-qt6-devel" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="5f94174d857d56db7c4d03ce41eb91e8712b78e17cf57e845b56e78469b0d94c" name="appstream-qt6-devel" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="3aeba54c2c206d73e575598b3710e1632c7ef3633b4c41ba3d77ca5a62f9a995" name="appstream-qt6-devel" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="a67f3e67205a21957ce0b0cf5007c8d2729d9b5b3d7b654edf3dcab485dcac2c" name="appstream-qt6-devel" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="40960ba4308c953dda21564c3adc6258878d78d10c41654c4bfd88d017e3e123" name="apr" arch="src">
  <version epoch="0" ver="1.6.3" rel="150000.3.6.1"/>
  <changelog author="tchvatal@suse.com" date="1403524800">- Single thread for tests.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1408449600">- 0004-Backport-r1593600-from-1.6.patch memory leak apr_pvsprintf()
- 0005-Backport-r1593612-from-1.6.patch Missing error codes in apr_error_string()
- 0007-backport-r1604596-1604598-from-trunk.patch memory corruption in apr_skiplist
- 0009-Merge-r1610854-from-trunk.patch posix semaphore must handle EINTR.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1413720000">- apr-use-getrandom.patch Use the new getrandom() system call
  in apr_generate_random_bytes() if the system call number
  is defined and if the call is sucessful, fallback if otherwise.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1425729600">- apr-use-getrandom.patch: Update, if getrandom blocks, fallback
  to the old codepath, restoring old always non-blocking behaviour
  in practice it blocks only at boottime when the entropy pool
  has not been fully initialized, this delays the startup
  of apache for example.
  * Use SYS_getrandom constant instead of the "internal"
  __NR_getrandom</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1425816000">- No longer use --enable-allocator-uses-mmap but the default
  which is using malloc, this feature exists to reduce
  fragmentation but this is currently at the expense of:
  * Loosing all malloc sanity checks.
  * mmap and munmap are expensive operations when using
    at lot of threads (like in apache worker,event)
  * It will waste memory, even more on archs that have big
    page sizes.
- If there are fragmentation or performance problems in glibc
  malloc, the library has to be fixed instead.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430654400">- apr 1.5.2
  * apr_escape: Correctly calculate the size of the returned string in
  apr_escape_path and set the correct return value in case we actually
  escape the string
  * apr_poll(cb): fix error paths returned values and leaks.
  * apr_skiplist: Optimize the number of allocations by reusing pooled or
  malloc()ed nodes for the lifetime of the skiplist.
  * apr_skiplist: Fix possible multiple-free() on the same value in
  apr_skiplist_remove_all()
  (obsoletes 0007-backport-r1604596-1604598-from-trunk.patch)
  * apr_global_mutex/apr_proc_mutex: Resolve failures with the
  POSIX sem implementation in environments which receive signals.
  (obsoletes 0009-Merge-r1610854-from-trunk.patch)
  * drop already included or no longer needed patches:
    0004-Backport-r1593600-from-1.6.patch
    0005-Backport-r1593612-from-1.6.patch
    0007-backport-r1604596-1604598-from-trunk.patch
    0009-Merge-r1610854-from-trunk.patch
    string-compare.diff</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430654401">- remove baselibs.conf that osc rejects now with message:
  ERROR: 'arch' referenced in baselibs.conf is not being built
  ERROR: 'ppc' referenced in baselibs.conf is not being built
  ERROR: 'package' referenced in baselibs.conf is not being built
  ERROR: 'arch' referenced in baselibs.conf is not being built
  ERROR: 'ppc' referenced in baselibs.conf is not being built
  ERROR: 'package' referenced in baselibs.conf is not being built</changelog>
  <changelog author="mpluskal@suse.com" date="1443528000">- Add gpg signature</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1462363200">- 0017-Merge-r1733694-r1733708-from-trunk.patch and
  0018-apr_proc_mutex-unix-backport-r1733775-from-trunk-par.patch
  Refcount shared mutexes usage to avoid
  destruction while still is use by some processes, this fixes
  apache graceful-restart sometimes leaving processes in
  "Gracefully finishing" state forever.
- apr-proc-mutex-map-anon.patch use MAP_ANON instead of mmap'ing
  /dev/zero.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497441600">- define READDIR_IS_THREAD_SAFE, because it is. Avoid
  using obsolete and potentially dangerous readdir_r.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- apr 1.6.2
  * apr_allocator: Provide apr_allocator_align()
  * apr_file_io: Add apr_file_pipe_create_pools()
  * Add APR_SO_FREEBIND option for apr_socket_opt_set.
  * apr_skiplist: Add apr_skiplist_addne*()
  * Added Unix domain socket support.
  * See http://www.apache.org/dist/apr/CHANGES-APR-1.6 for
    a full list of changes.
- Drop patches from upstream:
  * 0017-Merge-r1733694-r1733708-from-trunk.patch
  * 0018-apr_proc_mutex-unix-backport-r1733775-from-trunk-par.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1498132800">- Rename package</changelog>
  <changelog author="jengelh@inai.de" date="1499688000">- Replace vision statement in %description with feature list.
  Fix RPM groups.
- Drop --with-pic which is only useful for static libs.</changelog>
  <changelog author="mpluskal@suse.com" date="1508155200">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Do not require python for building - its not needed anyways
  (fate#323526)</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1516708800">- ignore PowerPC transient test failures</changelog>
  <changelog author="mliska@suse.cz" date="1524052800">- Add gcc8-integer-overflow.patch to handle an undefined
  behavior (boo#1090085).</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1525953600">- Version 1.6.3:
  * apr_file_trunc: Truncating a buffered file could add unexpected
  data after the truncate position. PR 51017.
  * apr_file_trunc: Fix an issue where reading from a buffered file
  after truncate could return stale data from the buffer.
  * apr_ipsubnet_create() now fails for an empty input string.
- fixes [bsc#1092981]</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- added patches
  increase timeout to fix random failure of testsuite [bsc#1151059]
  + apr-test-sendfile-timeout.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1726660800">- security update
- added patches
  fix CVE-2023-49582 [bsc#1229783], unexpected lax shared memory permissions
  + apr-CVE-2023-49582.patch</changelog>
</package>
<package pkgid="ffc7af42e4a4b0e7ca3d725cb3ac3f661e14c9a67a2d191333d60c5c8a7f5ecf" name="apr-devel" arch="aarch64">
  <version epoch="0" ver="1.6.3" rel="150000.3.6.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1413720000">- apr-use-getrandom.patch Use the new getrandom() system call
  in apr_generate_random_bytes() if the system call number
  is defined and if the call is sucessful, fallback if otherwise.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1425729600">- apr-use-getrandom.patch: Update, if getrandom blocks, fallback
  to the old codepath, restoring old always non-blocking behaviour
  in practice it blocks only at boottime when the entropy pool
  has not been fully initialized, this delays the startup
  of apache for example.
  * Use SYS_getrandom constant instead of the "internal"
  __NR_getrandom</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1425816000">- No longer use --enable-allocator-uses-mmap but the default
  which is using malloc, this feature exists to reduce
  fragmentation but this is currently at the expense of:
  * Loosing all malloc sanity checks.
  * mmap and munmap are expensive operations when using
    at lot of threads (like in apache worker,event)
  * It will waste memory, even more on archs that have big
    page sizes.
- If there are fragmentation or performance problems in glibc
  malloc, the library has to be fixed instead.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430654400">- apr 1.5.2
  * apr_escape: Correctly calculate the size of the returned string in
  apr_escape_path and set the correct return value in case we actually
  escape the string
  * apr_poll(cb): fix error paths returned values and leaks.
  * apr_skiplist: Optimize the number of allocations by reusing pooled or
  malloc()ed nodes for the lifetime of the skiplist.
  * apr_skiplist: Fix possible multiple-free() on the same value in
  apr_skiplist_remove_all()
  (obsoletes 0007-backport-r1604596-1604598-from-trunk.patch)
  * apr_global_mutex/apr_proc_mutex: Resolve failures with the
  POSIX sem implementation in environments which receive signals.
  (obsoletes 0009-Merge-r1610854-from-trunk.patch)
  * drop already included or no longer needed patches:
    0004-Backport-r1593600-from-1.6.patch
    0005-Backport-r1593612-from-1.6.patch
    0007-backport-r1604596-1604598-from-trunk.patch
    0009-Merge-r1610854-from-trunk.patch
    string-compare.diff</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430654401">- remove baselibs.conf that osc rejects now with message:
  ERROR: 'arch' referenced in baselibs.conf is not being built
  ERROR: 'ppc' referenced in baselibs.conf is not being built
  ERROR: 'package' referenced in baselibs.conf is not being built
  ERROR: 'arch' referenced in baselibs.conf is not being built
  ERROR: 'ppc' referenced in baselibs.conf is not being built
  ERROR: 'package' referenced in baselibs.conf is not being built</changelog>
  <changelog author="mpluskal@suse.com" date="1443528000">- Add gpg signature</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1462363200">- 0017-Merge-r1733694-r1733708-from-trunk.patch and
  0018-apr_proc_mutex-unix-backport-r1733775-from-trunk-par.patch
  Refcount shared mutexes usage to avoid
  destruction while still is use by some processes, this fixes
  apache graceful-restart sometimes leaving processes in
  "Gracefully finishing" state forever.
- apr-proc-mutex-map-anon.patch use MAP_ANON instead of mmap'ing
  /dev/zero.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497441600">- define READDIR_IS_THREAD_SAFE, because it is. Avoid
  using obsolete and potentially dangerous readdir_r.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- apr 1.6.2
  * apr_allocator: Provide apr_allocator_align()
  * apr_file_io: Add apr_file_pipe_create_pools()
  * Add APR_SO_FREEBIND option for apr_socket_opt_set.
  * apr_skiplist: Add apr_skiplist_addne*()
  * Added Unix domain socket support.
  * See http://www.apache.org/dist/apr/CHANGES-APR-1.6 for
    a full list of changes.
- Drop patches from upstream:
  * 0017-Merge-r1733694-r1733708-from-trunk.patch
  * 0018-apr_proc_mutex-unix-backport-r1733775-from-trunk-par.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1498132800">- Rename package</changelog>
  <changelog author="jengelh@inai.de" date="1499688000">- Replace vision statement in %description with feature list.
  Fix RPM groups.
- Drop --with-pic which is only useful for static libs.</changelog>
  <changelog author="mpluskal@suse.com" date="1508155200">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Do not require python for building - its not needed anyways
  (fate#323526)</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1516708800">- ignore PowerPC transient test failures</changelog>
  <changelog author="mliska@suse.cz" date="1524052800">- Add gcc8-integer-overflow.patch to handle an undefined
  behavior (boo#1090085).</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1525953600">- Version 1.6.3:
  * apr_file_trunc: Truncating a buffered file could add unexpected
  data after the truncate position. PR 51017.
  * apr_file_trunc: Fix an issue where reading from a buffered file
  after truncate could return stale data from the buffer.
  * apr_ipsubnet_create() now fails for an empty input string.
- fixes [bsc#1092981]</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- added patches
  increase timeout to fix random failure of testsuite [bsc#1151059]
  + apr-test-sendfile-timeout.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1726660800">- security update
- added patches
  fix CVE-2023-49582 [bsc#1229783], unexpected lax shared memory permissions
  + apr-CVE-2023-49582.patch</changelog>
</package>
<package pkgid="2c42edd1849682b7f34935f73ebf563bd7b83cf01698f27239563d128daf038b" name="apr-devel" arch="ppc64le">
  <version epoch="0" ver="1.6.3" rel="150000.3.6.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1413720000">- apr-use-getrandom.patch Use the new getrandom() system call
  in apr_generate_random_bytes() if the system call number
  is defined and if the call is sucessful, fallback if otherwise.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1425729600">- apr-use-getrandom.patch: Update, if getrandom blocks, fallback
  to the old codepath, restoring old always non-blocking behaviour
  in practice it blocks only at boottime when the entropy pool
  has not been fully initialized, this delays the startup
  of apache for example.
  * Use SYS_getrandom constant instead of the "internal"
  __NR_getrandom</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1425816000">- No longer use --enable-allocator-uses-mmap but the default
  which is using malloc, this feature exists to reduce
  fragmentation but this is currently at the expense of:
  * Loosing all malloc sanity checks.
  * mmap and munmap are expensive operations when using
    at lot of threads (like in apache worker,event)
  * It will waste memory, even more on archs that have big
    page sizes.
- If there are fragmentation or performance problems in glibc
  malloc, the library has to be fixed instead.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430654400">- apr 1.5.2
  * apr_escape: Correctly calculate the size of the returned string in
  apr_escape_path and set the correct return value in case we actually
  escape the string
  * apr_poll(cb): fix error paths returned values and leaks.
  * apr_skiplist: Optimize the number of allocations by reusing pooled or
  malloc()ed nodes for the lifetime of the skiplist.
  * apr_skiplist: Fix possible multiple-free() on the same value in
  apr_skiplist_remove_all()
  (obsoletes 0007-backport-r1604596-1604598-from-trunk.patch)
  * apr_global_mutex/apr_proc_mutex: Resolve failures with the
  POSIX sem implementation in environments which receive signals.
  (obsoletes 0009-Merge-r1610854-from-trunk.patch)
  * drop already included or no longer needed patches:
    0004-Backport-r1593600-from-1.6.patch
    0005-Backport-r1593612-from-1.6.patch
    0007-backport-r1604596-1604598-from-trunk.patch
    0009-Merge-r1610854-from-trunk.patch
    string-compare.diff</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430654401">- remove baselibs.conf that osc rejects now with message:
  ERROR: 'arch' referenced in baselibs.conf is not being built
  ERROR: 'ppc' referenced in baselibs.conf is not being built
  ERROR: 'package' referenced in baselibs.conf is not being built
  ERROR: 'arch' referenced in baselibs.conf is not being built
  ERROR: 'ppc' referenced in baselibs.conf is not being built
  ERROR: 'package' referenced in baselibs.conf is not being built</changelog>
  <changelog author="mpluskal@suse.com" date="1443528000">- Add gpg signature</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1462363200">- 0017-Merge-r1733694-r1733708-from-trunk.patch and
  0018-apr_proc_mutex-unix-backport-r1733775-from-trunk-par.patch
  Refcount shared mutexes usage to avoid
  destruction while still is use by some processes, this fixes
  apache graceful-restart sometimes leaving processes in
  "Gracefully finishing" state forever.
- apr-proc-mutex-map-anon.patch use MAP_ANON instead of mmap'ing
  /dev/zero.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497441600">- define READDIR_IS_THREAD_SAFE, because it is. Avoid
  using obsolete and potentially dangerous readdir_r.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- apr 1.6.2
  * apr_allocator: Provide apr_allocator_align()
  * apr_file_io: Add apr_file_pipe_create_pools()
  * Add APR_SO_FREEBIND option for apr_socket_opt_set.
  * apr_skiplist: Add apr_skiplist_addne*()
  * Added Unix domain socket support.
  * See http://www.apache.org/dist/apr/CHANGES-APR-1.6 for
    a full list of changes.
- Drop patches from upstream:
  * 0017-Merge-r1733694-r1733708-from-trunk.patch
  * 0018-apr_proc_mutex-unix-backport-r1733775-from-trunk-par.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1498132800">- Rename package</changelog>
  <changelog author="jengelh@inai.de" date="1499688000">- Replace vision statement in %description with feature list.
  Fix RPM groups.
- Drop --with-pic which is only useful for static libs.</changelog>
  <changelog author="mpluskal@suse.com" date="1508155200">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Do not require python for building - its not needed anyways
  (fate#323526)</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1516708800">- ignore PowerPC transient test failures</changelog>
  <changelog author="mliska@suse.cz" date="1524052800">- Add gcc8-integer-overflow.patch to handle an undefined
  behavior (boo#1090085).</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1525953600">- Version 1.6.3:
  * apr_file_trunc: Truncating a buffered file could add unexpected
  data after the truncate position. PR 51017.
  * apr_file_trunc: Fix an issue where reading from a buffered file
  after truncate could return stale data from the buffer.
  * apr_ipsubnet_create() now fails for an empty input string.
- fixes [bsc#1092981]</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- added patches
  increase timeout to fix random failure of testsuite [bsc#1151059]
  + apr-test-sendfile-timeout.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1726660800">- security update
- added patches
  fix CVE-2023-49582 [bsc#1229783], unexpected lax shared memory permissions
  + apr-CVE-2023-49582.patch</changelog>
</package>
<package pkgid="2c5ec3453a2f1fcf66c10b467653720a58a010dd9cb0190ffa2761dd8bef780a" name="apr-devel" arch="s390x">
  <version epoch="0" ver="1.6.3" rel="150000.3.6.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1413720000">- apr-use-getrandom.patch Use the new getrandom() system call
  in apr_generate_random_bytes() if the system call number
  is defined and if the call is sucessful, fallback if otherwise.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1425729600">- apr-use-getrandom.patch: Update, if getrandom blocks, fallback
  to the old codepath, restoring old always non-blocking behaviour
  in practice it blocks only at boottime when the entropy pool
  has not been fully initialized, this delays the startup
  of apache for example.
  * Use SYS_getrandom constant instead of the "internal"
  __NR_getrandom</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1425816000">- No longer use --enable-allocator-uses-mmap but the default
  which is using malloc, this feature exists to reduce
  fragmentation but this is currently at the expense of:
  * Loosing all malloc sanity checks.
  * mmap and munmap are expensive operations when using
    at lot of threads (like in apache worker,event)
  * It will waste memory, even more on archs that have big
    page sizes.
- If there are fragmentation or performance problems in glibc
  malloc, the library has to be fixed instead.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430654400">- apr 1.5.2
  * apr_escape: Correctly calculate the size of the returned string in
  apr_escape_path and set the correct return value in case we actually
  escape the string
  * apr_poll(cb): fix error paths returned values and leaks.
  * apr_skiplist: Optimize the number of allocations by reusing pooled or
  malloc()ed nodes for the lifetime of the skiplist.
  * apr_skiplist: Fix possible multiple-free() on the same value in
  apr_skiplist_remove_all()
  (obsoletes 0007-backport-r1604596-1604598-from-trunk.patch)
  * apr_global_mutex/apr_proc_mutex: Resolve failures with the
  POSIX sem implementation in environments which receive signals.
  (obsoletes 0009-Merge-r1610854-from-trunk.patch)
  * drop already included or no longer needed patches:
    0004-Backport-r1593600-from-1.6.patch
    0005-Backport-r1593612-from-1.6.patch
    0007-backport-r1604596-1604598-from-trunk.patch
    0009-Merge-r1610854-from-trunk.patch
    string-compare.diff</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430654401">- remove baselibs.conf that osc rejects now with message:
  ERROR: 'arch' referenced in baselibs.conf is not being built
  ERROR: 'ppc' referenced in baselibs.conf is not being built
  ERROR: 'package' referenced in baselibs.conf is not being built
  ERROR: 'arch' referenced in baselibs.conf is not being built
  ERROR: 'ppc' referenced in baselibs.conf is not being built
  ERROR: 'package' referenced in baselibs.conf is not being built</changelog>
  <changelog author="mpluskal@suse.com" date="1443528000">- Add gpg signature</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1462363200">- 0017-Merge-r1733694-r1733708-from-trunk.patch and
  0018-apr_proc_mutex-unix-backport-r1733775-from-trunk-par.patch
  Refcount shared mutexes usage to avoid
  destruction while still is use by some processes, this fixes
  apache graceful-restart sometimes leaving processes in
  "Gracefully finishing" state forever.
- apr-proc-mutex-map-anon.patch use MAP_ANON instead of mmap'ing
  /dev/zero.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497441600">- define READDIR_IS_THREAD_SAFE, because it is. Avoid
  using obsolete and potentially dangerous readdir_r.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- apr 1.6.2
  * apr_allocator: Provide apr_allocator_align()
  * apr_file_io: Add apr_file_pipe_create_pools()
  * Add APR_SO_FREEBIND option for apr_socket_opt_set.
  * apr_skiplist: Add apr_skiplist_addne*()
  * Added Unix domain socket support.
  * See http://www.apache.org/dist/apr/CHANGES-APR-1.6 for
    a full list of changes.
- Drop patches from upstream:
  * 0017-Merge-r1733694-r1733708-from-trunk.patch
  * 0018-apr_proc_mutex-unix-backport-r1733775-from-trunk-par.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1498132800">- Rename package</changelog>
  <changelog author="jengelh@inai.de" date="1499688000">- Replace vision statement in %description with feature list.
  Fix RPM groups.
- Drop --with-pic which is only useful for static libs.</changelog>
  <changelog author="mpluskal@suse.com" date="1508155200">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Do not require python for building - its not needed anyways
  (fate#323526)</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1516708800">- ignore PowerPC transient test failures</changelog>
  <changelog author="mliska@suse.cz" date="1524052800">- Add gcc8-integer-overflow.patch to handle an undefined
  behavior (boo#1090085).</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1525953600">- Version 1.6.3:
  * apr_file_trunc: Truncating a buffered file could add unexpected
  data after the truncate position. PR 51017.
  * apr_file_trunc: Fix an issue where reading from a buffered file
  after truncate could return stale data from the buffer.
  * apr_ipsubnet_create() now fails for an empty input string.
- fixes [bsc#1092981]</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- added patches
  increase timeout to fix random failure of testsuite [bsc#1151059]
  + apr-test-sendfile-timeout.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1726660800">- security update
- added patches
  fix CVE-2023-49582 [bsc#1229783], unexpected lax shared memory permissions
  + apr-CVE-2023-49582.patch</changelog>
</package>
<package pkgid="ec4694e87e565ab08f36074b539f0b65b2c1628e45089168164a4e2a756b7fb3" name="apr-devel" arch="x86_64">
  <version epoch="0" ver="1.6.3" rel="150000.3.6.1"/>
  <changelog author="crrodriguez@opensuse.org" date="1413720000">- apr-use-getrandom.patch Use the new getrandom() system call
  in apr_generate_random_bytes() if the system call number
  is defined and if the call is sucessful, fallback if otherwise.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1425729600">- apr-use-getrandom.patch: Update, if getrandom blocks, fallback
  to the old codepath, restoring old always non-blocking behaviour
  in practice it blocks only at boottime when the entropy pool
  has not been fully initialized, this delays the startup
  of apache for example.
  * Use SYS_getrandom constant instead of the "internal"
  __NR_getrandom</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1425816000">- No longer use --enable-allocator-uses-mmap but the default
  which is using malloc, this feature exists to reduce
  fragmentation but this is currently at the expense of:
  * Loosing all malloc sanity checks.
  * mmap and munmap are expensive operations when using
    at lot of threads (like in apache worker,event)
  * It will waste memory, even more on archs that have big
    page sizes.
- If there are fragmentation or performance problems in glibc
  malloc, the library has to be fixed instead.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430654400">- apr 1.5.2
  * apr_escape: Correctly calculate the size of the returned string in
  apr_escape_path and set the correct return value in case we actually
  escape the string
  * apr_poll(cb): fix error paths returned values and leaks.
  * apr_skiplist: Optimize the number of allocations by reusing pooled or
  malloc()ed nodes for the lifetime of the skiplist.
  * apr_skiplist: Fix possible multiple-free() on the same value in
  apr_skiplist_remove_all()
  (obsoletes 0007-backport-r1604596-1604598-from-trunk.patch)
  * apr_global_mutex/apr_proc_mutex: Resolve failures with the
  POSIX sem implementation in environments which receive signals.
  (obsoletes 0009-Merge-r1610854-from-trunk.patch)
  * drop already included or no longer needed patches:
    0004-Backport-r1593600-from-1.6.patch
    0005-Backport-r1593612-from-1.6.patch
    0007-backport-r1604596-1604598-from-trunk.patch
    0009-Merge-r1610854-from-trunk.patch
    string-compare.diff</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430654401">- remove baselibs.conf that osc rejects now with message:
  ERROR: 'arch' referenced in baselibs.conf is not being built
  ERROR: 'ppc' referenced in baselibs.conf is not being built
  ERROR: 'package' referenced in baselibs.conf is not being built
  ERROR: 'arch' referenced in baselibs.conf is not being built
  ERROR: 'ppc' referenced in baselibs.conf is not being built
  ERROR: 'package' referenced in baselibs.conf is not being built</changelog>
  <changelog author="mpluskal@suse.com" date="1443528000">- Add gpg signature</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1462363200">- 0017-Merge-r1733694-r1733708-from-trunk.patch and
  0018-apr_proc_mutex-unix-backport-r1733775-from-trunk-par.patch
  Refcount shared mutexes usage to avoid
  destruction while still is use by some processes, this fixes
  apache graceful-restart sometimes leaving processes in
  "Gracefully finishing" state forever.
- apr-proc-mutex-map-anon.patch use MAP_ANON instead of mmap'ing
  /dev/zero.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497441600">- define READDIR_IS_THREAD_SAFE, because it is. Avoid
  using obsolete and potentially dangerous readdir_r.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1497873600">- apr 1.6.2
  * apr_allocator: Provide apr_allocator_align()
  * apr_file_io: Add apr_file_pipe_create_pools()
  * Add APR_SO_FREEBIND option for apr_socket_opt_set.
  * apr_skiplist: Add apr_skiplist_addne*()
  * Added Unix domain socket support.
  * See http://www.apache.org/dist/apr/CHANGES-APR-1.6 for
    a full list of changes.
- Drop patches from upstream:
  * 0017-Merge-r1733694-r1733708-from-trunk.patch
  * 0018-apr_proc_mutex-unix-backport-r1733775-from-trunk-par.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1498132800">- Rename package</changelog>
  <changelog author="jengelh@inai.de" date="1499688000">- Replace vision statement in %description with feature list.
  Fix RPM groups.
- Drop --with-pic which is only useful for static libs.</changelog>
  <changelog author="mpluskal@suse.com" date="1508155200">- We need to obsolete same version of package (bsc#1063305)</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Do not require python for building - its not needed anyways
  (fate#323526)</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1516708800">- ignore PowerPC transient test failures</changelog>
  <changelog author="mliska@suse.cz" date="1524052800">- Add gcc8-integer-overflow.patch to handle an undefined
  behavior (boo#1090085).</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1525953600">- Version 1.6.3:
  * apr_file_trunc: Truncating a buffered file could add unexpected
  data after the truncate position. PR 51017.
  * apr_file_trunc: Fix an issue where reading from a buffered file
  after truncate could return stale data from the buffer.
  * apr_ipsubnet_create() now fails for an empty input string.
- fixes [bsc#1092981]</changelog>
  <changelog author="pgajdos@suse.com" date="1568980800">- added patches
  increase timeout to fix random failure of testsuite [bsc#1151059]
  + apr-test-sendfile-timeout.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1726660800">- security update
- added patches
  fix CVE-2023-49582 [bsc#1229783], unexpected lax shared memory permissions
  + apr-CVE-2023-49582.patch</changelog>
</package>
<package pkgid="ea22388d430de3a6ac6bfc6649e24318918591c00f326ee54676a07092b281d6" name="assertj-core" arch="noarch">
  <version epoch="0" ver="3.25.3" rel="150200.5.4.3"/>
  <changelog author="fstrba@suse.com" date="1556625600">- Initial packaging of assertj-core 3.8.0</changelog>
  <changelog author="jengelh@inai.de" date="1556712000">- Ensure neutrality of descriptions.</changelog>
  <changelog author="fstrba@suse.com" date="1714478400">- Upgrade to version 3.25.3
  * Deprecations:
    + Deprecate the following date/time related assertions in favor
    of isCloseTo:
  - isEqualToIgnoringHours
  - isEqualToIgnoringMinutes
  - isEqualToIgnoringSeconds
  - isEqualToIgnoringMillis
  - isEqualToIgnoringNanos
  - isInSameHourAs
  - isInSameMinuteAs
  - isInSameSecondAs
    + Deprecate asList in favor of asInstanceOf
  * New Features:
    + Add Descriptable#describedAs(Supplier&lt;String&gt;)
    + Add isInThePast and isInTheFuture to LocalDate assertions
    + Add isInThePast and isInTheFuture to the missing Java 8
    date/time types
    + Add isRecord and isNotRecord to Class assertions
    + Add hasNullValue and doesNotHaveNullValue to
    AtomicReferenceAssert
    + Add asBoolean|Byte|Short|Int|Long|Float|Double to String
    assertions
    + Add hasRecordComponents to Class assertions
    + Add getters for field path in ComparisonDifference
    + Allow to compare enum and string fields in the recursive
    comparison
    + Provide value when assertThatThrownBy / thenThrownBy fail
    + Add isSealed and isNotSealed to Class assertions
    + Add assertThatCharSequence to disambiguate Groovy's GString
    + Change the way the properties are collected using the
    Class.getMethods() API instead of iterating the class
    hierarchy using Class.declaredMethods()
    + Add default constructor for RecursiveComparator
    + Add isPrimitive and isNotPrimitive to Class assertions
    + Add anyOf(ThrowingConsumer...) and allOf(ThrowingConsumer...)
    + Show the array/iterable under test in the assertion error
    message when it is not empty but should have been
  * Bug Fixes:
    + Compare Java types from javax and com.sun by their equals
    method in recursive comparison
    + The recursive comparison comparingOnlyFields did not treat
    array/iterable elements as root objects
    + Fixes a bug when failing assertions on DirectoryStream types
    + Fix handling of null containers in the recursive assertion
    + Handle null values in map entry sets when formatting
    + Fix NPE when expected and actual field values are null
    + Fix NPE on anyMatch when actual contains null and
    Objects::isNull is used as predicate
    + Fix misleading subsequence failure messages in string
    assertions
    + Do not ignore nested fields of types specified in
    comparingOnlyFieldsOfTypes
    + containsExactly does not work properly with maps not using
    equals to compare keys
    + Escape percentage in shouldContainExactly error message
    + Fix recursive comparison of ignored types in unordered
    collection
    + Revert "Provide value when assertThatThrownBy/thenThrownBy
    fail"
    + Revert "fix: containsExactly does not work properly with maps
    not using equals to compare keys"
    + Fix unresolvable Javadoc stylesheet URLs, simplify
    configuration
    + Fix missing configuration for MatcherAssert soft assertions
    + Make deprecation notice visible in AbstractAssert#asList
    + Recursive comparison uses equals on root object when
    useOverriddenEquals is enabled
    + satisfiesExactlyInAnyOrder fails if actual overrides equals
    + Avoid calling actual.hashCode() and expected.hashCode() in
    DualValue
    + Recursive comparison checks for existence of fields in types
    that parameterize nested unordered iterables
    + Lock maven-clean-plugin version for all modules
    + Fix a performance regression in the recursive comparison
    related to FieldLocation
    + Don't fail when the recursive comparison checks compared
    fields in collection elements
  * Improvements
    + Add Spotless
    + Use Bnd feature to write resolved bndrun files to output
    folder
    + Add Throwable stack trace to ShouldHaveClause
    + Avoid copy of any Collection instance in
    Iterables::assertContains
    + Add Throwable stack trace to ShouldHaveRootCauseInstance and
    ShouldHaveRootCauseExactlyInstance
    + Add missing description to nested condition
    + Make nestable condition factory accept conditions on super
    types
    + Add varargs overload to Assert::hasString and
    Assert::doesNotHaveString
    + Improve recursive comparison performance by caching field and
    field names result
    + Document performance cost of ignoring collection order
    + Track visited values and their comparison differences so that
    they can be reused
    + Use hash code for compareUnorderedIterables to improve
    performance in some common cases
    + Improve recursive comparison error message regarding equals
    methods used for JDK types
    + Format large arrays as strings
    + Remove null check as isArray already performs it
    + Fix PrimitiveArralList/TransformlingList test file names
    + Add exception for usages of isEqualTo and isNotEqualTo on
    assertions
    + Add check for missing fields in recursive comparison where
    specific fields are requested for comparison
    + Improve efficiency of iterable string conversion
    + Add more tests for usingRecursiveComparison
    + Checks that compared fields exist before running the recursive
    comparison
    + Remove maven-surefire-plugin duplicate version
    + Remove Maven default goal
    + Add dependency graph workflow
    + Normalize non-breaking spaces like regular white spaces
    + AbstractOffsetDateTimeAssert::isBetween parameter names should
    use inclusive, not exclusive
    + Invoke isNotNull in returns and doesNotReturn
    + Cache node names in ComparingFields, ComparingProperties
    + Cache node names in ComparingNormalizedFields
    + Use simpler syntax in
    DefaultRecursiveComparisonIntrospectionStrategy
    .getChildrenNodeNamesOf
    + Update to Contributor Covenant Code of Conduct v2.1
    + Correct contains assertion Javadoc to reflect method behavior
    in case actual is not empty and the group of values to look
    for is
    + Fix Javadoc typos
    + Improving null-safety of isEqualToNormalizingNewlines
    + Speed up for BinaryDiff performance
    + Upgrade workflows to Java 21
    + Apply flatten-maven-plugin to assertj-core and assertj-guava</changelog>
  <changelog author="fstrba@suse.com" date="1716552000">- Require in OBS junit5-minimal to avoid provider choice</changelog>
</package>
<package pkgid="36d14b0b961124536a93f90d3f1f1befd2c3abfb76934bb3987edf49548a23db" name="assertj-core" arch="src">
  <version epoch="0" ver="3.25.3" rel="150200.5.4.3"/>
  <changelog author="fstrba@suse.com" date="1556625600">- Initial packaging of assertj-core 3.8.0</changelog>
  <changelog author="jengelh@inai.de" date="1556712000">- Ensure neutrality of descriptions.</changelog>
  <changelog author="fstrba@suse.com" date="1714478400">- Upgrade to version 3.25.3
  * Deprecations:
    + Deprecate the following date/time related assertions in favor
    of isCloseTo:
  - isEqualToIgnoringHours
  - isEqualToIgnoringMinutes
  - isEqualToIgnoringSeconds
  - isEqualToIgnoringMillis
  - isEqualToIgnoringNanos
  - isInSameHourAs
  - isInSameMinuteAs
  - isInSameSecondAs
    + Deprecate asList in favor of asInstanceOf
  * New Features:
    + Add Descriptable#describedAs(Supplier&lt;String&gt;)
    + Add isInThePast and isInTheFuture to LocalDate assertions
    + Add isInThePast and isInTheFuture to the missing Java 8
    date/time types
    + Add isRecord and isNotRecord to Class assertions
    + Add hasNullValue and doesNotHaveNullValue to
    AtomicReferenceAssert
    + Add asBoolean|Byte|Short|Int|Long|Float|Double to String
    assertions
    + Add hasRecordComponents to Class assertions
    + Add getters for field path in ComparisonDifference
    + Allow to compare enum and string fields in the recursive
    comparison
    + Provide value when assertThatThrownBy / thenThrownBy fail
    + Add isSealed and isNotSealed to Class assertions
    + Add assertThatCharSequence to disambiguate Groovy's GString
    + Change the way the properties are collected using the
    Class.getMethods() API instead of iterating the class
    hierarchy using Class.declaredMethods()
    + Add default constructor for RecursiveComparator
    + Add isPrimitive and isNotPrimitive to Class assertions
    + Add anyOf(ThrowingConsumer...) and allOf(ThrowingConsumer...)
    + Show the array/iterable under test in the assertion error
    message when it is not empty but should have been
  * Bug Fixes:
    + Compare Java types from javax and com.sun by their equals
    method in recursive comparison
    + The recursive comparison comparingOnlyFields did not treat
    array/iterable elements as root objects
    + Fixes a bug when failing assertions on DirectoryStream types
    + Fix handling of null containers in the recursive assertion
    + Handle null values in map entry sets when formatting
    + Fix NPE when expected and actual field values are null
    + Fix NPE on anyMatch when actual contains null and
    Objects::isNull is used as predicate
    + Fix misleading subsequence failure messages in string
    assertions
    + Do not ignore nested fields of types specified in
    comparingOnlyFieldsOfTypes
    + containsExactly does not work properly with maps not using
    equals to compare keys
    + Escape percentage in shouldContainExactly error message
    + Fix recursive comparison of ignored types in unordered
    collection
    + Revert "Provide value when assertThatThrownBy/thenThrownBy
    fail"
    + Revert "fix: containsExactly does not work properly with maps
    not using equals to compare keys"
    + Fix unresolvable Javadoc stylesheet URLs, simplify
    configuration
    + Fix missing configuration for MatcherAssert soft assertions
    + Make deprecation notice visible in AbstractAssert#asList
    + Recursive comparison uses equals on root object when
    useOverriddenEquals is enabled
    + satisfiesExactlyInAnyOrder fails if actual overrides equals
    + Avoid calling actual.hashCode() and expected.hashCode() in
    DualValue
    + Recursive comparison checks for existence of fields in types
    that parameterize nested unordered iterables
    + Lock maven-clean-plugin version for all modules
    + Fix a performance regression in the recursive comparison
    related to FieldLocation
    + Don't fail when the recursive comparison checks compared
    fields in collection elements
  * Improvements
    + Add Spotless
    + Use Bnd feature to write resolved bndrun files to output
    folder
    + Add Throwable stack trace to ShouldHaveClause
    + Avoid copy of any Collection instance in
    Iterables::assertContains
    + Add Throwable stack trace to ShouldHaveRootCauseInstance and
    ShouldHaveRootCauseExactlyInstance
    + Add missing description to nested condition
    + Make nestable condition factory accept conditions on super
    types
    + Add varargs overload to Assert::hasString and
    Assert::doesNotHaveString
    + Improve recursive comparison performance by caching field and
    field names result
    + Document performance cost of ignoring collection order
    + Track visited values and their comparison differences so that
    they can be reused
    + Use hash code for compareUnorderedIterables to improve
    performance in some common cases
    + Improve recursive comparison error message regarding equals
    methods used for JDK types
    + Format large arrays as strings
    + Remove null check as isArray already performs it
    + Fix PrimitiveArralList/TransformlingList test file names
    + Add exception for usages of isEqualTo and isNotEqualTo on
    assertions
    + Add check for missing fields in recursive comparison where
    specific fields are requested for comparison
    + Improve efficiency of iterable string conversion
    + Add more tests for usingRecursiveComparison
    + Checks that compared fields exist before running the recursive
    comparison
    + Remove maven-surefire-plugin duplicate version
    + Remove Maven default goal
    + Add dependency graph workflow
    + Normalize non-breaking spaces like regular white spaces
    + AbstractOffsetDateTimeAssert::isBetween parameter names should
    use inclusive, not exclusive
    + Invoke isNotNull in returns and doesNotReturn
    + Cache node names in ComparingFields, ComparingProperties
    + Cache node names in ComparingNormalizedFields
    + Use simpler syntax in
    DefaultRecursiveComparisonIntrospectionStrategy
    .getChildrenNodeNamesOf
    + Update to Contributor Covenant Code of Conduct v2.1
    + Correct contains assertion Javadoc to reflect method behavior
    in case actual is not empty and the group of values to look
    for is
    + Fix Javadoc typos
    + Improving null-safety of isEqualToNormalizingNewlines
    + Speed up for BinaryDiff performance
    + Upgrade workflows to Java 21
    + Apply flatten-maven-plugin to assertj-core and assertj-guava</changelog>
  <changelog author="fstrba@suse.com" date="1716552000">- Require in OBS junit5-minimal to avoid provider choice</changelog>
</package>
<package pkgid="2b182714d5b9e83774e3690f921d4a9865ee7b0823a5381ed79cefdac7a9ef92" name="atinject" arch="noarch">
  <version epoch="0" ver="1+20211017gitd06ce18" rel="150200.3.13.1"/>
  <changelog author="fstrba@suse.com" date="1540382400">- Initial packaging of atinject adapted from Fedora rpm</changelog>
  <changelog author="fstrba@suse.com" date="1647691200">- Build with source/target levels 8
- Added patch:
  * atinject-javadoc.patch
    + fix build with javadoc 17</changelog>
  <changelog author="fstrba@suse.com" date="1648123200">- Fetch the sources using a source service
- Do not use the upstream build.sh, but use it to write a
  necessary part directly to the spec file</changelog>
  <changelog author="fstrba@suse.com" date="1648900800">- Alias to the new jakarta name</changelog>
  <changelog author="fstrba@suse.com" date="1712750400">- Upgrade to version 1.0.5 and switch to sources in
  https://github.com/jakartaee/inject/
  * Changes of 1.0.5:
    + This switches the module name back to the java.inject that was
    used by the 1.0.3 release with automatic module. This is a
    multi-release jar
  * Changes of 1.0.4:
    + This is a 1.0.4 service release with a multi-release jar that
    adds the module-info class to
    META-INF/versions/9/module-info.class using the
    https://github.com/moditect/moditect plugin for the
    javax.inject module.
  * Changes of 1.0.3:
    + This release corrects the 1.0.2 release which was incorrectly
    done from the master branch with the jakarta.* packages.
    + It adds the Automatic-Module-Name=java.inject to the api jar
    manifest.
  * Changes of 1.0.2:
    + A service release that addresses:
  - #14, set Automatic-Module-Name to java.inject
  - #15, add OSGi bundle headers
  * Changes of 1.0.1:
    + Add Automatic-Module-Name of jakarta.inject
  * Changes of 1.0:
    + First Injection API release for Jakarta EE
- Remove unused sub-package tck
- Removed patch:
  * atinject-javadoc.patch
    + not needed with this version</changelog>
  <changelog author="fstrba@suse.com" date="1717761600">- Don't distribute as jakarta.inject:jakarta-inject-api artifact
  to prevent conflicts with the version 2.x that actually has
  classes in jakarta.inject namespace and thus is incompatible</changelog>
  <changelog author="fstrba@suse.com" date="1720526400">- Revert to versioning 1+&lt;date&gt;git&lt;git short hash&gt; to avoid upgrade
  problems in SLE</changelog>
</package>
<package pkgid="8889fc3ef99485f1682edb2fbd1310aa3b3700bf4f9f8066e7445c3773fb54c1" name="atinject" arch="src">
  <version epoch="0" ver="1+20211017gitd06ce18" rel="150200.3.13.1"/>
  <changelog author="fstrba@suse.com" date="1540382400">- Initial packaging of atinject adapted from Fedora rpm</changelog>
  <changelog author="fstrba@suse.com" date="1647691200">- Build with source/target levels 8
- Added patch:
  * atinject-javadoc.patch
    + fix build with javadoc 17</changelog>
  <changelog author="fstrba@suse.com" date="1648123200">- Fetch the sources using a source service
- Do not use the upstream build.sh, but use it to write a
  necessary part directly to the spec file</changelog>
  <changelog author="fstrba@suse.com" date="1648900800">- Alias to the new jakarta name</changelog>
  <changelog author="fstrba@suse.com" date="1712750400">- Upgrade to version 1.0.5 and switch to sources in
  https://github.com/jakartaee/inject/
  * Changes of 1.0.5:
    + This switches the module name back to the java.inject that was
    used by the 1.0.3 release with automatic module. This is a
    multi-release jar
  * Changes of 1.0.4:
    + This is a 1.0.4 service release with a multi-release jar that
    adds the module-info class to
    META-INF/versions/9/module-info.class using the
    https://github.com/moditect/moditect plugin for the
    javax.inject module.
  * Changes of 1.0.3:
    + This release corrects the 1.0.2 release which was incorrectly
    done from the master branch with the jakarta.* packages.
    + It adds the Automatic-Module-Name=java.inject to the api jar
    manifest.
  * Changes of 1.0.2:
    + A service release that addresses:
  - #14, set Automatic-Module-Name to java.inject
  - #15, add OSGi bundle headers
  * Changes of 1.0.1:
    + Add Automatic-Module-Name of jakarta.inject
  * Changes of 1.0:
    + First Injection API release for Jakarta EE
- Remove unused sub-package tck
- Removed patch:
  * atinject-javadoc.patch
    + not needed with this version</changelog>
  <changelog author="fstrba@suse.com" date="1717761600">- Don't distribute as jakarta.inject:jakarta-inject-api artifact
  to prevent conflicts with the version 2.x that actually has
  classes in jakarta.inject namespace and thus is incompatible</changelog>
  <changelog author="fstrba@suse.com" date="1720526400">- Revert to versioning 1+&lt;date&gt;git&lt;git short hash&gt; to avoid upgrade
  problems in SLE</changelog>
</package>
<package pkgid="82b385b8bf94e36cd1f25c23683ff5360b2ab0d17588b61fd93e4d2b36d231c2" name="atinject-javadoc" arch="noarch">
  <version epoch="0" ver="1+20211017gitd06ce18" rel="150200.3.13.1"/>
  <changelog author="fstrba@suse.com" date="1540382400">- Initial packaging of atinject adapted from Fedora rpm</changelog>
  <changelog author="fstrba@suse.com" date="1647691200">- Build with source/target levels 8
- Added patch:
  * atinject-javadoc.patch
    + fix build with javadoc 17</changelog>
  <changelog author="fstrba@suse.com" date="1648123200">- Fetch the sources using a source service
- Do not use the upstream build.sh, but use it to write a
  necessary part directly to the spec file</changelog>
  <changelog author="fstrba@suse.com" date="1648900800">- Alias to the new jakarta name</changelog>
  <changelog author="fstrba@suse.com" date="1712750400">- Upgrade to version 1.0.5 and switch to sources in
  https://github.com/jakartaee/inject/
  * Changes of 1.0.5:
    + This switches the module name back to the java.inject that was
    used by the 1.0.3 release with automatic module. This is a
    multi-release jar
  * Changes of 1.0.4:
    + This is a 1.0.4 service release with a multi-release jar that
    adds the module-info class to
    META-INF/versions/9/module-info.class using the
    https://github.com/moditect/moditect plugin for the
    javax.inject module.
  * Changes of 1.0.3:
    + This release corrects the 1.0.2 release which was incorrectly
    done from the master branch with the jakarta.* packages.
    + It adds the Automatic-Module-Name=java.inject to the api jar
    manifest.
  * Changes of 1.0.2:
    + A service release that addresses:
  - #14, set Automatic-Module-Name to java.inject
  - #15, add OSGi bundle headers
  * Changes of 1.0.1:
    + Add Automatic-Module-Name of jakarta.inject
  * Changes of 1.0:
    + First Injection API release for Jakarta EE
- Remove unused sub-package tck
- Removed patch:
  * atinject-javadoc.patch
    + not needed with this version</changelog>
  <changelog author="fstrba@suse.com" date="1717761600">- Don't distribute as jakarta.inject:jakarta-inject-api artifact
  to prevent conflicts with the version 2.x that actually has
  classes in jakarta.inject namespace and thus is incompatible</changelog>
  <changelog author="fstrba@suse.com" date="1720526400">- Revert to versioning 1+&lt;date&gt;git&lt;git short hash&gt; to avoid upgrade
  problems in SLE</changelog>
</package>
<package pkgid="59d3f3e76dee43c6cef5af56006a4c701b48a307c1ba48c032876d022a7e763a" name="automake" arch="noarch">
  <version epoch="0" ver="1.15.1" rel="150000.4.13.2"/>
  <changelog author="pth@suse.de" date="1423569600">- Update to 1.15:
  New in 1.15:
  * Improvements and refactorings in the install-sh script:
  - It has been modernized, and now makes the following assumptions
  * unconditionally*:
    (1) a working 'dirname' program is available;
    (2) the ${var:-value} shell parameters substitution works;
    (3) the "set -f" and "set +f" shell commands work, and, respectively,
    disable and enable shell globbing.
  - The script implements stricter error checking, and now it complains
    and bails out if any of the following expectations is not met:
    (1) the options -d and -t are never used together;
    (2) the argument passed to option -t is a directory;
    (3) if there are two or more SOURCEFILE arguments, the
    DESTINATION argument must be a directory.
  * Automake-generated testsuites:
  - The default test-driver used by the Automake-generates testsuites
    now appends the result and exit status of each "plain" test to the
    associated log file (automake bug#11814).
  - The perl implementation of the TAP testsuite driver is no longer
    installed in the Automake's scripts directory, and is instead just
    distributed as a "contrib" addition.  There should be no reason to
    use this implementation anyway in real packages, since the awk+shell
    implementation of the TAP driver (which is documented in the manual)
    is more portable and has feature parity with the perl implementation.
  - The rule generating 'test-suite.log' no longer risk incurring in an
    extra useless "make all" recursive invocation in some corner cases
    (automake bug#16302).
  * Distribution:
  - Automake bug#18286: "make distcheck" could sometimes fail to detect
    files missing from the distribution tarball, especially in those cases
    where both the generated files and their dependencies are explicitly
    in $(srcdir).  An important example of this are *generated* makefile
    fragments included at Automake time in Makefile.am; e.g.:
    ...
    $(srcdir)/fragment.am: $(srcdir)/data.txt $(srcdir)/preproc.sh
    cd $(srcdir) &amp;&amp; $(SHELL) preproc.sh &lt;data.txt &gt;fragment.am
    include $(srcdir)/fragment.am
    ...
    If the use forgot to add data.txt and/or preproc.sh in the distribution
    tarball, "make distcheck" would have erroneously succeeded!  This issue
    is now fixed.
  - As a consequence of the previous change, "make distcheck" will run
    using '$(distdir)/_build/sub' as the build directory, rather than
    simply '$(distdir)/_build' (as it was the case for Automake 1.14 and
    earlier).  Consequently, the './configure' and 'make' invocations
    issued by the distcheck recipe now have $(srcdir) equal to '../..',
    rather than to just '..'.  Dependent and similar variables (e.g.,
    '$(top_srcdir)') are also changed accordingly.
    Thus, Makefiles that made assumptions about the exact values of the
    build and source directories used by "make distcheck" will have to
    be adjusted.  Notice that making such assumptions was a bad and
    unsupported practice anyway, since the exact locations of those
    directories should be considered implementation details, and we
    reserve the right to change them at any time.
  * Miscellaneous bugs fixed:
  - The expansion of AM_INIT_AUTOMAKE ends once again with a trailing
    newline (bug#16841).  Regression introduced in Automake 1.14.
  - We no longer risk to use '$ac_aux_dir' before it's defined (see
    automake bug#15981). Bug introduced in Automake 1.14.
  - The code used to detect whether the currently used make is GNU make
    or not (relying on the private macro 'am__is_gnu_make') no longer
    risks causing "Arg list too long" for projects using automatic
    dependency tracking and having a ton of source files (bug#18744).
  - Automake tries to offer a more deterministic output for generated
    Makefiles, in the face of the newly-introduced randomization for
    hash keys order in Perl 5.18.
  - In older Automake versions, if a user defined one single Makefile
    fragment (say 'foo.am') to be included via Automake includes in
    his main Makefile.am, and defined a custom make rule to generate that
    file from other data, Automake used to spuriously complain with some
    message like "... overrides Automake target '$(srcdir)/foo.am".
    This bug is now fixed.
  - The user can now extend the special .PRECIOUS target, the same way
    he could already do with the .MAKE .and .PHONY targets.
  - Some confusing typos have been fixed in the manual and in few warning
    messages (automake bug#16827 and bug#16997).
- Remove automake-fix-ac_aux_dir-used-before-initialized.patch as the
  change is incorporated now.
- Refresh automake-SuSE.patch and automake-require_file.patch so that
  they apply cleanly.</changelog>
  <changelog author="meissner@suse.com" date="1431864000">- move delete of info file to preun section</changelog>
  <changelog author="dimstar@opensuse.org" date="1441108800">- Add automake-perl-5.22.patch: Fix test suite with perl 5.22 by
  silencing some warnings.</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1465905600">- add 0001-correct-parameter-parsing-in-test-driver-script.patch
  make parameter parsing of test driver script matching the help
  text</changelog>
  <changelog author="mpluskal@suse.com" date="1466942400">- Fix tests with gzip-1.7 and later:
  * automake-fix-tests-gzip.patch</changelog>
  <changelog author="bg@suse.com" date="1486728000">- use vendor suse instead of IBM on s390x</changelog>
  <changelog author="mpluskal@suse.com" date="1497960000">- Update to version 1.15.1:
  * The code has been adapted to remove a warning present since
    Perl 5.22 stating that "Unescaped left brace in regex is
    deprecated". This warning has become an hard error in Perl 5.26
  * The generated Makefiles do not rely on the obsolescent GZIP
    environment variable which was used for passing arguments to
    'gzip'.  Compatibility with old versions has been preserved.
  * Miscellaneous changes:
- Drop no longer needed patches:
  * automake-perl-5.22.patch
  * automake-fix-tests-gzip.patch
- Add keyring
- Small spec file cleanup</changelog>
  <changelog author="jayvdb@gmail.com" date="1508500800">- Add missing BuildRequires perl(Thread::Queue)</changelog>
  <changelog author="mkubecek@suse.cz" date="1619956800">- update 0001-correct-parameter-parsing-in-test-driver-script.patch
  * avoid bashisms in test-driver script (bsc#1185540)</changelog>
  <changelog author="josef.moellers@suse.com" date="1624363200">- make generated autoconf makefiles reproducible.
  [bsc#1182604, automake-reproducible.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1624449600">- Add automake-update-help2man.patch to avoid date variations in docs
  [boo#1047218, jsc#SLE-17848, automake-update-help2man.patch]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1730808000">- check python major version and use imp or importlib accordingly
  [bsc#1232532, python-support-both-Python-2-and-3-in-py-compile.patch]</changelog>
</package>
<package pkgid="96940240b6395519904fd40e3184573e7b1e145de351838ceb0bc19d62c09582" name="automake" arch="src">
  <version epoch="0" ver="1.15.1" rel="150000.4.13.2"/>
  <changelog author="pth@suse.de" date="1369742400">- Remove aclocal-am_ac.patch and aclocal-am_ac.sh as they aren't
  needed anymore and instead cause havok.</changelog>
  <changelog author="pth@suse.de" date="1371038400">- Update to 1.13.3:
  * Documentation fixes:
  - The documentation no longer mistakenly reports that the
    obsolete 'AM_MKDIR_PROG_P' macro and '$(mkdir_p)' make variable
    are going to be removed in Automake 2.0.
  * Bugs fixed:
  - Byte-compilation of Emacs lisp files could fail spuriously on
    Solaris, when /bin/ksh or /usr/xpg4/bin/sh were used as shell.
  - If the same user-defined suffixes were transformed into
    different Automake-known suffixes in different Makefile.am
    files in the same project, automake could get confused and
    generate inconsistent Makefiles (automake bug#14441).
    For example, if 'Makefile.am' contained a ".ext.cc:" suffix
    rule, and 'sub/Makefile.am' contained a ".ext.c:" suffix rule,
    automake would have mistakenly placed into 'Makefile.in' rules
    to compile "*.c" files into object files, and into
    'sub/Makefile.in' rules to compile "*.cc" files into object
    files --- rather than the other way around.  This is now fixed.
  - Several spurious failures have been fixed (they hit especially
    MinGW/MSYS builds).  See automake bugs #14493, #14494, #14495,
    [#14498], #14499, #14500, #14501, #14517 and #14528.
  - Some other minor miscellaneous changes and fixlets.
  - Patches updated to they apply cleanly and with no offset.</changelog>
  <changelog author="pth@suse.de" date="1371470400">- Update to 1.13.4:
  - Fix a minor regression introduced in Automake 1.13.3: when two or more
    user-defined suffix rules were present in a single Makefile.am,
    automake would needlessly include definition of some make variables
    related to C compilation in the generated Makefile.in (bug#14560).
- Adapt automake-SuSE.patch to changed config.guess.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1376654400">- fix tests on factory
  automake-1.13.4-fix-primary-prefix-invalid-couples-test.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1383048000">- Add expect as BuildRequires/Requires for automake-testsuite.</changelog>
  <changelog author="jengelh@inai.de" date="1391601600">- Update to new upstream release 1.14.1
  * The 'compile' script is now unconditionally required for all
  packages that perform C compilation
  * The AM_PROG_CC_C_O macro can still be called, albeit that
  should no longer be necessary.
  * The special Automake-time substitutions '%reldir%' and
  '%canon_reldir%' (and their short versions, '%D%' and '%C%'
  respectively) can now be used in an included Makefile fragment.
  The former is substituted with the relative directory of the
  included fragment (compared to the top-level including
  Makefile), and the latter with the canonicalized version of the
  same relative directory.
  * The 'shar' and 'compress' distribution formats are deprecated</changelog>
  <changelog author="pth@suse.de" date="1408968000">- Explicitely pass the directory name to setup so that the testsuite
  can run.</changelog>
  <changelog author="gber@opensuse.org" date="1412596800">- Add automake-fix-ac_aux_dir-used-before-initialized.patch in
  to fix the use of $ac_aux_dir before being initialized</changelog>
  <changelog author="pth@suse.de" date="1423569600">- Update to 1.15:
  New in 1.15:
  * Improvements and refactorings in the install-sh script:
  - It has been modernized, and now makes the following assumptions
  * unconditionally*:
    (1) a working 'dirname' program is available;
    (2) the ${var:-value} shell parameters substitution works;
    (3) the "set -f" and "set +f" shell commands work, and, respectively,
    disable and enable shell globbing.
  - The script implements stricter error checking, and now it complains
    and bails out if any of the following expectations is not met:
    (1) the options -d and -t are never used together;
    (2) the argument passed to option -t is a directory;
    (3) if there are two or more SOURCEFILE arguments, the
    DESTINATION argument must be a directory.
  * Automake-generated testsuites:
  - The default test-driver used by the Automake-generates testsuites
    now appends the result and exit status of each "plain" test to the
    associated log file (automake bug#11814).
  - The perl implementation of the TAP testsuite driver is no longer
    installed in the Automake's scripts directory, and is instead just
    distributed as a "contrib" addition.  There should be no reason to
    use this implementation anyway in real packages, since the awk+shell
    implementation of the TAP driver (which is documented in the manual)
    is more portable and has feature parity with the perl implementation.
  - The rule generating 'test-suite.log' no longer risk incurring in an
    extra useless "make all" recursive invocation in some corner cases
    (automake bug#16302).
  * Distribution:
  - Automake bug#18286: "make distcheck" could sometimes fail to detect
    files missing from the distribution tarball, especially in those cases
    where both the generated files and their dependencies are explicitly
    in $(srcdir).  An important example of this are *generated* makefile
    fragments included at Automake time in Makefile.am; e.g.:
    ...
    $(srcdir)/fragment.am: $(srcdir)/data.txt $(srcdir)/preproc.sh
    cd $(srcdir) &amp;&amp; $(SHELL) preproc.sh &lt;data.txt &gt;fragment.am
    include $(srcdir)/fragment.am
    ...
    If the use forgot to add data.txt and/or preproc.sh in the distribution
    tarball, "make distcheck" would have erroneously succeeded!  This issue
    is now fixed.
  - As a consequence of the previous change, "make distcheck" will run
    using '$(distdir)/_build/sub' as the build directory, rather than
    simply '$(distdir)/_build' (as it was the case for Automake 1.14 and
    earlier).  Consequently, the './configure' and 'make' invocations
    issued by the distcheck recipe now have $(srcdir) equal to '../..',
    rather than to just '..'.  Dependent and similar variables (e.g.,
    '$(top_srcdir)') are also changed accordingly.
    Thus, Makefiles that made assumptions about the exact values of the
    build and source directories used by "make distcheck" will have to
    be adjusted.  Notice that making such assumptions was a bad and
    unsupported practice anyway, since the exact locations of those
    directories should be considered implementation details, and we
    reserve the right to change them at any time.
  * Miscellaneous bugs fixed:
  - The expansion of AM_INIT_AUTOMAKE ends once again with a trailing
    newline (bug#16841).  Regression introduced in Automake 1.14.
  - We no longer risk to use '$ac_aux_dir' before it's defined (see
    automake bug#15981). Bug introduced in Automake 1.14.
  - The code used to detect whether the currently used make is GNU make
    or not (relying on the private macro 'am__is_gnu_make') no longer
    risks causing "Arg list too long" for projects using automatic
    dependency tracking and having a ton of source files (bug#18744).
  - Automake tries to offer a more deterministic output for generated
    Makefiles, in the face of the newly-introduced randomization for
    hash keys order in Perl 5.18.
  - In older Automake versions, if a user defined one single Makefile
    fragment (say 'foo.am') to be included via Automake includes in
    his main Makefile.am, and defined a custom make rule to generate that
    file from other data, Automake used to spuriously complain with some
    message like "... overrides Automake target '$(srcdir)/foo.am".
    This bug is now fixed.
  - The user can now extend the special .PRECIOUS target, the same way
    he could already do with the .MAKE .and .PHONY targets.
  - Some confusing typos have been fixed in the manual and in few warning
    messages (automake bug#16827 and bug#16997).
- Remove automake-fix-ac_aux_dir-used-before-initialized.patch as the
  change is incorporated now.
- Refresh automake-SuSE.patch and automake-require_file.patch so that
  they apply cleanly.</changelog>
  <changelog author="meissner@suse.com" date="1431864000">- move delete of info file to preun section</changelog>
  <changelog author="dimstar@opensuse.org" date="1441108800">- Add automake-perl-5.22.patch: Fix test suite with perl 5.22 by
  silencing some warnings.</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1465905600">- add 0001-correct-parameter-parsing-in-test-driver-script.patch
  make parameter parsing of test driver script matching the help
  text</changelog>
  <changelog author="mpluskal@suse.com" date="1466942400">- Fix tests with gzip-1.7 and later:
  * automake-fix-tests-gzip.patch</changelog>
  <changelog author="bg@suse.com" date="1486728000">- use vendor suse instead of IBM on s390x</changelog>
  <changelog author="mpluskal@suse.com" date="1497960000">- Update to version 1.15.1:
  * The code has been adapted to remove a warning present since
    Perl 5.22 stating that "Unescaped left brace in regex is
    deprecated". This warning has become an hard error in Perl 5.26
  * The generated Makefiles do not rely on the obsolescent GZIP
    environment variable which was used for passing arguments to
    'gzip'.  Compatibility with old versions has been preserved.
  * Miscellaneous changes:
- Drop no longer needed patches:
  * automake-perl-5.22.patch
  * automake-fix-tests-gzip.patch
- Add keyring
- Small spec file cleanup</changelog>
  <changelog author="jayvdb@gmail.com" date="1508500800">- Add missing BuildRequires perl(Thread::Queue)</changelog>
  <changelog author="mkubecek@suse.cz" date="1619956800">- update 0001-correct-parameter-parsing-in-test-driver-script.patch
  * avoid bashisms in test-driver script (bsc#1185540)</changelog>
  <changelog author="josef.moellers@suse.com" date="1624363200">- make generated autoconf makefiles reproducible.
  [bsc#1182604, automake-reproducible.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1624449600">- Add automake-update-help2man.patch to avoid date variations in docs
  [boo#1047218, jsc#SLE-17848, automake-update-help2man.patch]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1730808000">- check python major version and use imp or importlib accordingly
  [bsc#1232532, python-support-both-Python-2-and-3-in-py-compile.patch]</changelog>
</package>
<package pkgid="b85e528ec532c0004f39b9831fabced4c80d13f0c0bde489f73c4475ec2d539c" name="avahi" arch="aarch64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="33e75041d1bb37f5f1b78dbc07636747d358f0ca4f7599b5adba1aaa2061384f" name="avahi" arch="ppc64le">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="211010baf3903bbc4359efc6b82685f07c811be5b31906f7f8325745045e51c1" name="avahi" arch="s390x">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="50f60742818d2464e16d3b42b162a4632202f05e197f59bbb679314e4289af1e" name="avahi" arch="src">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="b712d4f5be5f7759e0a912900353e6cdb567303a5239ef38f887ea7a1b090543" name="avahi" arch="x86_64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="2b223095334fea91967414c3eb5155f42cab6ce6aa822b5690258a682de85976" name="avahi" arch="aarch64">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="302b638174fe1ea85bb2e42ac18677eff3398a841a4bdb9b48af542b02594eee" name="avahi" arch="ppc64le">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="9377dc918a66c288c19fb3fbd844d79dfbf6432bd8a3796f0721a05072354c20" name="avahi" arch="s390x">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="712f3b952c2b605229ec7047977ce5b458e0b6107c3cef1730f371a3c0a89f42" name="avahi" arch="src">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="dedc0d436e5655b1ba28f78a1079c6650889e3c8066509387187d667d871f609" name="avahi" arch="x86_64">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="4d38b7c5e5eee3f2df075f28eba8953cc7885508f9deab79e5316af272e21dca" name="avahi-autoipd" arch="aarch64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="a55e953fca8e033e6aa3ac98d550bd15ed41e334c98983dffa75496aa3de9f22" name="avahi-autoipd" arch="ppc64le">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="d610a3aeabad4a1787590993fb924af76a9c61af3c74cc400beca7772a56bfc2" name="avahi-autoipd" arch="s390x">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="300e46f44f928957ef74da83bdfdf5aaf79712dbfc9f1b5d325f211ff97ee542" name="avahi-autoipd" arch="x86_64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="a9307118635ea5732fd44ab690ee18eda04c7bac346f6aa39dc04c48141ebab9" name="avahi-autoipd" arch="aarch64">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="fe3994b1784e9bbd1ed1d24f1f5ace0b3132d8aff07dfb129fc480abe5e43b86" name="avahi-autoipd" arch="ppc64le">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="cb59b0971b799c8daecbb6c5c9555faac66edd3360a269fdd20ea39ad937015c" name="avahi-autoipd" arch="s390x">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="90731aba295a2e5ea1e8831bdaa9ade6d9167d764cd07c49a8994f72fa3c56db" name="avahi-autoipd" arch="x86_64">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="aebab81b20e6b7872a3bd1c5d7a2eeb014fbef792583c52c91826d9cc4b171f3" name="avahi-compat-howl-devel" arch="aarch64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="689a338f5584fee7616055b1a64a9f40179df56f9838cc68a0be04421dd7c18f" name="avahi-compat-howl-devel" arch="ppc64le">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="3ce11a7dc833e3b17abba5b3faee81b4e618101573e72153d93830df8a45883f" name="avahi-compat-howl-devel" arch="s390x">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="d3b6fff46b52bb0fdbe4a3cfade0ff69a3fd39a3b2744edb2395bd5bfb85c85e" name="avahi-compat-howl-devel" arch="x86_64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="3481afe9d27388e3da05f2bd458b3e47c0566e78c73b4b647be2acb6ee1d6307" name="avahi-compat-howl-devel" arch="aarch64">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="5fe8af2c1571422052ba6921e3d80255c46cf738f812f676edf2df9ee20619ca" name="avahi-compat-howl-devel" arch="ppc64le">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="e6f0fad755cb4a5e554eff23fd0d679c19ed3a899af50dde1b4770c10514a0ac" name="avahi-compat-howl-devel" arch="s390x">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="70c47f8716ded216d7a33b882b4ee7012bc0c3df7631de752b27798767fe693c" name="avahi-compat-howl-devel" arch="x86_64">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="75ff46f435dd1b2dfbd0566ceccd2b6bb6040e0b50a117593e44fcd475115ae6" name="avahi-compat-mDNSResponder-devel" arch="aarch64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="d5122647e4ab054c35cd4fa3fbac1eb8b833924b44900f720a86cb9d7bdc9fc6" name="avahi-compat-mDNSResponder-devel" arch="ppc64le">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="d402eb1f145fc21aa4249f2d8afd44cdd700bec2a333682762aab1a1853291a4" name="avahi-compat-mDNSResponder-devel" arch="s390x">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="3ec18a8982f79351f49d1b1c8edc4821d165551b9d6bdffaf9c7b8440b4a9955" name="avahi-compat-mDNSResponder-devel" arch="x86_64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="3996ce7557391abdc90dd398ec8cefbb2e5f2f6e510712ffe3a982d281875341" name="avahi-compat-mDNSResponder-devel" arch="aarch64">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="a32fb8d7ec7f043460f12b6631d575fa1e5e57ffc0e0e755699296e519b1516c" name="avahi-compat-mDNSResponder-devel" arch="ppc64le">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="970f563e66a5e6357d3c599e5a1aee780b6cf3b2933ea8ff406b94ca80093302" name="avahi-compat-mDNSResponder-devel" arch="s390x">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="ce89c22bffa040ecc243902121a7c05c8c2ca390f21c814704e3bdf69bc9e87a" name="avahi-compat-mDNSResponder-devel" arch="x86_64">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="f73854bd4606002e4d6d69148ce00ac8da0faacfee9fa6e54c88a5578568c817" name="avahi-glib2" arch="src">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="8a08f89b6e8b80ddf9406e3784897581ff14bd0b623b0e496feeb96cec0687b5" name="avahi-glib2" arch="src">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="81a6a3ad78953768e141c6936d74427520d6396c1c3f5f3da036274550e45e1b" name="avahi-lang" arch="noarch">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="6f4ea87130c24d7c17a6ce1aa0b5ab8a02eb621f9bcd45658486d9161e296cee" name="avahi-lang" arch="noarch">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="efdfc703ad408819d551e42bc6c04d762857d0a6666edf842e9a4e1b87e0fbc5" name="avahi-qt5" arch="src">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="84924574c9b17dcaaaf144c738174c39fd3a56644ec5908afbc0ac7d8018bdf0" name="avahi-qt5" arch="src">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="5b0c0e0ac660de72fecb9165ae999752c69171eef7d6c0e24c03a34d152e2e2f" name="avahi-utils" arch="aarch64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="03de9d25f3eaaf47e80758b686fb1581f006daad94ff408a5dec02e32613795c" name="avahi-utils" arch="ppc64le">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="c82144f96abe67bc521a3692be9c9acd37833172fc3c8737b1525daf65340af1" name="avahi-utils" arch="s390x">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="7687e0f021b5a4417b8a5ae6041e193a75f29990fecaf8f4e1d15fc90353b140" name="avahi-utils" arch="x86_64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="b17890da8d7c02d9daa968eee61f65e5a919551aa9fe9e89f2d00d5a51d26d66" name="avahi-utils" arch="aarch64">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="d9710dbf9f65bfa0190cde7ed7d016530251087d17c2113c29eb1bd0d9dd724f" name="avahi-utils" arch="ppc64le">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="6e993d35a0ae1e147174bb8c33d15870b9963fd93ff15e9a17018634d7c7ea1e" name="avahi-utils" arch="s390x">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="c791997951a5b7bb1f406c4b9d21e2ac68e36a1648f130b418c4b8e490d0888c" name="avahi-utils" arch="x86_64">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="99bcf6f4a184cd248977ff07f99a0fe1b0c8b3801749e69b09c5d9be74cff5ff" name="avahi-utils-gtk" arch="aarch64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="d033bb66469fd5ce364a8c441275bc145f5bb97cd99b35b14a962f67d437aad3" name="avahi-utils-gtk" arch="ppc64le">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="129acf0a4a7cb1f309d2302c9f25b75edafa77ac917fccc3a7a29dcceb751005" name="avahi-utils-gtk" arch="s390x">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="8f01193e8d536215aaa0966dde039ac30d89b95752f4b6964412e7075145a2e1" name="avahi-utils-gtk" arch="x86_64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="66fa1e75ff026ebf5aea5974857e84befc9e5770941f6bc2488c870288e4da31" name="avahi-utils-gtk" arch="aarch64">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="1527b384497c2291914605bba646893d5ce99320d5dd3ffcd484b007e926826f" name="avahi-utils-gtk" arch="ppc64le">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="c8c8847a173757d2f65203933ff09716b997a7e248d9a3f78735bc0309e97c7f" name="avahi-utils-gtk" arch="s390x">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="b7c2328df25584b08dbdf00c8043e06f9405d49ba70946b15b57f15af21749c0" name="avahi-utils-gtk" arch="x86_64">
  <version epoch="0" ver="0.8" rel="150600.15.6.1"/>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
  <changelog author="qzhao@suse.com" date="1732104000">- Add avahi-CVE-2024-52616.patch:
  Backporting 1dade81c from upstream: Properly randomize query id
  of DNS packets.
  (CVE-2024-52616, bsc#1233420)</changelog>
</package>
<package pkgid="f7a425deef0528802584c6641a885860fd5920aa70732b1d3a768cca798da563" name="aws-cli" arch="noarch">
  <version epoch="0" ver="1.32.31" rel="150400.35.3.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1674820800">- Update to version 1.27.58
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.58/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675425600">- Update to version 1.27.60
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.60/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675857600">- Update to version 1.27.66
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.66/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1676462400">- Update to version 1.27.71
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.71/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1677240000">- Update to version 1.27.78
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.78/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678708800">- Update to version 1.27.89
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.89/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680696000">- Update in SLE-15 (bsc#1209255, jsc#PED-3780)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1681905600">- Update to version 1.27.115
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.115/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683633600">- Update to version 1.27.130
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.130/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1686744000">- Update to version 1.27.153
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.153/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688040000">- Update to version 1.27.163
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.163/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1689076800">- Update to version 1.29.2
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.29.2/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692273600">- Update to version 1.29.27
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.29.27/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1693396800">- Update to version 1.29.36
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.29.27/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696593600">- Update to version 1.29.61
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.29.61/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700827200">- Update to version 1.30.6
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.30.6/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1702296000">- Update to version 1.31.11
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.31.11/CHANGELOG.rst
- Add patch to update docutils dependency (bsc#1217336)
  + ac_update-docutils.patch
- Update Requires in spec file from setup.py</changelog>
  <changelog author="rjschwei@suse.com" date="1706702400">- Switch to Python 3.11 build in SLE 15 SP4 and openSUSE Leap 15.4 and
  later (jsc#PCT-371)
- Switch to wheel build
- Update to version 1.32.31
  * Forward port ac_update-docutils.patch
  * api-change:``datazone``: Add new skipDeletionCheck to DeleteDomain. Add
    new skipDeletionCheck to DeleteProject which also automatically deletes
    dependent objects
  * api-change:``route53``: Update the SDKs for text changes in the APIs.
- From 1.32.30
  * api-change:``autoscaling``: EC2 Auto Scaling customers who use attribute
    based instance-type selection can now intuitively define their Spot
    instances price protection limit as a percentage of the lowest priced
    On-Demand instance type.
  * api-change:``comprehend``: Comprehend PII analysis now supports Spanish
    input documents.
  * api-change:``ec2``: EC2 Fleet customers who use attribute based
    instance-type selection can now intuitively define their Spot instances
    price protection limit as a percentage of the lowest priced On-Demand
    instance type.
  * api-change:``mwaa``: This release adds MAINTENANCE environment status for
    Amazon MWAA environments.
  * api-change:``rds``: Introduced support for the
    InsufficientDBInstanceCapacityFault error in the RDS
    RestoreDBClusterFromSnapshot and RestoreDBClusterToPointInTime API methods.
    This provides enhanced error handling, ensuring a more robust experience.
  * api-change:``snowball``: Modified description of createaddress to include
    direction to add path when providing a JSON file.
- From 1.32.29
  * api-change:``connect``: Update list and string length limits for predefined
    attributes.
  * api-change:``inspector2``: This release adds ECR container image scanning
    based on their lastRecordedPullTime.
  * api-change:``sagemaker``: Amazon SageMaker Automatic Model Tuning now
    provides an API to programmatically delete tuning jobs.
- From 1.32.28
  * api-change:``acm-pca``: AWS Private CA now supports an option to omit the
    CDP extension from issued certificates, when CRL revocation is enabled.
  * api-change:``lightsail``: This release adds support for IPv6-only instance
    plans.
- From 1.32.27
  * api-change:``ec2``: Introduced a new clientToken request parameter on
    CreateNetworkAcl and CreateRouteTable APIs. The clientToken parameter
    allows idempotent operations on the APIs.
  * api-change:``ecs``: Documentation updates for Amazon ECS.
  * api-change:``outposts``: DeviceSerialNumber parameter is now optional in
    StartConnection API
  * api-change:``rds``: This release adds support for Aurora Limitless Database.
  * api-change:``storagegateway``: Add DeprecationDate and SoftwareVersion to
    response of ListGateways.
- From 1.32.26
  * api-change:``inspector2``: This release adds support for CIS scans on EC2
    instances.
- From 1.32.25
  * bugfix:``s3 sync``: Disable S3 Express support for s3 sync command
- From 1.32.24
  * api-change:``appconfigdata``: Fix FIPS Endpoints in aws-us-gov.
  * api-change:``cloud9``: Doc-only update around removing AL1 from list of
    available AMIs for Cloud9
  * api-change:``cloudfront-keyvaluestore``: This release improves upon the
    DescribeKeyValueStore API by returning two additional fields, Status of the
    KeyValueStore and the FailureReason in case of failures during creation of
    KeyValueStore.
  * api-change:``connectcases``: This release adds the ability to view audit
    history on a case and introduces a new parameter, performedBy, for
    CreateCase and UpdateCase API's.
  * api-change:``ec2``: Documentation updates for Amazon EC2.
  * api-change:``ecs``: This release adds support for Transport Layer Security
    (TLS) and Configurable Timeout to ECS Service Connect. TLS facilitates
    privacy and data security for inter-service communications, while
    Configurable Timeout allows customized per-request timeout and idle timeout
    for Service Connect services.
  * api-change:``finspace``: Allow customer to set zip default through command
    line arguments.
  * api-change:``organizations``: Doc only update for quota increase change
  * api-change:``rds``: Introduced support for the
    InsufficientDBInstanceCapacityFault error in the RDS CreateDBCluster API
    method. This provides enhanced error handling, ensuring a more robust
    experience when creating database clusters with insufficient instance
    capacity.
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.23
  * api-change:``athena``: Introducing new NotebookS3LocationUri parameter to
    Athena ImportNotebook API. Payload is no longer required and either Payload
    or NotebookS3LocationUri needs to be provided (not both) for a successful
    ImportNotebook API call. If both are provided, an InvalidRequestException
    will be thrown.
  * api-change:``codebuild``: Release CodeBuild Reserved Capacity feature
  * api-change:``dynamodb``: This release adds support for including
    ApproximateCreationDateTimePrecision configurations in
    EnableKinesisStreamingDestination API, adds the same as an optional field
    in the response of DescribeKinesisStreamingDestination, and adds support
    for a new UpdateKinesisStreamingDestination API.
  * api-change:``qconnect``: Increased Quick Response name max length to 100
- From 1.32.22
  * api-change:``b2bi``: Increasing TestMapping inputFileContent file size
    limit to 5MB and adding file size limit 250KB for TestParsing input file.
    This release also includes exposing InternalServerException for Tag APIs.
  * api-change:``cloudtrail``: This release adds a new API
    ListInsightsMetricData to retrieve metric data from CloudTrail Insights.
  * api-change:``connect``: GetMetricDataV2 now supports 3 groupings
  * api-change:``drs``: Removed invalid and unnecessary default values.
  * api-change:``firehose``: Allow support for Snowflake as a Kinesis Data
    Firehose delivery destination.
  * api-change:``sagemaker-featurestore-runtime``: Increase BatchGetRecord
    limits from 10 items to 100 items
- From 1.32.21
  * api-change:``dynamodb``: Updating note for enabling streams for UpdateTable.
  * api-change:``keyspaces``: This release adds support for Multi-Region
    Replication with provisioned tables, and Keyspaces auto scaling APIs
- From 1.32.20
  * api-change:``iot``: Revert release of LogTargetTypes
  * api-change:``iotfleetwise``: Updated APIs: SignalNodeType query parameter
    has been added to ListSignalCatalogNodesRequest and ListVehiclesResponse
    has been extended with attributes field.
  * api-change:``macie2``: This release adds support for analyzing Amazon S3
    objects that are encrypted using dual-layer server-side encryption with
    AWS KMS keys (DSSE-KMS). It also adds support for reporting DSSE-KMS
    details in statistics and metadata about encryption settings for S3 buckets
    and objects.
  * api-change:``payment-cryptography``: Provide an additional option for key
    exchange using RSA wrap/unwrap in addition to tr-34/tr-31 in ImportKey and
    ExportKey operations. Added new key usage (type)
    TR31_M1_ISO_9797_1_MAC_KEY, for use with Generate/VerifyMac dataplane
    operations  with ISO9797 Algorithm 1 MAC calculations.
  * api-change:``personalize-runtime``: Documentation updates for Amazon
    Personalize
  * api-change:``personalize``: Documentation updates for Amazon Personalize.
  * api-change:``rekognition``: This release adds ContentType and TaxonomyLevel
    attributes to DetectModerationLabels and GetMediaAnalysisJob API responses.
  * api-change:``securityhub``: Documentation updates for AWS Security Hub
- From 1.32.19
  * api-change:``sagemaker``: This release will have ValidationException thrown
    if certain invalid app types are provided. The release will also throw
    ValidationException if more than 10 account ids are provided in
    VpcOnlyTrustedAccounts.
- From 1.32.18
  * api-change:``connect``: Supervisor Barge for Chat is now supported through
    the MonitorContact API.
  * api-change:``connectparticipant``: Introduce new Supervisor participant
    role
  * api-change:``location``: Location SDK documentation update. Added missing
    fonts to the MapConfiguration data type. Updated note for the
    SubMunicipality property in the place data type.
  * api-change:``mwaa``: This Amazon MWAA feature release includes new fields
    in CreateWebLoginToken response model. The new fields IamIdentity and
    AirflowIdentity will let you match identifications, as the Airflow identity
    length is currently hashed to 64 characters.
  * api-change:``s3control``: S3 On Outposts team adds dualstack endpoints
    support for S3Control and S3Outposts API calls.
  * api-change:``supplychain``: This release includes APIs
    CreateBillOfMaterialsImportJob and GetBillOfMaterialsImportJob.
  * api-change:``transfer``: AWS Transfer Family now supports static IP
    addresses for SFTP &amp; AS2 connectors and for async MDNs on AS2 servers.
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.17
  * api-change:``ec2``: This release adds support for adding an
    ElasticBlockStorage volume configurations in ECS
    RunTask/StartTask/CreateService/UpdateService APIs. The configuration
    allows for attaching EBS volumes to ECS Tasks.
  * api-change:``ecs``: This release adds support for adding an
    ElasticBlockStorage volume configurations in ECS
    RunTask/StartTask/CreateService/UpdateService APIs. The configuration
    allows for attaching EBS volumes to ECS Tasks.
  * api-change:``events``: Update events command to latest version
  * api-change:``iot``: Add ConflictException to Update APIs of AWS IoT
    Software Package Catalog
  * api-change:``iotfleetwise``: The following dataTypes have been removed:
    CUSTOMER_DECODED_INTERFACE in NetworkInterfaceType;
    CUSTOMER_DECODED_SIGNAL_INFO_IS_NULL in SignalDecoderFailureReason;
    CUSTOMER_DECODED_SIGNAL_NETWORK_INTERFACE_INFO_IS_NULL in
    NetworkInterfaceFailureReason; CUSTOMER_DECODED_SIGNAL in SignalDecoderType
  * api-change:``secretsmanager``: Doc only update for Secrets Manager
  * api-change:``workspaces``: Added AWS Workspaces RebootWorkspaces
    API - Extended Reboot documentation update
- From 1.32.16
  * api-change:``connectcampaigns``: Minor pattern updates for Campaign and
    Dial Request API fields.
  * api-change:``location``: This release adds API support for custom layers
    for the maps service APIs: CreateMap, UpdateMap, DescribeMap.
  * api-change:``logs``: Add support for account level subscription filter
    policies to PutAccountPolicy, DescribeAccountPolicies, and
    DeleteAccountPolicy APIs. Additionally, PutAccountPolicy has been modified
    with new optional "selectionCriteria" parameter for resource selection.
  * api-change:``qconnect``: QueryAssistant and GetRecommendations will be
    discontinued starting June 1, 2024. To receive generative responses after
    March 1, 2024 you will need to create a new Assistant in the Connect
    console and integrate the Amazon Q in Connect JavaScript library
    (amazon-q-connectjs) into your applications.
  * api-change:``redshift-serverless``: Updates to ConfigParameter for RSS
    workgroup, removal of use_fips_ssl
  * api-change:``route53``: Route53 now supports geoproximity routing in AWS
    regions
  * api-change:``wisdom``: QueryAssistant and GetRecommendations will be
    discontinued starting June 1, 2024. To receive generative responses after
    March 1, 2024 you will need to create a new Assistant in the Connect
    console and integrate the Amazon Q in Connect JavaScript library
    (amazon-q-connectjs) into your applications.
- From 1.32.15
  * api-change:``codebuild``: Aws CodeBuild now supports new compute type
    BUILD_GENERAL1_XLARGE
  * api-change:``ec2``: Amazon EC2 R7iz bare metal instances are powered by
    custom 4th generation Intel Xeon Scalable processors.
  * api-change:``route53resolver``: This release adds support for query type
    configuration on firewall rules that enables customers for granular action
    (ALLOW, ALERT, BLOCK) by DNS query type.
- From 1.32.14
  * api-change:``connect``: Minor trait updates for User APIs
  * api-change:``kms``: Documentation updates for AWS Key Management Service
    (KMS).
  * api-change:``redshift-serverless``: use_fips_ssl and require_ssl parameter
    support for Workgroup, UpdateWorkgroup, and CreateWorkgroup
- From 1.32.13
  * api-change:``config``: Updated ResourceType enum with new resource types onboarded by AWS Config in November and December 2023.
  * api-change:``docdb``: Adding PerformanceInsightsEnabled and
    PerformanceInsightsKMSKeyId fields to DescribeDBInstances Response.
  * api-change:``ecs``: This release adds support for managed instance
    draining which facilitates graceful termination of Amazon ECS instances.
  * api-change:``es``: This release adds support for new or existing Amazon
    OpenSearch domains to enable TLS 1.3 or TLS 1.2 with perfect forward
    secrecy cipher suites for domain endpoints.
  * api-change:``lightsail``: This release adds support to set up an HTTPS
    endpoint on an instance.
  * api-change:``opensearch``: This release adds support for new or existing
    Amazon OpenSearch domains to enable TLS 1.3 or TLS 1.2 with perfect forward
    secrecy cipher suites for domain endpoints.
  * api-change:``sagemaker``: Adding support for provisioned throughput mode
    for SageMaker Feature Groups
  * api-change:``servicecatalog``: Added Idempotency token support to Service
    Catalog  AssociateServiceActionWithProvisioningArtifact,
    DisassociateServiceActionFromProvisioningArtifact, DeleteServiceAction API
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.12
  * api-change:``connect``: Amazon Connect, Contact Lens Evaluation API
    increase evaluation notes max length to 3072.
  * api-change:``mediaconvert``: This release includes video engine updates
    including HEVC improvements, support for ingesting VP9 encoded video in
    MP4 containers, and support for user-specified 3D LUTs.
- From 1.32.11
  * api-change:``apprunner``: AWS App Runner adds Python 3.11 and Node.js 18
    runtimes.
  * api-change:``location``: This release introduces a new parameter to
    bypasses an API key's expiry conditions and delete the key.
  * api-change:``quicksight``: Add LinkEntityArn support for different
    partitions; Add UnsupportedUserEditionException in UpdateDashboardLinks
    API; Add support for New Reader Experience Topics
- From 1.32.10
  * api-change:``codestar-connections``: New integration with the GitLab
    self-managed provider type.
  * api-change:``kinesis-video-archived-media``: NoDataRetentionException
    thrown when GetImages requested for a Stream that does not retain data
    (that is, has a DataRetentionInHours of 0).
  * api-change:``sagemaker``: Amazon SageMaker Studio now supports Docker
    access from within app container
- From 1.32.9
  * api-change:``emr``: Update emr command to latest version
- From 1.32.8
  * api-change:``iam``: Documentation updates for AWS Identity and Access
    Management (IAM).
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.7
  * api-change:``bedrock-agent``: Adding Claude 2.1 support to Bedrock Agents
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
  * api-change:``glue``: This release adds additional configurations for Query
    Session Context on the following APIs: GetUnfilteredTableMetadata,
    GetUnfilteredPartitionMetadata, GetUnfilteredPartitionsMetadata.
  * api-change:``lakeformation``: This release adds additional configurations
    on GetTemporaryGlueTableCredentials for Query Session Context.
  * api-change:``mediaconnect``: This release adds the DescribeSourceMetadata
    API. This API can be used to view the stream information of the flow's
    source.
  * api-change:``networkmonitor``: CloudWatch Network Monitor is a new service
    within CloudWatch that will help network administrators and operators
    continuously monitor network performance metrics such as round-trip-time
    and packet loss between their AWS-hosted applications and their on-premises
    locations.
  * api-change:``omics``: Provides minor corrections and an updated description
    of APIs.
  * api-change:``secretsmanager``: Update endpoint rules and examples.
- From 1.32.6
  * api-change:``amp``: This release updates Amazon Managed Service for
    Prometheus APIs to support customer managed KMS keys.
  * api-change:``appintegrations``: The Amazon AppIntegrations service adds
    DeleteApplication API for deleting applications, and updates APIs to
    support third party applications reacting to workspace events and make
    data requests to Amazon Connect for agent and contact events.
  * api-change:``bedrock-agent``: This release introduces Amazon Aurora as a
    vector store on Knowledge Bases for Amazon Bedrock
  * api-change:``codecommit``: AWS CodeCommit now supports customer managed
    keys from AWS Key Management Service. UpdateRepositoryEncryptionKey is
    added for updating the key configuration. CreateRepository, GetRepository,
    BatchGetRepositories are updated with new input or output parameters.
  * api-change:``connect``: Adds APIs to manage User Proficiencies and
    Predefined Attributes. Enhances StartOutboundVoiceContact API input.
    Introduces SearchContacts API. Enhances DescribeContact API. Adds an API to
    update Routing Attributes in QueuePriority and QueueTimeAdjustmentSeconds.
  * api-change:``medialive``: MediaLive now supports the ability to configure
    the audio that an AWS Elemental Link UHD device produces, when the device
    is configured as the source for a flow in AWS Elemental MediaConnect.
  * api-change:``neptune-graph``: Adds Waiters for successful creation and
    deletion of Graph, Graph Snapshot, Import Task and Private Endpoints for
    Neptune Analytics
  * api-change:``rds-data``: This release adds support for using RDS Data API
    with Aurora PostgreSQL Serverless v2 and provisioned DB clusters.
  * api-change:``rds``: This release adds support for using RDS Data API with
    Aurora PostgreSQL Serverless v2 and provisioned DB clusters.
  * api-change:``sagemaker``: Amazon SageMaker Training now provides model
    training container access for debugging purposes. Amazon SageMaker Search
    now provides the ability to use visibility conditions to limit resource
    access to a single domain or multiple domains.
- From 1.32.5
  * api-change:``appstream``: This release introduces configurable clipboard,
    allowing admins to specify the maximum length of text that can be copied by
    the users from their device to the remote session and vice-versa.
  * api-change:``eks``: Add support for cluster insights, new EKS capability
    that surfaces potentially upgrade impacting issues.
  * api-change:``guardduty``: This release 1) introduces a new API:
    GetOrganizationStatistics , and 2) adds a new UsageStatisticType
    TOP_ACCOUNTS_BY_FEATURE for GetUsageStatistics API
  * api-change:``managedblockchain-query``: Adding Confirmation Status and
    Execution Status to GetTransaction Response.
  * api-change:``mediatailor``: Adds the ability to configure time shifting on
    MediaTailor channels using the TimeShiftConfiguration field
  * api-change:``route53``: Amazon Route 53 now supports the Canada West
    (Calgary) Region (ca-west-1) for latency records, geoproximity records,
    and private DNS for Amazon VPCs in that region.
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.4
  * api-change:``appsync``: This release adds additional configurations on
    GraphQL APIs for limits on query depth, resolver count, and introspection
  * api-change:``chime-sdk-meetings``: Add meeting features to specify a
    maximum camera resolution, a maximum content sharing resolution, and a
    maximum number of attendees for a given meeting.
  * api-change:``ec2``: Provision BYOIPv4 address ranges and advertise them by
    specifying the network border groups option in Los Angeles, Phoenix and
    Dallas AWS Local Zones.
  * api-change:``fsx``: Added support for FSx for OpenZFS on-demand data
    replication across AWS accounts and/or regions.Added the IncludeShared
    attribute for DescribeSnapshots.Added the CopyStrategy attribute for
    OpenZFSVolumeConfiguration.
  * api-change:``marketplace-catalog``: AWS Marketplace now supports a new API,
    BatchDescribeEntities, which returns metadata and content for multiple
    entities.
  * api-change:``rds``: RDS - The release adds two new APIs:
    DescribeDBRecommendations and ModifyDBRecommendation
- From 1.32.3
  * api-change:``cognito-idp``: Amazon Cognito now supports trigger versions
    that define the fields in the request sent to pre token generation Lambda
    triggers.
  * api-change:``eks``: Add support for EKS Cluster Access Management.
  * api-change:``quicksight``: A docs-only release to add missing entities to
    the API reference.
  * api-change:``route53resolver``: Add DOH protocols in resolver endpoints.
- From 1.32.2
  * enhancement:``cloudformation package``: Add support for intrinsic
    Fn:ForEach (fixes `#8075 &lt;https://github.com/aws/aws-cli/issues/8075&gt;`__)
  * api-change:``cloud9``: Updated Cloud9 API documentation for AL2023 release
  * api-change:``connect``: Adds relatedContactId field to
    StartOutboundVoiceContact API input. Introduces PauseContact API and
    ResumeContact API for Task contacts. Adds pause duration, number of pauses,
    timestamps for last paused and resumed events to DescribeContact API
    response. Adds new Rule type and new Rule action.
  * api-change:``connectcases``: Increase number of fields that can be included
    in CaseEventIncludedData from 50 to 200
  * api-change:``kms``: Documentation updates for AWS Key Management Service
  * api-change:``rds``: Updates Amazon RDS documentation by adding code examples
  * api-change:``sagemaker``: This release 1) introduces a new API:
    DeleteCompilationJob , and 2) adds InfraCheckConfig for Create/Describe
    training job API
- From 1.32.1
  * api-change:``appstream``: This release includes support for images of
    Windows Server 2022 platform.
  * api-change:``b2bi``: Documentation updates for AWS B2B Data Interchange
  * api-change:``billingconductor``: Billing Conductor is releasing a new API,
    GetBillingGroupCostReport, which provides the ability to retrieve/view the
    Billing Group Cost Report broken down by attributes for a specific billing
    group.
  * api-change:``connect``: This release adds support for more granular
    billing using tags (key:value pairs)
  * api-change:``controltower``: Documentation updates for AWS Control Tower.
  * api-change:``firehose``: This release, 1) adds configurable buffering hints
    for the Splunk destination, and 2) reduces the minimum configurable
    buffering interval for supported destinations
  * api-change:``gamelift``: Amazon GameLift adds the ability to add and update
    the game properties of active game sessions.
  * api-change:``iot``: This release adds the ability to self-manage
    certificate signing in AWS IoT Core fleet provisioning using the new
    certificate provider resource.
  * api-change:``neptune-graph``: This is the initial SDK release for Amazon
    Neptune Analytics
  * api-change:``opensearch``: Updating documentation for Amazon OpenSearch
    Service support for new zero-ETL integration with Amazon S3.
  * api-change:``quicksight``: Update Dashboard Links support;
    SingleAxisOptions support; Scatterplot Query limit support.
  * api-change:``workspaces``: Updated note to ensure customers understand
    running modes.
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.0
  * feature:Python: End of support for Python 3.7
  * api-change:``drs``: Adding AgentVersion to SourceServer and
    RecoveryInstance structures
  * feature:Python: End of support for Python 3.7
- From 1.31.13
  * api-change:``imagebuilder``: This release adds the Image Workflows feature
    to give more flexibility and control over the image building and testing
    process.
  * api-change:``location``: This release 1)  adds sub-municipality field in
    Places API for searching and getting places information, and 2) allows
    optimizing route calculation based on expected arrival time.
  * api-change:``logs``: This release introduces the StartLiveTail API to tail
    ingested logs in near real time.
- From 1.31.12
  * api-change:``neptune``: This release adds a new parameter configuration
    setting to the Neptune cluster related APIs that can be leveraged to
    switch between the underlying supported storage modes.
  * api-change:``pinpoint``: This release includes Amazon Pinpoint API
    documentation updates pertaining to campaign message sending rate limits.
  * api-change:``securityhub``: Added new resource detail objects to ASFF,
    including resources for AwsDynamoDbTable, AwsEc2ClientVpnEndpoint,
    AwsMskCluster, AwsS3AccessPoint, AwsS3Bucket
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="rjschwei@suse.com" date="1710331200">- Reconfigure the spec file support builds better in Factory and SLE
  supporting different Python interpreter versions</changelog>
</package>
<package pkgid="203ca79e4fb2f1b587df7263c9df1408e545431363515103b1151f7ab5e53bc9" name="aws-cli" arch="src">
  <version epoch="0" ver="1.32.31" rel="150400.35.3.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1674820800">- Update to version 1.27.58
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.58/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675425600">- Update to version 1.27.60
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.60/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675857600">- Update to version 1.27.66
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.66/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1676462400">- Update to version 1.27.71
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.71/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1677240000">- Update to version 1.27.78
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.78/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678708800">- Update to version 1.27.89
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.89/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680696000">- Update in SLE-15 (bsc#1209255, jsc#PED-3780)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1681905600">- Update to version 1.27.115
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.115/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683633600">- Update to version 1.27.130
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.130/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1686744000">- Update to version 1.27.153
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.153/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688040000">- Update to version 1.27.163
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.163/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1689076800">- Update to version 1.29.2
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.29.2/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692273600">- Update to version 1.29.27
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.29.27/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1693396800">- Update to version 1.29.36
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.29.27/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696593600">- Update to version 1.29.61
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.29.61/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700827200">- Update to version 1.30.6
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.30.6/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1702296000">- Update to version 1.31.11
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.31.11/CHANGELOG.rst
- Add patch to update docutils dependency (bsc#1217336)
  + ac_update-docutils.patch
- Update Requires in spec file from setup.py</changelog>
  <changelog author="rjschwei@suse.com" date="1706702400">- Switch to Python 3.11 build in SLE 15 SP4 and openSUSE Leap 15.4 and
  later (jsc#PCT-371)
- Switch to wheel build
- Update to version 1.32.31
  * Forward port ac_update-docutils.patch
  * api-change:``datazone``: Add new skipDeletionCheck to DeleteDomain. Add
    new skipDeletionCheck to DeleteProject which also automatically deletes
    dependent objects
  * api-change:``route53``: Update the SDKs for text changes in the APIs.
- From 1.32.30
  * api-change:``autoscaling``: EC2 Auto Scaling customers who use attribute
    based instance-type selection can now intuitively define their Spot
    instances price protection limit as a percentage of the lowest priced
    On-Demand instance type.
  * api-change:``comprehend``: Comprehend PII analysis now supports Spanish
    input documents.
  * api-change:``ec2``: EC2 Fleet customers who use attribute based
    instance-type selection can now intuitively define their Spot instances
    price protection limit as a percentage of the lowest priced On-Demand
    instance type.
  * api-change:``mwaa``: This release adds MAINTENANCE environment status for
    Amazon MWAA environments.
  * api-change:``rds``: Introduced support for the
    InsufficientDBInstanceCapacityFault error in the RDS
    RestoreDBClusterFromSnapshot and RestoreDBClusterToPointInTime API methods.
    This provides enhanced error handling, ensuring a more robust experience.
  * api-change:``snowball``: Modified description of createaddress to include
    direction to add path when providing a JSON file.
- From 1.32.29
  * api-change:``connect``: Update list and string length limits for predefined
    attributes.
  * api-change:``inspector2``: This release adds ECR container image scanning
    based on their lastRecordedPullTime.
  * api-change:``sagemaker``: Amazon SageMaker Automatic Model Tuning now
    provides an API to programmatically delete tuning jobs.
- From 1.32.28
  * api-change:``acm-pca``: AWS Private CA now supports an option to omit the
    CDP extension from issued certificates, when CRL revocation is enabled.
  * api-change:``lightsail``: This release adds support for IPv6-only instance
    plans.
- From 1.32.27
  * api-change:``ec2``: Introduced a new clientToken request parameter on
    CreateNetworkAcl and CreateRouteTable APIs. The clientToken parameter
    allows idempotent operations on the APIs.
  * api-change:``ecs``: Documentation updates for Amazon ECS.
  * api-change:``outposts``: DeviceSerialNumber parameter is now optional in
    StartConnection API
  * api-change:``rds``: This release adds support for Aurora Limitless Database.
  * api-change:``storagegateway``: Add DeprecationDate and SoftwareVersion to
    response of ListGateways.
- From 1.32.26
  * api-change:``inspector2``: This release adds support for CIS scans on EC2
    instances.
- From 1.32.25
  * bugfix:``s3 sync``: Disable S3 Express support for s3 sync command
- From 1.32.24
  * api-change:``appconfigdata``: Fix FIPS Endpoints in aws-us-gov.
  * api-change:``cloud9``: Doc-only update around removing AL1 from list of
    available AMIs for Cloud9
  * api-change:``cloudfront-keyvaluestore``: This release improves upon the
    DescribeKeyValueStore API by returning two additional fields, Status of the
    KeyValueStore and the FailureReason in case of failures during creation of
    KeyValueStore.
  * api-change:``connectcases``: This release adds the ability to view audit
    history on a case and introduces a new parameter, performedBy, for
    CreateCase and UpdateCase API's.
  * api-change:``ec2``: Documentation updates for Amazon EC2.
  * api-change:``ecs``: This release adds support for Transport Layer Security
    (TLS) and Configurable Timeout to ECS Service Connect. TLS facilitates
    privacy and data security for inter-service communications, while
    Configurable Timeout allows customized per-request timeout and idle timeout
    for Service Connect services.
  * api-change:``finspace``: Allow customer to set zip default through command
    line arguments.
  * api-change:``organizations``: Doc only update for quota increase change
  * api-change:``rds``: Introduced support for the
    InsufficientDBInstanceCapacityFault error in the RDS CreateDBCluster API
    method. This provides enhanced error handling, ensuring a more robust
    experience when creating database clusters with insufficient instance
    capacity.
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.23
  * api-change:``athena``: Introducing new NotebookS3LocationUri parameter to
    Athena ImportNotebook API. Payload is no longer required and either Payload
    or NotebookS3LocationUri needs to be provided (not both) for a successful
    ImportNotebook API call. If both are provided, an InvalidRequestException
    will be thrown.
  * api-change:``codebuild``: Release CodeBuild Reserved Capacity feature
  * api-change:``dynamodb``: This release adds support for including
    ApproximateCreationDateTimePrecision configurations in
    EnableKinesisStreamingDestination API, adds the same as an optional field
    in the response of DescribeKinesisStreamingDestination, and adds support
    for a new UpdateKinesisStreamingDestination API.
  * api-change:``qconnect``: Increased Quick Response name max length to 100
- From 1.32.22
  * api-change:``b2bi``: Increasing TestMapping inputFileContent file size
    limit to 5MB and adding file size limit 250KB for TestParsing input file.
    This release also includes exposing InternalServerException for Tag APIs.
  * api-change:``cloudtrail``: This release adds a new API
    ListInsightsMetricData to retrieve metric data from CloudTrail Insights.
  * api-change:``connect``: GetMetricDataV2 now supports 3 groupings
  * api-change:``drs``: Removed invalid and unnecessary default values.
  * api-change:``firehose``: Allow support for Snowflake as a Kinesis Data
    Firehose delivery destination.
  * api-change:``sagemaker-featurestore-runtime``: Increase BatchGetRecord
    limits from 10 items to 100 items
- From 1.32.21
  * api-change:``dynamodb``: Updating note for enabling streams for UpdateTable.
  * api-change:``keyspaces``: This release adds support for Multi-Region
    Replication with provisioned tables, and Keyspaces auto scaling APIs
- From 1.32.20
  * api-change:``iot``: Revert release of LogTargetTypes
  * api-change:``iotfleetwise``: Updated APIs: SignalNodeType query parameter
    has been added to ListSignalCatalogNodesRequest and ListVehiclesResponse
    has been extended with attributes field.
  * api-change:``macie2``: This release adds support for analyzing Amazon S3
    objects that are encrypted using dual-layer server-side encryption with
    AWS KMS keys (DSSE-KMS). It also adds support for reporting DSSE-KMS
    details in statistics and metadata about encryption settings for S3 buckets
    and objects.
  * api-change:``payment-cryptography``: Provide an additional option for key
    exchange using RSA wrap/unwrap in addition to tr-34/tr-31 in ImportKey and
    ExportKey operations. Added new key usage (type)
    TR31_M1_ISO_9797_1_MAC_KEY, for use with Generate/VerifyMac dataplane
    operations  with ISO9797 Algorithm 1 MAC calculations.
  * api-change:``personalize-runtime``: Documentation updates for Amazon
    Personalize
  * api-change:``personalize``: Documentation updates for Amazon Personalize.
  * api-change:``rekognition``: This release adds ContentType and TaxonomyLevel
    attributes to DetectModerationLabels and GetMediaAnalysisJob API responses.
  * api-change:``securityhub``: Documentation updates for AWS Security Hub
- From 1.32.19
  * api-change:``sagemaker``: This release will have ValidationException thrown
    if certain invalid app types are provided. The release will also throw
    ValidationException if more than 10 account ids are provided in
    VpcOnlyTrustedAccounts.
- From 1.32.18
  * api-change:``connect``: Supervisor Barge for Chat is now supported through
    the MonitorContact API.
  * api-change:``connectparticipant``: Introduce new Supervisor participant
    role
  * api-change:``location``: Location SDK documentation update. Added missing
    fonts to the MapConfiguration data type. Updated note for the
    SubMunicipality property in the place data type.
  * api-change:``mwaa``: This Amazon MWAA feature release includes new fields
    in CreateWebLoginToken response model. The new fields IamIdentity and
    AirflowIdentity will let you match identifications, as the Airflow identity
    length is currently hashed to 64 characters.
  * api-change:``s3control``: S3 On Outposts team adds dualstack endpoints
    support for S3Control and S3Outposts API calls.
  * api-change:``supplychain``: This release includes APIs
    CreateBillOfMaterialsImportJob and GetBillOfMaterialsImportJob.
  * api-change:``transfer``: AWS Transfer Family now supports static IP
    addresses for SFTP &amp; AS2 connectors and for async MDNs on AS2 servers.
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.17
  * api-change:``ec2``: This release adds support for adding an
    ElasticBlockStorage volume configurations in ECS
    RunTask/StartTask/CreateService/UpdateService APIs. The configuration
    allows for attaching EBS volumes to ECS Tasks.
  * api-change:``ecs``: This release adds support for adding an
    ElasticBlockStorage volume configurations in ECS
    RunTask/StartTask/CreateService/UpdateService APIs. The configuration
    allows for attaching EBS volumes to ECS Tasks.
  * api-change:``events``: Update events command to latest version
  * api-change:``iot``: Add ConflictException to Update APIs of AWS IoT
    Software Package Catalog
  * api-change:``iotfleetwise``: The following dataTypes have been removed:
    CUSTOMER_DECODED_INTERFACE in NetworkInterfaceType;
    CUSTOMER_DECODED_SIGNAL_INFO_IS_NULL in SignalDecoderFailureReason;
    CUSTOMER_DECODED_SIGNAL_NETWORK_INTERFACE_INFO_IS_NULL in
    NetworkInterfaceFailureReason; CUSTOMER_DECODED_SIGNAL in SignalDecoderType
  * api-change:``secretsmanager``: Doc only update for Secrets Manager
  * api-change:``workspaces``: Added AWS Workspaces RebootWorkspaces
    API - Extended Reboot documentation update
- From 1.32.16
  * api-change:``connectcampaigns``: Minor pattern updates for Campaign and
    Dial Request API fields.
  * api-change:``location``: This release adds API support for custom layers
    for the maps service APIs: CreateMap, UpdateMap, DescribeMap.
  * api-change:``logs``: Add support for account level subscription filter
    policies to PutAccountPolicy, DescribeAccountPolicies, and
    DeleteAccountPolicy APIs. Additionally, PutAccountPolicy has been modified
    with new optional "selectionCriteria" parameter for resource selection.
  * api-change:``qconnect``: QueryAssistant and GetRecommendations will be
    discontinued starting June 1, 2024. To receive generative responses after
    March 1, 2024 you will need to create a new Assistant in the Connect
    console and integrate the Amazon Q in Connect JavaScript library
    (amazon-q-connectjs) into your applications.
  * api-change:``redshift-serverless``: Updates to ConfigParameter for RSS
    workgroup, removal of use_fips_ssl
  * api-change:``route53``: Route53 now supports geoproximity routing in AWS
    regions
  * api-change:``wisdom``: QueryAssistant and GetRecommendations will be
    discontinued starting June 1, 2024. To receive generative responses after
    March 1, 2024 you will need to create a new Assistant in the Connect
    console and integrate the Amazon Q in Connect JavaScript library
    (amazon-q-connectjs) into your applications.
- From 1.32.15
  * api-change:``codebuild``: Aws CodeBuild now supports new compute type
    BUILD_GENERAL1_XLARGE
  * api-change:``ec2``: Amazon EC2 R7iz bare metal instances are powered by
    custom 4th generation Intel Xeon Scalable processors.
  * api-change:``route53resolver``: This release adds support for query type
    configuration on firewall rules that enables customers for granular action
    (ALLOW, ALERT, BLOCK) by DNS query type.
- From 1.32.14
  * api-change:``connect``: Minor trait updates for User APIs
  * api-change:``kms``: Documentation updates for AWS Key Management Service
    (KMS).
  * api-change:``redshift-serverless``: use_fips_ssl and require_ssl parameter
    support for Workgroup, UpdateWorkgroup, and CreateWorkgroup
- From 1.32.13
  * api-change:``config``: Updated ResourceType enum with new resource types onboarded by AWS Config in November and December 2023.
  * api-change:``docdb``: Adding PerformanceInsightsEnabled and
    PerformanceInsightsKMSKeyId fields to DescribeDBInstances Response.
  * api-change:``ecs``: This release adds support for managed instance
    draining which facilitates graceful termination of Amazon ECS instances.
  * api-change:``es``: This release adds support for new or existing Amazon
    OpenSearch domains to enable TLS 1.3 or TLS 1.2 with perfect forward
    secrecy cipher suites for domain endpoints.
  * api-change:``lightsail``: This release adds support to set up an HTTPS
    endpoint on an instance.
  * api-change:``opensearch``: This release adds support for new or existing
    Amazon OpenSearch domains to enable TLS 1.3 or TLS 1.2 with perfect forward
    secrecy cipher suites for domain endpoints.
  * api-change:``sagemaker``: Adding support for provisioned throughput mode
    for SageMaker Feature Groups
  * api-change:``servicecatalog``: Added Idempotency token support to Service
    Catalog  AssociateServiceActionWithProvisioningArtifact,
    DisassociateServiceActionFromProvisioningArtifact, DeleteServiceAction API
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.12
  * api-change:``connect``: Amazon Connect, Contact Lens Evaluation API
    increase evaluation notes max length to 3072.
  * api-change:``mediaconvert``: This release includes video engine updates
    including HEVC improvements, support for ingesting VP9 encoded video in
    MP4 containers, and support for user-specified 3D LUTs.
- From 1.32.11
  * api-change:``apprunner``: AWS App Runner adds Python 3.11 and Node.js 18
    runtimes.
  * api-change:``location``: This release introduces a new parameter to
    bypasses an API key's expiry conditions and delete the key.
  * api-change:``quicksight``: Add LinkEntityArn support for different
    partitions; Add UnsupportedUserEditionException in UpdateDashboardLinks
    API; Add support for New Reader Experience Topics
- From 1.32.10
  * api-change:``codestar-connections``: New integration with the GitLab
    self-managed provider type.
  * api-change:``kinesis-video-archived-media``: NoDataRetentionException
    thrown when GetImages requested for a Stream that does not retain data
    (that is, has a DataRetentionInHours of 0).
  * api-change:``sagemaker``: Amazon SageMaker Studio now supports Docker
    access from within app container
- From 1.32.9
  * api-change:``emr``: Update emr command to latest version
- From 1.32.8
  * api-change:``iam``: Documentation updates for AWS Identity and Access
    Management (IAM).
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.7
  * api-change:``bedrock-agent``: Adding Claude 2.1 support to Bedrock Agents
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
  * api-change:``glue``: This release adds additional configurations for Query
    Session Context on the following APIs: GetUnfilteredTableMetadata,
    GetUnfilteredPartitionMetadata, GetUnfilteredPartitionsMetadata.
  * api-change:``lakeformation``: This release adds additional configurations
    on GetTemporaryGlueTableCredentials for Query Session Context.
  * api-change:``mediaconnect``: This release adds the DescribeSourceMetadata
    API. This API can be used to view the stream information of the flow's
    source.
  * api-change:``networkmonitor``: CloudWatch Network Monitor is a new service
    within CloudWatch that will help network administrators and operators
    continuously monitor network performance metrics such as round-trip-time
    and packet loss between their AWS-hosted applications and their on-premises
    locations.
  * api-change:``omics``: Provides minor corrections and an updated description
    of APIs.
  * api-change:``secretsmanager``: Update endpoint rules and examples.
- From 1.32.6
  * api-change:``amp``: This release updates Amazon Managed Service for
    Prometheus APIs to support customer managed KMS keys.
  * api-change:``appintegrations``: The Amazon AppIntegrations service adds
    DeleteApplication API for deleting applications, and updates APIs to
    support third party applications reacting to workspace events and make
    data requests to Amazon Connect for agent and contact events.
  * api-change:``bedrock-agent``: This release introduces Amazon Aurora as a
    vector store on Knowledge Bases for Amazon Bedrock
  * api-change:``codecommit``: AWS CodeCommit now supports customer managed
    keys from AWS Key Management Service. UpdateRepositoryEncryptionKey is
    added for updating the key configuration. CreateRepository, GetRepository,
    BatchGetRepositories are updated with new input or output parameters.
  * api-change:``connect``: Adds APIs to manage User Proficiencies and
    Predefined Attributes. Enhances StartOutboundVoiceContact API input.
    Introduces SearchContacts API. Enhances DescribeContact API. Adds an API to
    update Routing Attributes in QueuePriority and QueueTimeAdjustmentSeconds.
  * api-change:``medialive``: MediaLive now supports the ability to configure
    the audio that an AWS Elemental Link UHD device produces, when the device
    is configured as the source for a flow in AWS Elemental MediaConnect.
  * api-change:``neptune-graph``: Adds Waiters for successful creation and
    deletion of Graph, Graph Snapshot, Import Task and Private Endpoints for
    Neptune Analytics
  * api-change:``rds-data``: This release adds support for using RDS Data API
    with Aurora PostgreSQL Serverless v2 and provisioned DB clusters.
  * api-change:``rds``: This release adds support for using RDS Data API with
    Aurora PostgreSQL Serverless v2 and provisioned DB clusters.
  * api-change:``sagemaker``: Amazon SageMaker Training now provides model
    training container access for debugging purposes. Amazon SageMaker Search
    now provides the ability to use visibility conditions to limit resource
    access to a single domain or multiple domains.
- From 1.32.5
  * api-change:``appstream``: This release introduces configurable clipboard,
    allowing admins to specify the maximum length of text that can be copied by
    the users from their device to the remote session and vice-versa.
  * api-change:``eks``: Add support for cluster insights, new EKS capability
    that surfaces potentially upgrade impacting issues.
  * api-change:``guardduty``: This release 1) introduces a new API:
    GetOrganizationStatistics , and 2) adds a new UsageStatisticType
    TOP_ACCOUNTS_BY_FEATURE for GetUsageStatistics API
  * api-change:``managedblockchain-query``: Adding Confirmation Status and
    Execution Status to GetTransaction Response.
  * api-change:``mediatailor``: Adds the ability to configure time shifting on
    MediaTailor channels using the TimeShiftConfiguration field
  * api-change:``route53``: Amazon Route 53 now supports the Canada West
    (Calgary) Region (ca-west-1) for latency records, geoproximity records,
    and private DNS for Amazon VPCs in that region.
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.4
  * api-change:``appsync``: This release adds additional configurations on
    GraphQL APIs for limits on query depth, resolver count, and introspection
  * api-change:``chime-sdk-meetings``: Add meeting features to specify a
    maximum camera resolution, a maximum content sharing resolution, and a
    maximum number of attendees for a given meeting.
  * api-change:``ec2``: Provision BYOIPv4 address ranges and advertise them by
    specifying the network border groups option in Los Angeles, Phoenix and
    Dallas AWS Local Zones.
  * api-change:``fsx``: Added support for FSx for OpenZFS on-demand data
    replication across AWS accounts and/or regions.Added the IncludeShared
    attribute for DescribeSnapshots.Added the CopyStrategy attribute for
    OpenZFSVolumeConfiguration.
  * api-change:``marketplace-catalog``: AWS Marketplace now supports a new API,
    BatchDescribeEntities, which returns metadata and content for multiple
    entities.
  * api-change:``rds``: RDS - The release adds two new APIs:
    DescribeDBRecommendations and ModifyDBRecommendation
- From 1.32.3
  * api-change:``cognito-idp``: Amazon Cognito now supports trigger versions
    that define the fields in the request sent to pre token generation Lambda
    triggers.
  * api-change:``eks``: Add support for EKS Cluster Access Management.
  * api-change:``quicksight``: A docs-only release to add missing entities to
    the API reference.
  * api-change:``route53resolver``: Add DOH protocols in resolver endpoints.
- From 1.32.2
  * enhancement:``cloudformation package``: Add support for intrinsic
    Fn:ForEach (fixes `#8075 &lt;https://github.com/aws/aws-cli/issues/8075&gt;`__)
  * api-change:``cloud9``: Updated Cloud9 API documentation for AL2023 release
  * api-change:``connect``: Adds relatedContactId field to
    StartOutboundVoiceContact API input. Introduces PauseContact API and
    ResumeContact API for Task contacts. Adds pause duration, number of pauses,
    timestamps for last paused and resumed events to DescribeContact API
    response. Adds new Rule type and new Rule action.
  * api-change:``connectcases``: Increase number of fields that can be included
    in CaseEventIncludedData from 50 to 200
  * api-change:``kms``: Documentation updates for AWS Key Management Service
  * api-change:``rds``: Updates Amazon RDS documentation by adding code examples
  * api-change:``sagemaker``: This release 1) introduces a new API:
    DeleteCompilationJob , and 2) adds InfraCheckConfig for Create/Describe
    training job API
- From 1.32.1
  * api-change:``appstream``: This release includes support for images of
    Windows Server 2022 platform.
  * api-change:``b2bi``: Documentation updates for AWS B2B Data Interchange
  * api-change:``billingconductor``: Billing Conductor is releasing a new API,
    GetBillingGroupCostReport, which provides the ability to retrieve/view the
    Billing Group Cost Report broken down by attributes for a specific billing
    group.
  * api-change:``connect``: This release adds support for more granular
    billing using tags (key:value pairs)
  * api-change:``controltower``: Documentation updates for AWS Control Tower.
  * api-change:``firehose``: This release, 1) adds configurable buffering hints
    for the Splunk destination, and 2) reduces the minimum configurable
    buffering interval for supported destinations
  * api-change:``gamelift``: Amazon GameLift adds the ability to add and update
    the game properties of active game sessions.
  * api-change:``iot``: This release adds the ability to self-manage
    certificate signing in AWS IoT Core fleet provisioning using the new
    certificate provider resource.
  * api-change:``neptune-graph``: This is the initial SDK release for Amazon
    Neptune Analytics
  * api-change:``opensearch``: Updating documentation for Amazon OpenSearch
    Service support for new zero-ETL integration with Amazon S3.
  * api-change:``quicksight``: Update Dashboard Links support;
    SingleAxisOptions support; Scatterplot Query limit support.
  * api-change:``workspaces``: Updated note to ensure customers understand
    running modes.
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.0
  * feature:Python: End of support for Python 3.7
  * api-change:``drs``: Adding AgentVersion to SourceServer and
    RecoveryInstance structures
  * feature:Python: End of support for Python 3.7
- From 1.31.13
  * api-change:``imagebuilder``: This release adds the Image Workflows feature
    to give more flexibility and control over the image building and testing
    process.
  * api-change:``location``: This release 1)  adds sub-municipality field in
    Places API for searching and getting places information, and 2) allows
    optimizing route calculation based on expected arrival time.
  * api-change:``logs``: This release introduces the StartLiveTail API to tail
    ingested logs in near real time.
- From 1.31.12
  * api-change:``neptune``: This release adds a new parameter configuration
    setting to the Neptune cluster related APIs that can be leveraged to
    switch between the underlying supported storage modes.
  * api-change:``pinpoint``: This release includes Amazon Pinpoint API
    documentation updates pertaining to campaign message sending rate limits.
  * api-change:``securityhub``: Added new resource detail objects to ASFF,
    including resources for AwsDynamoDbTable, AwsEc2ClientVpnEndpoint,
    AwsMskCluster, AwsS3AccessPoint, AwsS3Bucket
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="rjschwei@suse.com" date="1710331200">- Reconfigure the spec file support builds better in Factory and SLE
  supporting different Python interpreter versions</changelog>
</package>
<package pkgid="cb9b5ab21c30811487bbff216c03e8d35984d63256b1f97303656f7774154c0d" name="aws-iam-authenticator" arch="aarch64">
  <version epoch="0" ver="0.5.3" rel="150000.1.12.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1557835200">- Initial build
  + Version 0.4.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558612800">- Include in SLE-15 (fate#327747, bsc#1098521)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1621512000">- Update to version 0.5.3
  * Bump Go to 1.15 in Travis (#361)
  * Update aws sdk go v1.37.1 (#360)
  * (arn): validate partition against all partitions returned by the aws sdk (#348)
  * Document AccessKeyId from UserInfo (#332)
  * Support IPv6 listen address (#352)
  * Added user agent to AWS SDK (#359)
  * Remove Chris Hein from OWNERS (#351)
  * Add instructions for the release process (#346)
- from version 0.5.2
  * Added partition flag (#341)
  * Update link to Kops docs site (#338)
  * Security Improvements on the example yaml (#335)
  * Fix RBAC on example file: service account requires get to ConfigMap (#334)
  * Add AccessKeyID as variable for username (#337)
  * Added server side AWS account ID log redaction (#327)
- from version 0.5.1
  * Update examples/README (#317)
  * Changelog gen (#318)
  * Fix CRD mapper blocking all others because caches
    never sync and revamp backend-mode flag (#303)
  * Update aws-sdk-go to version v1.30.0 (#306)
  * Bump k8s.io/ dependencies to 1.16.8 (#305)
  * chown aws-iam-authenticator to avoid permission denied (#302)
  * Indentation and unit test improvements (#298)
  * Adding Rate limiting ec2:DescribeInstances API
    along with Batching for high TPS (#292)
  * Restrict ClusterRole to readonly IAMIdentityMapping access (#287)
  * added selector to spec and changed from extenstions to apps/v1 (#291)
  * Add AWS AccessKeyID as an extra field in UserInfo (#286)
  * Allow server port customization (#278)
- from version 0.5.0
  * Remove DNS-1123 validation of usernames and groups (#260)
  * switch to use regional sts endpoint &amp; imdsV2 (#283)
  * Add AWS Access Key ID to log (#282)
  * Require to pass in interface instead of the concrete type (#279)
  * Refactor to allow configurable backends (configmap, eks configmap, crd) (#269)
  * Update go version (#255)
  * Adding session name parameter to TokenGenerator (#272)
  * Rename prometheus metrics to match new project name (#249)
  * Remove inactive approvers, add wongma7 (#266)
  * Update aws-sdk-go to v1.23.11 (257)
  * Added go module download check (#259)
  * Updating goreleaser yaml to fix deprecated options (#252)
  * Remove deprecated language from README (#244)
  * Lowercase ARN inside doMapping and log about it (#239)
  * IAMIdentityMapping CRD Implementation (#116)
  * Adding micahhausler as approver (#237)
  * add support for passing externalID to assume role (#228)
  * Update README.md (#231)
  * Using sigs.k8s.io domain instead of github.com (#223)
  * Refactored EC2 API calls to be testable (#226)
  * Include aws request ID when logging errors (#178)
- Remove global Go project variables
- Set GO111MODULE=off to force use of vendored modules
- Update Go build paths</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1648728000">- Update in SLE-15 (bsc#1197703)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1657627200">- Add patch to fix AccessKeyID validation bypass (bsc#1201395, CVE-2022-2385)
  * 0001-Add-query-parameter-validation-for-multiple-parameters.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1733918400">- Add patch to fix CORS bypass in go-restful (bsc#1200528, CVE-2022-1996)
  * 0002-CVE-2022-1996.patch</changelog>
</package>
<package pkgid="67f259f0cb5ca214fbeb9b26337e0b5b73d3bf700fddb6c4826ca81874f5c7a1" name="aws-iam-authenticator" arch="ppc64le">
  <version epoch="0" ver="0.5.3" rel="150000.1.12.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1557835200">- Initial build
  + Version 0.4.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558612800">- Include in SLE-15 (fate#327747, bsc#1098521)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1621512000">- Update to version 0.5.3
  * Bump Go to 1.15 in Travis (#361)
  * Update aws sdk go v1.37.1 (#360)
  * (arn): validate partition against all partitions returned by the aws sdk (#348)
  * Document AccessKeyId from UserInfo (#332)
  * Support IPv6 listen address (#352)
  * Added user agent to AWS SDK (#359)
  * Remove Chris Hein from OWNERS (#351)
  * Add instructions for the release process (#346)
- from version 0.5.2
  * Added partition flag (#341)
  * Update link to Kops docs site (#338)
  * Security Improvements on the example yaml (#335)
  * Fix RBAC on example file: service account requires get to ConfigMap (#334)
  * Add AccessKeyID as variable for username (#337)
  * Added server side AWS account ID log redaction (#327)
- from version 0.5.1
  * Update examples/README (#317)
  * Changelog gen (#318)
  * Fix CRD mapper blocking all others because caches
    never sync and revamp backend-mode flag (#303)
  * Update aws-sdk-go to version v1.30.0 (#306)
  * Bump k8s.io/ dependencies to 1.16.8 (#305)
  * chown aws-iam-authenticator to avoid permission denied (#302)
  * Indentation and unit test improvements (#298)
  * Adding Rate limiting ec2:DescribeInstances API
    along with Batching for high TPS (#292)
  * Restrict ClusterRole to readonly IAMIdentityMapping access (#287)
  * added selector to spec and changed from extenstions to apps/v1 (#291)
  * Add AWS AccessKeyID as an extra field in UserInfo (#286)
  * Allow server port customization (#278)
- from version 0.5.0
  * Remove DNS-1123 validation of usernames and groups (#260)
  * switch to use regional sts endpoint &amp; imdsV2 (#283)
  * Add AWS Access Key ID to log (#282)
  * Require to pass in interface instead of the concrete type (#279)
  * Refactor to allow configurable backends (configmap, eks configmap, crd) (#269)
  * Update go version (#255)
  * Adding session name parameter to TokenGenerator (#272)
  * Rename prometheus metrics to match new project name (#249)
  * Remove inactive approvers, add wongma7 (#266)
  * Update aws-sdk-go to v1.23.11 (257)
  * Added go module download check (#259)
  * Updating goreleaser yaml to fix deprecated options (#252)
  * Remove deprecated language from README (#244)
  * Lowercase ARN inside doMapping and log about it (#239)
  * IAMIdentityMapping CRD Implementation (#116)
  * Adding micahhausler as approver (#237)
  * add support for passing externalID to assume role (#228)
  * Update README.md (#231)
  * Using sigs.k8s.io domain instead of github.com (#223)
  * Refactored EC2 API calls to be testable (#226)
  * Include aws request ID when logging errors (#178)
- Remove global Go project variables
- Set GO111MODULE=off to force use of vendored modules
- Update Go build paths</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1648728000">- Update in SLE-15 (bsc#1197703)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1657627200">- Add patch to fix AccessKeyID validation bypass (bsc#1201395, CVE-2022-2385)
  * 0001-Add-query-parameter-validation-for-multiple-parameters.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1733918400">- Add patch to fix CORS bypass in go-restful (bsc#1200528, CVE-2022-1996)
  * 0002-CVE-2022-1996.patch</changelog>
</package>
<package pkgid="7c1d88c011dd1ba71ae7787eb4f6df199699c249a9d7b40d2bd412ee5235f682" name="aws-iam-authenticator" arch="s390x">
  <version epoch="0" ver="0.5.3" rel="150000.1.12.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1557835200">- Initial build
  + Version 0.4.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558612800">- Include in SLE-15 (fate#327747, bsc#1098521)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1621512000">- Update to version 0.5.3
  * Bump Go to 1.15 in Travis (#361)
  * Update aws sdk go v1.37.1 (#360)
  * (arn): validate partition against all partitions returned by the aws sdk (#348)
  * Document AccessKeyId from UserInfo (#332)
  * Support IPv6 listen address (#352)
  * Added user agent to AWS SDK (#359)
  * Remove Chris Hein from OWNERS (#351)
  * Add instructions for the release process (#346)
- from version 0.5.2
  * Added partition flag (#341)
  * Update link to Kops docs site (#338)
  * Security Improvements on the example yaml (#335)
  * Fix RBAC on example file: service account requires get to ConfigMap (#334)
  * Add AccessKeyID as variable for username (#337)
  * Added server side AWS account ID log redaction (#327)
- from version 0.5.1
  * Update examples/README (#317)
  * Changelog gen (#318)
  * Fix CRD mapper blocking all others because caches
    never sync and revamp backend-mode flag (#303)
  * Update aws-sdk-go to version v1.30.0 (#306)
  * Bump k8s.io/ dependencies to 1.16.8 (#305)
  * chown aws-iam-authenticator to avoid permission denied (#302)
  * Indentation and unit test improvements (#298)
  * Adding Rate limiting ec2:DescribeInstances API
    along with Batching for high TPS (#292)
  * Restrict ClusterRole to readonly IAMIdentityMapping access (#287)
  * added selector to spec and changed from extenstions to apps/v1 (#291)
  * Add AWS AccessKeyID as an extra field in UserInfo (#286)
  * Allow server port customization (#278)
- from version 0.5.0
  * Remove DNS-1123 validation of usernames and groups (#260)
  * switch to use regional sts endpoint &amp; imdsV2 (#283)
  * Add AWS Access Key ID to log (#282)
  * Require to pass in interface instead of the concrete type (#279)
  * Refactor to allow configurable backends (configmap, eks configmap, crd) (#269)
  * Update go version (#255)
  * Adding session name parameter to TokenGenerator (#272)
  * Rename prometheus metrics to match new project name (#249)
  * Remove inactive approvers, add wongma7 (#266)
  * Update aws-sdk-go to v1.23.11 (257)
  * Added go module download check (#259)
  * Updating goreleaser yaml to fix deprecated options (#252)
  * Remove deprecated language from README (#244)
  * Lowercase ARN inside doMapping and log about it (#239)
  * IAMIdentityMapping CRD Implementation (#116)
  * Adding micahhausler as approver (#237)
  * add support for passing externalID to assume role (#228)
  * Update README.md (#231)
  * Using sigs.k8s.io domain instead of github.com (#223)
  * Refactored EC2 API calls to be testable (#226)
  * Include aws request ID when logging errors (#178)
- Remove global Go project variables
- Set GO111MODULE=off to force use of vendored modules
- Update Go build paths</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1648728000">- Update in SLE-15 (bsc#1197703)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1657627200">- Add patch to fix AccessKeyID validation bypass (bsc#1201395, CVE-2022-2385)
  * 0001-Add-query-parameter-validation-for-multiple-parameters.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1733918400">- Add patch to fix CORS bypass in go-restful (bsc#1200528, CVE-2022-1996)
  * 0002-CVE-2022-1996.patch</changelog>
</package>
<package pkgid="50a830d01918061d4eb1e2e9cc106b5d565bc6b7641510772e12927fd4f242f1" name="aws-iam-authenticator" arch="src">
  <version epoch="0" ver="0.5.3" rel="150000.1.12.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1557835200">- Initial build
  + Version 0.4.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558612800">- Include in SLE-15 (fate#327747, bsc#1098521)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1621512000">- Update to version 0.5.3
  * Bump Go to 1.15 in Travis (#361)
  * Update aws sdk go v1.37.1 (#360)
  * (arn): validate partition against all partitions returned by the aws sdk (#348)
  * Document AccessKeyId from UserInfo (#332)
  * Support IPv6 listen address (#352)
  * Added user agent to AWS SDK (#359)
  * Remove Chris Hein from OWNERS (#351)
  * Add instructions for the release process (#346)
- from version 0.5.2
  * Added partition flag (#341)
  * Update link to Kops docs site (#338)
  * Security Improvements on the example yaml (#335)
  * Fix RBAC on example file: service account requires get to ConfigMap (#334)
  * Add AccessKeyID as variable for username (#337)
  * Added server side AWS account ID log redaction (#327)
- from version 0.5.1
  * Update examples/README (#317)
  * Changelog gen (#318)
  * Fix CRD mapper blocking all others because caches
    never sync and revamp backend-mode flag (#303)
  * Update aws-sdk-go to version v1.30.0 (#306)
  * Bump k8s.io/ dependencies to 1.16.8 (#305)
  * chown aws-iam-authenticator to avoid permission denied (#302)
  * Indentation and unit test improvements (#298)
  * Adding Rate limiting ec2:DescribeInstances API
    along with Batching for high TPS (#292)
  * Restrict ClusterRole to readonly IAMIdentityMapping access (#287)
  * added selector to spec and changed from extenstions to apps/v1 (#291)
  * Add AWS AccessKeyID as an extra field in UserInfo (#286)
  * Allow server port customization (#278)
- from version 0.5.0
  * Remove DNS-1123 validation of usernames and groups (#260)
  * switch to use regional sts endpoint &amp; imdsV2 (#283)
  * Add AWS Access Key ID to log (#282)
  * Require to pass in interface instead of the concrete type (#279)
  * Refactor to allow configurable backends (configmap, eks configmap, crd) (#269)
  * Update go version (#255)
  * Adding session name parameter to TokenGenerator (#272)
  * Rename prometheus metrics to match new project name (#249)
  * Remove inactive approvers, add wongma7 (#266)
  * Update aws-sdk-go to v1.23.11 (257)
  * Added go module download check (#259)
  * Updating goreleaser yaml to fix deprecated options (#252)
  * Remove deprecated language from README (#244)
  * Lowercase ARN inside doMapping and log about it (#239)
  * IAMIdentityMapping CRD Implementation (#116)
  * Adding micahhausler as approver (#237)
  * add support for passing externalID to assume role (#228)
  * Update README.md (#231)
  * Using sigs.k8s.io domain instead of github.com (#223)
  * Refactored EC2 API calls to be testable (#226)
  * Include aws request ID when logging errors (#178)
- Remove global Go project variables
- Set GO111MODULE=off to force use of vendored modules
- Update Go build paths</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1648728000">- Update in SLE-15 (bsc#1197703)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1657627200">- Add patch to fix AccessKeyID validation bypass (bsc#1201395, CVE-2022-2385)
  * 0001-Add-query-parameter-validation-for-multiple-parameters.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1733918400">- Add patch to fix CORS bypass in go-restful (bsc#1200528, CVE-2022-1996)
  * 0002-CVE-2022-1996.patch</changelog>
</package>
<package pkgid="596be381e18ebea7b44912d3a01ee7800059ff7cb2961a83700887c8af60b240" name="aws-iam-authenticator" arch="x86_64">
  <version epoch="0" ver="0.5.3" rel="150000.1.12.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1557835200">- Initial build
  + Version 0.4.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558612800">- Include in SLE-15 (fate#327747, bsc#1098521)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1621512000">- Update to version 0.5.3
  * Bump Go to 1.15 in Travis (#361)
  * Update aws sdk go v1.37.1 (#360)
  * (arn): validate partition against all partitions returned by the aws sdk (#348)
  * Document AccessKeyId from UserInfo (#332)
  * Support IPv6 listen address (#352)
  * Added user agent to AWS SDK (#359)
  * Remove Chris Hein from OWNERS (#351)
  * Add instructions for the release process (#346)
- from version 0.5.2
  * Added partition flag (#341)
  * Update link to Kops docs site (#338)
  * Security Improvements on the example yaml (#335)
  * Fix RBAC on example file: service account requires get to ConfigMap (#334)
  * Add AccessKeyID as variable for username (#337)
  * Added server side AWS account ID log redaction (#327)
- from version 0.5.1
  * Update examples/README (#317)
  * Changelog gen (#318)
  * Fix CRD mapper blocking all others because caches
    never sync and revamp backend-mode flag (#303)
  * Update aws-sdk-go to version v1.30.0 (#306)
  * Bump k8s.io/ dependencies to 1.16.8 (#305)
  * chown aws-iam-authenticator to avoid permission denied (#302)
  * Indentation and unit test improvements (#298)
  * Adding Rate limiting ec2:DescribeInstances API
    along with Batching for high TPS (#292)
  * Restrict ClusterRole to readonly IAMIdentityMapping access (#287)
  * added selector to spec and changed from extenstions to apps/v1 (#291)
  * Add AWS AccessKeyID as an extra field in UserInfo (#286)
  * Allow server port customization (#278)
- from version 0.5.0
  * Remove DNS-1123 validation of usernames and groups (#260)
  * switch to use regional sts endpoint &amp; imdsV2 (#283)
  * Add AWS Access Key ID to log (#282)
  * Require to pass in interface instead of the concrete type (#279)
  * Refactor to allow configurable backends (configmap, eks configmap, crd) (#269)
  * Update go version (#255)
  * Adding session name parameter to TokenGenerator (#272)
  * Rename prometheus metrics to match new project name (#249)
  * Remove inactive approvers, add wongma7 (#266)
  * Update aws-sdk-go to v1.23.11 (257)
  * Added go module download check (#259)
  * Updating goreleaser yaml to fix deprecated options (#252)
  * Remove deprecated language from README (#244)
  * Lowercase ARN inside doMapping and log about it (#239)
  * IAMIdentityMapping CRD Implementation (#116)
  * Adding micahhausler as approver (#237)
  * add support for passing externalID to assume role (#228)
  * Update README.md (#231)
  * Using sigs.k8s.io domain instead of github.com (#223)
  * Refactored EC2 API calls to be testable (#226)
  * Include aws request ID when logging errors (#178)
- Remove global Go project variables
- Set GO111MODULE=off to force use of vendored modules
- Update Go build paths</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1648728000">- Update in SLE-15 (bsc#1197703)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1657627200">- Add patch to fix AccessKeyID validation bypass (bsc#1201395, CVE-2022-2385)
  * 0001-Add-query-parameter-validation-for-multiple-parameters.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1733918400">- Add patch to fix CORS bypass in go-restful (bsc#1200528, CVE-2022-1996)
  * 0002-CVE-2022-1996.patch</changelog>
</package>
<package pkgid="a4dcc3b3d0ccf84f536848f87dcf1cc944c5a5cb45776b474f7120a1d9213f6f" name="aws-nitro-enclaves-binaryblobs-upstream" arch="aarch64">
  <version epoch="0" ver="1.3.0~git1.db34c02" rel="150600.10.3.1"/>
  <changelog author="olaf@aepfle.de" date="1637582400">- Initial version 1.1.0~git8.a46465e (bsc#1179544, jsc#SLE-22954)</changelog>
  <changelog author="olaf@aepfle.de" date="1639483200">- Update to version 1.1.0~git16.860cfe4 to get all the precious cargo
  (bsc#1195053)</changelog>
  <changelog author="olaf@aepfle.de" date="1643025600">- Update to version 1.1.0~git32.8f6ed74 to get all the precious cargo
- init.c is maintained in aws-nitro-enclaves-sdk-bootstrap.git</changelog>
  <changelog author="olaf@aepfle.de" date="1647518400">- Update to version 1.2.0~git2.841ef94 to get all the precious cargo
  (bsc#1196972, CVE-2022-24713)</changelog>
  <changelog author="olaf@aepfle.de" date="1677844800">- Update to version 1.2.2~git0.4ccc639 to get all the precious cargo
  (bsc#1208555, CVE-2022-31394)</changelog>
  <changelog author="olaf@aepfle.de" date="1712232000">- Update to version 1.2.3~git11.d3d77e0 to get all the precious cargo
  (bsc#1218501, CVE-2023-50711)</changelog>
  <changelog author="olaf@aepfle.de" date="1714478400">- Update to version 1.3.0~git0.be13960</changelog>
  <changelog author="olaf@aepfle.de" date="1716379200">- Update to version 1.3.0~git1.db34c02
- Update aws-nitro-enclaves-sdk-bootstrap to version v1.0.0 (203242d5)</changelog>
</package>
<package pkgid="7cfc2ebc5d95a7e714920729aae6acf830f418d19c745507b7c2198f47992734" name="aws-nitro-enclaves-binaryblobs-upstream" arch="x86_64">
  <version epoch="0" ver="1.3.0~git1.db34c02" rel="150600.10.3.1"/>
  <changelog author="olaf@aepfle.de" date="1637582400">- Initial version 1.1.0~git8.a46465e (bsc#1179544, jsc#SLE-22954)</changelog>
  <changelog author="olaf@aepfle.de" date="1639483200">- Update to version 1.1.0~git16.860cfe4 to get all the precious cargo
  (bsc#1195053)</changelog>
  <changelog author="olaf@aepfle.de" date="1643025600">- Update to version 1.1.0~git32.8f6ed74 to get all the precious cargo
- init.c is maintained in aws-nitro-enclaves-sdk-bootstrap.git</changelog>
  <changelog author="olaf@aepfle.de" date="1647518400">- Update to version 1.2.0~git2.841ef94 to get all the precious cargo
  (bsc#1196972, CVE-2022-24713)</changelog>
  <changelog author="olaf@aepfle.de" date="1677844800">- Update to version 1.2.2~git0.4ccc639 to get all the precious cargo
  (bsc#1208555, CVE-2022-31394)</changelog>
  <changelog author="olaf@aepfle.de" date="1712232000">- Update to version 1.2.3~git11.d3d77e0 to get all the precious cargo
  (bsc#1218501, CVE-2023-50711)</changelog>
  <changelog author="olaf@aepfle.de" date="1714478400">- Update to version 1.3.0~git0.be13960</changelog>
  <changelog author="olaf@aepfle.de" date="1716379200">- Update to version 1.3.0~git1.db34c02
- Update aws-nitro-enclaves-sdk-bootstrap to version v1.0.0 (203242d5)</changelog>
</package>
<package pkgid="854ecd3e41c450a97aeafe1bd9d17365a711efd9603b0a17de97a81574ed13cd" name="aws-nitro-enclaves-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~git1.db34c02" rel="150600.10.3.1"/>
  <changelog author="olaf@aepfle.de" date="1637582400">- Initial version 1.1.0~git8.a46465e (bsc#1179544, jsc#SLE-22954)</changelog>
  <changelog author="olaf@aepfle.de" date="1639483200">- Update to version 1.1.0~git16.860cfe4 to get all the precious cargo
  (bsc#1195053)</changelog>
  <changelog author="olaf@aepfle.de" date="1643025600">- Update to version 1.1.0~git32.8f6ed74 to get all the precious cargo
- init.c is maintained in aws-nitro-enclaves-sdk-bootstrap.git</changelog>
  <changelog author="olaf@aepfle.de" date="1647518400">- Update to version 1.2.0~git2.841ef94 to get all the precious cargo
  (bsc#1196972, CVE-2022-24713)</changelog>
  <changelog author="olaf@aepfle.de" date="1677844800">- Update to version 1.2.2~git0.4ccc639 to get all the precious cargo
  (bsc#1208555, CVE-2022-31394)</changelog>
  <changelog author="olaf@aepfle.de" date="1712232000">- Update to version 1.2.3~git11.d3d77e0 to get all the precious cargo
  (bsc#1218501, CVE-2023-50711)</changelog>
  <changelog author="olaf@aepfle.de" date="1714478400">- Update to version 1.3.0~git0.be13960</changelog>
  <changelog author="olaf@aepfle.de" date="1716379200">- Update to version 1.3.0~git1.db34c02
- Update aws-nitro-enclaves-sdk-bootstrap to version v1.0.0 (203242d5)</changelog>
</package>
<package pkgid="7d324ee70ea4fb2ef8993fd408403734b4de995d8a2acd76a496092256daa63c" name="aws-nitro-enclaves-cli" arch="src">
  <version epoch="0" ver="1.3.0~git1.db34c02" rel="150600.10.3.1"/>
  <changelog author="olaf@aepfle.de" date="1637582400">- Initial version 1.1.0~git8.a46465e (bsc#1179544, jsc#SLE-22954)</changelog>
  <changelog author="olaf@aepfle.de" date="1639483200">- Update to version 1.1.0~git16.860cfe4 to get all the precious cargo
  (bsc#1195053)</changelog>
  <changelog author="olaf@aepfle.de" date="1643025600">- Update to version 1.1.0~git32.8f6ed74 to get all the precious cargo
- init.c is maintained in aws-nitro-enclaves-sdk-bootstrap.git</changelog>
  <changelog author="olaf@aepfle.de" date="1647518400">- Update to version 1.2.0~git2.841ef94 to get all the precious cargo
  (bsc#1196972, CVE-2022-24713)</changelog>
  <changelog author="olaf@aepfle.de" date="1677844800">- Update to version 1.2.2~git0.4ccc639 to get all the precious cargo
  (bsc#1208555, CVE-2022-31394)</changelog>
  <changelog author="olaf@aepfle.de" date="1712232000">- Update to version 1.2.3~git11.d3d77e0 to get all the precious cargo
  (bsc#1218501, CVE-2023-50711)</changelog>
  <changelog author="olaf@aepfle.de" date="1714478400">- Update to version 1.3.0~git0.be13960</changelog>
  <changelog author="olaf@aepfle.de" date="1716379200">- Update to version 1.3.0~git1.db34c02
- Update aws-nitro-enclaves-sdk-bootstrap to version v1.0.0 (203242d5)</changelog>
</package>
<package pkgid="e643f5644ab298513732c28bad6f7099eb30df2e91fc68238ef24de43e3027b4" name="aws-nitro-enclaves-cli" arch="x86_64">
  <version epoch="0" ver="1.3.0~git1.db34c02" rel="150600.10.3.1"/>
  <changelog author="olaf@aepfle.de" date="1637582400">- Initial version 1.1.0~git8.a46465e (bsc#1179544, jsc#SLE-22954)</changelog>
  <changelog author="olaf@aepfle.de" date="1639483200">- Update to version 1.1.0~git16.860cfe4 to get all the precious cargo
  (bsc#1195053)</changelog>
  <changelog author="olaf@aepfle.de" date="1643025600">- Update to version 1.1.0~git32.8f6ed74 to get all the precious cargo
- init.c is maintained in aws-nitro-enclaves-sdk-bootstrap.git</changelog>
  <changelog author="olaf@aepfle.de" date="1647518400">- Update to version 1.2.0~git2.841ef94 to get all the precious cargo
  (bsc#1196972, CVE-2022-24713)</changelog>
  <changelog author="olaf@aepfle.de" date="1677844800">- Update to version 1.2.2~git0.4ccc639 to get all the precious cargo
  (bsc#1208555, CVE-2022-31394)</changelog>
  <changelog author="olaf@aepfle.de" date="1712232000">- Update to version 1.2.3~git11.d3d77e0 to get all the precious cargo
  (bsc#1218501, CVE-2023-50711)</changelog>
  <changelog author="olaf@aepfle.de" date="1714478400">- Update to version 1.3.0~git0.be13960</changelog>
  <changelog author="olaf@aepfle.de" date="1716379200">- Update to version 1.3.0~git1.db34c02
- Update aws-nitro-enclaves-sdk-bootstrap to version v1.0.0 (203242d5)</changelog>
</package>
<package pkgid="9788e9c7cdea596d7aacde59f12e8f8dd55ba545547ac7b720eb7a0e2b41c5ea" name="azure-cli" arch="noarch">
  <version epoch="0" ver="2.58.0" rel="150400.14.6.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1673352000">- New upstream release
  + Version 2.44.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1674043200">- New upstream release
  + Version 2.44.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675944000">- New upstream release
  + Version 2.45.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678190400">- New upstream release (bsc#1199592)
  + Version 2.46.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680609600">- New upstream release
  + Version 2.47.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683115200">- New upstream release
  + Version 2.48.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684929600">- New upstream release
  + Version 2.49.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688644800">- New upstream release
  + Version 2.50.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 2.51.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1694088000">- New upstream release
  + Version 2.52.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696420800">- New upstream release
  + Version 2.53.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1698667200">- New upstream release
  + Version 2.53.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700049600">- New upstream release
  + Version 2.54.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1704283200">- New upstream release
  + Version 2.55.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1705579200">- New upstream release
  + Version 2.56.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707307200">- New upstream release
  + Version 2.57.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1709726400">- New upstream release
  + Version 2.58.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1715083200">- Add Obsoletes for python3-azure-functions-devops-build package on SLE-15
- Remove azure-cli-command-modules-nspkg from BuildRequires and Requires</changelog>
</package>
<package pkgid="6d4687b8958fa80bba11f72daee171a0d9a89c2a0d9f940c4bbbbadae106b71b" name="azure-cli" arch="src">
  <version epoch="0" ver="2.58.0" rel="150400.14.6.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1673352000">- New upstream release
  + Version 2.44.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1674043200">- New upstream release
  + Version 2.44.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675944000">- New upstream release
  + Version 2.45.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678190400">- New upstream release (bsc#1199592)
  + Version 2.46.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680609600">- New upstream release
  + Version 2.47.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683115200">- New upstream release
  + Version 2.48.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684929600">- New upstream release
  + Version 2.49.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688644800">- New upstream release
  + Version 2.50.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 2.51.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1694088000">- New upstream release
  + Version 2.52.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696420800">- New upstream release
  + Version 2.53.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1698667200">- New upstream release
  + Version 2.53.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700049600">- New upstream release
  + Version 2.54.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1704283200">- New upstream release
  + Version 2.55.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1705579200">- New upstream release
  + Version 2.56.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707307200">- New upstream release
  + Version 2.57.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1709726400">- New upstream release
  + Version 2.58.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1715083200">- Add Obsoletes for python3-azure-functions-devops-build package on SLE-15
- Remove azure-cli-command-modules-nspkg from BuildRequires and Requires</changelog>
</package>
<package pkgid="df74fc7e62af29cb427cb4d548d832eb4e2eed29f845d4893988ea6df820330b" name="azure-cli-core" arch="noarch">
  <version epoch="0" ver="2.58.0" rel="150400.14.3.2"/>
  <changelog author="adrian.glaubitz@suse.com" date="1670328000">- New upstream release
  + Version 2.43.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1673352000">- New upstream release
  + Version 2.44.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Drop patches for issues fixed upstream
  + acc_update-argcomplete.patch
- Relax version dependency for python-packaging
  in BuildRequires (bsc#1206869)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1674043200">- New upstream release
  + Version 2.44.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675944000">- New upstream release
  + Version 2.45.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678190400">- New upstream release (bsc#1199592)
  + Version 2.46.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680609600">- New upstream release
  + Version 2.47.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683115200">- New upstream release
  + Version 2.48.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684929600">- New upstream release
  + Version 2.49.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Add patch to update argcomplete dependency (bsc#1206869)
  + acc_update-argcomplete.patch
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688644800">- New upstream release
  + Version 2.50.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Drop patches for issues fixed upstream
  + acc_update-argcomplete.patch
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 2.51.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1694088000">- New upstream release
  + Version 2.52.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696420800">- New upstream release
  + Version 2.53.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1698667200">- New upstream release
  + Version 2.53.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700049600">- New upstream release
  + Version 2.54.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1704283200">- New upstream release
  + Version 2.55.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1705579200">- New upstream release
  + Version 2.56.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707307200">- New upstream release
  + Version 2.57.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1709726400">- New upstream release
  + Version 2.58.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
  + Drop support for older Python versions
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
</package>
<package pkgid="74a51eecab7ac953ddbc1afc31693dd01c6b57b11037509d0f79c97a744acab2" name="azure-cli-core" arch="src">
  <version epoch="0" ver="2.58.0" rel="150400.14.3.2"/>
  <changelog author="adrian.glaubitz@suse.com" date="1670328000">- New upstream release
  + Version 2.43.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1673352000">- New upstream release
  + Version 2.44.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Drop patches for issues fixed upstream
  + acc_update-argcomplete.patch
- Relax version dependency for python-packaging
  in BuildRequires (bsc#1206869)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1674043200">- New upstream release
  + Version 2.44.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675944000">- New upstream release
  + Version 2.45.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678190400">- New upstream release (bsc#1199592)
  + Version 2.46.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680609600">- New upstream release
  + Version 2.47.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683115200">- New upstream release
  + Version 2.48.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684929600">- New upstream release
  + Version 2.49.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Add patch to update argcomplete dependency (bsc#1206869)
  + acc_update-argcomplete.patch
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688644800">- New upstream release
  + Version 2.50.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Drop patches for issues fixed upstream
  + acc_update-argcomplete.patch
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 2.51.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1694088000">- New upstream release
  + Version 2.52.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696420800">- New upstream release
  + Version 2.53.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1698667200">- New upstream release
  + Version 2.53.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700049600">- New upstream release
  + Version 2.54.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1704283200">- New upstream release
  + Version 2.55.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1705579200">- New upstream release
  + Version 2.56.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707307200">- New upstream release
  + Version 2.57.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1709726400">- New upstream release
  + Version 2.58.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
  + Drop support for older Python versions
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
</package>
<package pkgid="dc201b3475a62fa7841a68e2af39542d5ea5702fc83f26b45f8ed7605f94c22c" name="azure-cli-nspkg" arch="noarch">
  <version epoch="0" ver="3.0.4" rel="150400.13.3.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1506513600">- Initial build
  + Version 3.0.1</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1524225600">- New upstream release
  + Version 3.0.2
- Move LICENSE.txt from %doc to %license section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1555416000">- New upstream release
  + Version 3.0.3
  + For detailed information about changes see the
    HISTORY.txt file provided with this package
- Bump minimum version for Python Azure SDK namespace
  packages to 3.0.0 in BuildRequires and Requires
- Remove python3-devel package from BuildRequires
- Remove unzip package from BuildRequires
- Run fdupes to hardlink duplicate files
  + Add fdupes to BuildRequires
  + Add %fdupes invocation to %install</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1559649600">- Remove unneccesary %python_expand prefix from %fdupes call</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1571918400">- New upstream release
  + Version 3.0.4
  + For detailed information about changes see the
    HISTORY.txt file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1657800000">- Add missing python-rpm-macros package to BuildRequires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
</package>
<package pkgid="1355596dbee0abfdaee59f67fc139033a7a54b215183cac8cc8515d78e561e81" name="azure-cli-nspkg" arch="src">
  <version epoch="0" ver="3.0.4" rel="150400.13.3.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1506513600">- Initial build
  + Version 3.0.1</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1524225600">- New upstream release
  + Version 3.0.2
- Move LICENSE.txt from %doc to %license section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1555416000">- New upstream release
  + Version 3.0.3
  + For detailed information about changes see the
    HISTORY.txt file provided with this package
- Bump minimum version for Python Azure SDK namespace
  packages to 3.0.0 in BuildRequires and Requires
- Remove python3-devel package from BuildRequires
- Remove unzip package from BuildRequires
- Run fdupes to hardlink duplicate files
  + Add fdupes to BuildRequires
  + Add %fdupes invocation to %install</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1559649600">- Remove unneccesary %python_expand prefix from %fdupes call</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1571918400">- New upstream release
  + Version 3.0.4
  + For detailed information about changes see the
    HISTORY.txt file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1657800000">- Add missing python-rpm-macros package to BuildRequires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
</package>
<package pkgid="70609d345e66b197dc318ff66e47d3153d82541fece41929e2486e7f95c6c37f" name="azure-cli-telemetry" arch="noarch">
  <version epoch="0" ver="1.1.0" rel="150400.10.3.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1538395200">- Initial build
  + Version 1.0.0
- Add patch to relax version numbers in install_requires
  + act_relax-requires-versions.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1555416000">- New upstream release
  + Version 1.0.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Bump minimum version for Python Azure SDK namespace
  packages to 3.0.0 in BuildRequires and Requires
- Remove python3-devel package from BuildRequires
- Remove unzip package from BuildRequires
- Run fdupes to hardlink duplicate files
  + Add fdupes to BuildRequires
  + Add %fdupes invocation to %install</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1559649600">- Remove unneccesary %python_expand prefix from %fdupes call</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1571918400">- New upstream release
  + Version 1.0.4
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Drop patch to relax version requires in setup.py, it's
  not required as the dependencies are managed by RPM
  + act_relax-requires-versions.patch
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1599048000">- New upstream release
  + Version 1.0.6
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1656331200">- Add missing python-rpm-macros package to BuildRequires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1659614400">- New upstream release
  + Version 1.0.7
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1663329600">- New upstream release
  + Version 1.0.8
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 1.1.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
</package>
<package pkgid="d4659eef712edb03d6051cbd72b9fbb2e9ed7bc797e38041bd1501a2569bbe59" name="azure-cli-telemetry" arch="src">
  <version epoch="0" ver="1.1.0" rel="150400.10.3.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1538395200">- Initial build
  + Version 1.0.0
- Add patch to relax version numbers in install_requires
  + act_relax-requires-versions.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1555416000">- New upstream release
  + Version 1.0.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Bump minimum version for Python Azure SDK namespace
  packages to 3.0.0 in BuildRequires and Requires
- Remove python3-devel package from BuildRequires
- Remove unzip package from BuildRequires
- Run fdupes to hardlink duplicate files
  + Add fdupes to BuildRequires
  + Add %fdupes invocation to %install</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1559649600">- Remove unneccesary %python_expand prefix from %fdupes call</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1571918400">- New upstream release
  + Version 1.0.4
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Drop patch to relax version requires in setup.py, it's
  not required as the dependencies are managed by RPM
  + act_relax-requires-versions.patch
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1599048000">- New upstream release
  + Version 1.0.6
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1656331200">- Add missing python-rpm-macros package to BuildRequires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1659614400">- New upstream release
  + Version 1.0.7
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1663329600">- New upstream release
  + Version 1.0.8
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 1.1.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
</package>
<package pkgid="83d42750210e74912919e22636c7d1c4d7fc24c9dbca78f923bdace73013f0e0" name="azure-cli-test" arch="aarch64">
  <version epoch="0" ver="2.58.0" rel="150400.14.6.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1673352000">- New upstream release
  + Version 2.44.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1674043200">- New upstream release
  + Version 2.44.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675944000">- New upstream release
  + Version 2.45.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678190400">- New upstream release (bsc#1199592)
  + Version 2.46.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680609600">- New upstream release
  + Version 2.47.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683115200">- New upstream release
  + Version 2.48.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684929600">- New upstream release
  + Version 2.49.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688644800">- New upstream release
  + Version 2.50.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 2.51.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1694088000">- New upstream release
  + Version 2.52.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696420800">- New upstream release
  + Version 2.53.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1698667200">- New upstream release
  + Version 2.53.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700049600">- New upstream release
  + Version 2.54.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1704283200">- New upstream release
  + Version 2.55.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1705579200">- New upstream release
  + Version 2.56.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707307200">- New upstream release
  + Version 2.57.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1709726400">- New upstream release
  + Version 2.58.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1715083200">- Add Obsoletes for python3-azure-functions-devops-build package on SLE-15
- Remove azure-cli-command-modules-nspkg from BuildRequires and Requires</changelog>
</package>
<package pkgid="0093308776b2266e55d10d5f98bfb3abd414a204e89f06891650eb66cb47f71b" name="azure-cli-test" arch="ppc64le">
  <version epoch="0" ver="2.58.0" rel="150400.14.6.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1673352000">- New upstream release
  + Version 2.44.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1674043200">- New upstream release
  + Version 2.44.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675944000">- New upstream release
  + Version 2.45.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678190400">- New upstream release (bsc#1199592)
  + Version 2.46.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680609600">- New upstream release
  + Version 2.47.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683115200">- New upstream release
  + Version 2.48.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684929600">- New upstream release
  + Version 2.49.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688644800">- New upstream release
  + Version 2.50.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 2.51.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1694088000">- New upstream release
  + Version 2.52.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696420800">- New upstream release
  + Version 2.53.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1698667200">- New upstream release
  + Version 2.53.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700049600">- New upstream release
  + Version 2.54.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1704283200">- New upstream release
  + Version 2.55.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1705579200">- New upstream release
  + Version 2.56.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707307200">- New upstream release
  + Version 2.57.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1709726400">- New upstream release
  + Version 2.58.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1715083200">- Add Obsoletes for python3-azure-functions-devops-build package on SLE-15
- Remove azure-cli-command-modules-nspkg from BuildRequires and Requires</changelog>
</package>
<package pkgid="d156fb3a2804787c6f92d180ee5ba79e21216e971de1f6a699349c2bd9d3fc83" name="azure-cli-test" arch="s390x">
  <version epoch="0" ver="2.58.0" rel="150400.14.6.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1673352000">- New upstream release
  + Version 2.44.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1674043200">- New upstream release
  + Version 2.44.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675944000">- New upstream release
  + Version 2.45.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678190400">- New upstream release (bsc#1199592)
  + Version 2.46.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680609600">- New upstream release
  + Version 2.47.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683115200">- New upstream release
  + Version 2.48.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684929600">- New upstream release
  + Version 2.49.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688644800">- New upstream release
  + Version 2.50.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 2.51.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1694088000">- New upstream release
  + Version 2.52.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696420800">- New upstream release
  + Version 2.53.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1698667200">- New upstream release
  + Version 2.53.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700049600">- New upstream release
  + Version 2.54.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1704283200">- New upstream release
  + Version 2.55.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1705579200">- New upstream release
  + Version 2.56.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707307200">- New upstream release
  + Version 2.57.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1709726400">- New upstream release
  + Version 2.58.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1715083200">- Add Obsoletes for python3-azure-functions-devops-build package on SLE-15
- Remove azure-cli-command-modules-nspkg from BuildRequires and Requires</changelog>
</package>
<package pkgid="1aec528ef180169bfcf4438f0ac92ae562edd220dadfc2fdc4d8f0dd6a9e9584" name="azure-cli-test" arch="src">
  <version epoch="0" ver="2.58.0" rel="150400.14.6.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1673352000">- New upstream release
  + Version 2.44.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1674043200">- New upstream release
  + Version 2.44.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675944000">- New upstream release
  + Version 2.45.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678190400">- New upstream release (bsc#1199592)
  + Version 2.46.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680609600">- New upstream release
  + Version 2.47.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683115200">- New upstream release
  + Version 2.48.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684929600">- New upstream release
  + Version 2.49.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688644800">- New upstream release
  + Version 2.50.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 2.51.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1694088000">- New upstream release
  + Version 2.52.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696420800">- New upstream release
  + Version 2.53.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1698667200">- New upstream release
  + Version 2.53.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700049600">- New upstream release
  + Version 2.54.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1704283200">- New upstream release
  + Version 2.55.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1705579200">- New upstream release
  + Version 2.56.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707307200">- New upstream release
  + Version 2.57.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1709726400">- New upstream release
  + Version 2.58.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1715083200">- Add Obsoletes for python3-azure-functions-devops-build package on SLE-15
- Remove azure-cli-command-modules-nspkg from BuildRequires and Requires</changelog>
</package>
<package pkgid="753b76c0975922a77452624347372f742c96d9a2715231fc5fea53a0fa6f9945" name="azure-cli-test" arch="x86_64">
  <version epoch="0" ver="2.58.0" rel="150400.14.6.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1673352000">- New upstream release
  + Version 2.44.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1674043200">- New upstream release
  + Version 2.44.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675944000">- New upstream release
  + Version 2.45.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678190400">- New upstream release (bsc#1199592)
  + Version 2.46.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680609600">- New upstream release
  + Version 2.47.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683115200">- New upstream release
  + Version 2.48.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684929600">- New upstream release
  + Version 2.49.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688644800">- New upstream release
  + Version 2.50.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 2.51.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1694088000">- New upstream release
  + Version 2.52.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696420800">- New upstream release
  + Version 2.53.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1698667200">- New upstream release
  + Version 2.53.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700049600">- New upstream release
  + Version 2.54.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1704283200">- New upstream release
  + Version 2.55.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1705579200">- New upstream release
  + Version 2.56.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707307200">- New upstream release
  + Version 2.57.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1709726400">- New upstream release
  + Version 2.58.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1715083200">- Add Obsoletes for python3-azure-functions-devops-build package on SLE-15
- Remove azure-cli-command-modules-nspkg from BuildRequires and Requires</changelog>
</package>
<package pkgid="6d2926f0f0523fdce52895c1df31cc9edf420568181b489fc0c11fbbf700f665" name="bash" arch="aarch64">
  <version epoch="0" ver="4.4" rel="150400.27.3.2"/>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
  <changelog author="werner@suse.de" date="1629201600">- Post update-alternatives approach back from factory for /bin/sh
  (SLE-19670)</changelog>
  <changelog author="schubi@suse.de" date="1634904000">- Using package bash-sh instead of the update-alternative
  mechanism.</changelog>
  <changelog author="werner@suse.de" date="1644580800">- Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234)</changelog>
  <changelog author="werner@suse.de" date="1648123200">- Do use old legacy PreReq to get bash installed before bash-sh
  but do not require bash-sh by bash (bsc#1197448)</changelog>
  <changelog author="werner@suse.de" date="1724241600">- Add patch boo1227807.patch
  * Load completion file eveh if a brace expansion is in the
    command line included (boo#1227807)</changelog>
</package>
<package pkgid="2038d25141b1a07c433c9a4da80e3d9bab06f395c7306353b8a6c1138bd6ff09" name="bash" arch="ppc64le">
  <version epoch="0" ver="4.4" rel="150400.27.3.2"/>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
  <changelog author="werner@suse.de" date="1629201600">- Post update-alternatives approach back from factory for /bin/sh
  (SLE-19670)</changelog>
  <changelog author="schubi@suse.de" date="1634904000">- Using package bash-sh instead of the update-alternative
  mechanism.</changelog>
  <changelog author="werner@suse.de" date="1644580800">- Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234)</changelog>
  <changelog author="werner@suse.de" date="1648123200">- Do use old legacy PreReq to get bash installed before bash-sh
  but do not require bash-sh by bash (bsc#1197448)</changelog>
  <changelog author="werner@suse.de" date="1724241600">- Add patch boo1227807.patch
  * Load completion file eveh if a brace expansion is in the
    command line included (boo#1227807)</changelog>
</package>
<package pkgid="fc1e6e784533389814486945356a3922187c464e227b463d8b0559175e75de44" name="bash" arch="s390x">
  <version epoch="0" ver="4.4" rel="150400.27.3.2"/>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
  <changelog author="werner@suse.de" date="1629201600">- Post update-alternatives approach back from factory for /bin/sh
  (SLE-19670)</changelog>
  <changelog author="schubi@suse.de" date="1634904000">- Using package bash-sh instead of the update-alternative
  mechanism.</changelog>
  <changelog author="werner@suse.de" date="1644580800">- Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234)</changelog>
  <changelog author="werner@suse.de" date="1648123200">- Do use old legacy PreReq to get bash installed before bash-sh
  but do not require bash-sh by bash (bsc#1197448)</changelog>
  <changelog author="werner@suse.de" date="1724241600">- Add patch boo1227807.patch
  * Load completion file eveh if a brace expansion is in the
    command line included (boo#1227807)</changelog>
</package>
<package pkgid="59919cde240350f8204c4f008537e68b3eea8c15db2b851c3f5d6e7de57ee930" name="bash" arch="src">
  <version epoch="0" ver="4.4" rel="150400.27.3.2"/>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
  <changelog author="werner@suse.de" date="1629201600">- Post update-alternatives approach back from factory for /bin/sh
  (SLE-19670)</changelog>
  <changelog author="schubi@suse.de" date="1634904000">- Using package bash-sh instead of the update-alternative
  mechanism.</changelog>
  <changelog author="werner@suse.de" date="1644580800">- Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234)</changelog>
  <changelog author="werner@suse.de" date="1648123200">- Do use old legacy PreReq to get bash installed before bash-sh
  but do not require bash-sh by bash (bsc#1197448)</changelog>
  <changelog author="werner@suse.de" date="1724241600">- Add patch boo1227807.patch
  * Load completion file eveh if a brace expansion is in the
    command line included (boo#1227807)</changelog>
</package>
<package pkgid="e995c6474f6c9b5fa91d4e9afedb7db7bfbb608f7233ae29fa63493a9ccd3ef2" name="bash" arch="x86_64">
  <version epoch="0" ver="4.4" rel="150400.27.3.2"/>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
  <changelog author="werner@suse.de" date="1629201600">- Post update-alternatives approach back from factory for /bin/sh
  (SLE-19670)</changelog>
  <changelog author="schubi@suse.de" date="1634904000">- Using package bash-sh instead of the update-alternative
  mechanism.</changelog>
  <changelog author="werner@suse.de" date="1644580800">- Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234)</changelog>
  <changelog author="werner@suse.de" date="1648123200">- Do use old legacy PreReq to get bash installed before bash-sh
  but do not require bash-sh by bash (bsc#1197448)</changelog>
  <changelog author="werner@suse.de" date="1724241600">- Add patch boo1227807.patch
  * Load completion file eveh if a brace expansion is in the
    command line included (boo#1227807)</changelog>
</package>
<package pkgid="5fbd1b9c940ee85bd1f5010e5710062fed1cc45b8b3e4ca64ad2b62cde950b3d" name="bash-devel" arch="aarch64">
  <version epoch="0" ver="4.4" rel="150400.27.3.2"/>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
  <changelog author="werner@suse.de" date="1629201600">- Post update-alternatives approach back from factory for /bin/sh
  (SLE-19670)</changelog>
  <changelog author="schubi@suse.de" date="1634904000">- Using package bash-sh instead of the update-alternative
  mechanism.</changelog>
  <changelog author="werner@suse.de" date="1644580800">- Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234)</changelog>
  <changelog author="werner@suse.de" date="1648123200">- Do use old legacy PreReq to get bash installed before bash-sh
  but do not require bash-sh by bash (bsc#1197448)</changelog>
  <changelog author="werner@suse.de" date="1724241600">- Add patch boo1227807.patch
  * Load completion file eveh if a brace expansion is in the
    command line included (boo#1227807)</changelog>
</package>
<package pkgid="2f1168a8b2fa152f698bb1b1407fb330cd4024066f9de944ee3c99a42e524aaf" name="bash-devel" arch="ppc64le">
  <version epoch="0" ver="4.4" rel="150400.27.3.2"/>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
  <changelog author="werner@suse.de" date="1629201600">- Post update-alternatives approach back from factory for /bin/sh
  (SLE-19670)</changelog>
  <changelog author="schubi@suse.de" date="1634904000">- Using package bash-sh instead of the update-alternative
  mechanism.</changelog>
  <changelog author="werner@suse.de" date="1644580800">- Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234)</changelog>
  <changelog author="werner@suse.de" date="1648123200">- Do use old legacy PreReq to get bash installed before bash-sh
  but do not require bash-sh by bash (bsc#1197448)</changelog>
  <changelog author="werner@suse.de" date="1724241600">- Add patch boo1227807.patch
  * Load completion file eveh if a brace expansion is in the
    command line included (boo#1227807)</changelog>
</package>
<package pkgid="bde69d8768af3323016031aecc9ed841bcf28ec1b0066e3106bb40dd23bc0344" name="bash-devel" arch="s390x">
  <version epoch="0" ver="4.4" rel="150400.27.3.2"/>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
  <changelog author="werner@suse.de" date="1629201600">- Post update-alternatives approach back from factory for /bin/sh
  (SLE-19670)</changelog>
  <changelog author="schubi@suse.de" date="1634904000">- Using package bash-sh instead of the update-alternative
  mechanism.</changelog>
  <changelog author="werner@suse.de" date="1644580800">- Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234)</changelog>
  <changelog author="werner@suse.de" date="1648123200">- Do use old legacy PreReq to get bash installed before bash-sh
  but do not require bash-sh by bash (bsc#1197448)</changelog>
  <changelog author="werner@suse.de" date="1724241600">- Add patch boo1227807.patch
  * Load completion file eveh if a brace expansion is in the
    command line included (boo#1227807)</changelog>
</package>
<package pkgid="7645a0e64b1ea233d896f1c6a3c2a71ce8206a9d02c864f31944f2d883d84cc7" name="bash-devel" arch="x86_64">
  <version epoch="0" ver="4.4" rel="150400.27.3.2"/>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
  <changelog author="werner@suse.de" date="1629201600">- Post update-alternatives approach back from factory for /bin/sh
  (SLE-19670)</changelog>
  <changelog author="schubi@suse.de" date="1634904000">- Using package bash-sh instead of the update-alternative
  mechanism.</changelog>
  <changelog author="werner@suse.de" date="1644580800">- Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234)</changelog>
  <changelog author="werner@suse.de" date="1648123200">- Do use old legacy PreReq to get bash installed before bash-sh
  but do not require bash-sh by bash (bsc#1197448)</changelog>
  <changelog author="werner@suse.de" date="1724241600">- Add patch boo1227807.patch
  * Load completion file eveh if a brace expansion is in the
    command line included (boo#1227807)</changelog>
</package>
<package pkgid="03bfc9fc3c4a655aa4a64909d2f33c9c0913a8daae2cf850e5f3f37701cb1edb" name="bash-doc" arch="noarch">
  <version epoch="0" ver="4.4" rel="150400.27.3.2"/>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
  <changelog author="werner@suse.de" date="1629201600">- Post update-alternatives approach back from factory for /bin/sh
  (SLE-19670)</changelog>
  <changelog author="schubi@suse.de" date="1634904000">- Using package bash-sh instead of the update-alternative
  mechanism.</changelog>
  <changelog author="werner@suse.de" date="1644580800">- Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234)</changelog>
  <changelog author="werner@suse.de" date="1648123200">- Do use old legacy PreReq to get bash installed before bash-sh
  but do not require bash-sh by bash (bsc#1197448)</changelog>
  <changelog author="werner@suse.de" date="1724241600">- Add patch boo1227807.patch
  * Load completion file eveh if a brace expansion is in the
    command line included (boo#1227807)</changelog>
</package>
<package pkgid="a95e9da5484be180df4cb073b0bc7d96f1de0776e8462e9a4e53d859d999539b" name="bash-lang" arch="noarch">
  <version epoch="0" ver="4.4" rel="150400.27.3.2"/>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
  <changelog author="werner@suse.de" date="1629201600">- Post update-alternatives approach back from factory for /bin/sh
  (SLE-19670)</changelog>
  <changelog author="schubi@suse.de" date="1634904000">- Using package bash-sh instead of the update-alternative
  mechanism.</changelog>
  <changelog author="werner@suse.de" date="1644580800">- Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234)</changelog>
  <changelog author="werner@suse.de" date="1648123200">- Do use old legacy PreReq to get bash installed before bash-sh
  but do not require bash-sh by bash (bsc#1197448)</changelog>
  <changelog author="werner@suse.de" date="1724241600">- Add patch boo1227807.patch
  * Load completion file eveh if a brace expansion is in the
    command line included (boo#1227807)</changelog>
</package>
<package pkgid="2651049493de0e515db2674cf1c5379394f0af0520f81fa6d4a4170c831d173d" name="bash-loadables" arch="aarch64">
  <version epoch="0" ver="4.4" rel="150400.27.3.2"/>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
  <changelog author="werner@suse.de" date="1629201600">- Post update-alternatives approach back from factory for /bin/sh
  (SLE-19670)</changelog>
  <changelog author="schubi@suse.de" date="1634904000">- Using package bash-sh instead of the update-alternative
  mechanism.</changelog>
  <changelog author="werner@suse.de" date="1644580800">- Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234)</changelog>
  <changelog author="werner@suse.de" date="1648123200">- Do use old legacy PreReq to get bash installed before bash-sh
  but do not require bash-sh by bash (bsc#1197448)</changelog>
  <changelog author="werner@suse.de" date="1724241600">- Add patch boo1227807.patch
  * Load completion file eveh if a brace expansion is in the
    command line included (boo#1227807)</changelog>
</package>
<package pkgid="173ced0ce1e75eac2a90aeaa5495d683884c9d294839e433ee92c68ff566d10e" name="bash-loadables" arch="ppc64le">
  <version epoch="0" ver="4.4" rel="150400.27.3.2"/>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
  <changelog author="werner@suse.de" date="1629201600">- Post update-alternatives approach back from factory for /bin/sh
  (SLE-19670)</changelog>
  <changelog author="schubi@suse.de" date="1634904000">- Using package bash-sh instead of the update-alternative
  mechanism.</changelog>
  <changelog author="werner@suse.de" date="1644580800">- Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234)</changelog>
  <changelog author="werner@suse.de" date="1648123200">- Do use old legacy PreReq to get bash installed before bash-sh
  but do not require bash-sh by bash (bsc#1197448)</changelog>
  <changelog author="werner@suse.de" date="1724241600">- Add patch boo1227807.patch
  * Load completion file eveh if a brace expansion is in the
    command line included (boo#1227807)</changelog>
</package>
<package pkgid="d33f84432ef85f05e375a5f5f4b02f9150cbffa932223fdd693223bdb635bf87" name="bash-loadables" arch="s390x">
  <version epoch="0" ver="4.4" rel="150400.27.3.2"/>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
  <changelog author="werner@suse.de" date="1629201600">- Post update-alternatives approach back from factory for /bin/sh
  (SLE-19670)</changelog>
  <changelog author="schubi@suse.de" date="1634904000">- Using package bash-sh instead of the update-alternative
  mechanism.</changelog>
  <changelog author="werner@suse.de" date="1644580800">- Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234)</changelog>
  <changelog author="werner@suse.de" date="1648123200">- Do use old legacy PreReq to get bash installed before bash-sh
  but do not require bash-sh by bash (bsc#1197448)</changelog>
  <changelog author="werner@suse.de" date="1724241600">- Add patch boo1227807.patch
  * Load completion file eveh if a brace expansion is in the
    command line included (boo#1227807)</changelog>
</package>
<package pkgid="8f9af2514709e0d9c004aa295a35fae28dd472744d3d86c4d0018b06717eab48" name="bash-loadables" arch="x86_64">
  <version epoch="0" ver="4.4" rel="150400.27.3.2"/>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
  <changelog author="werner@suse.de" date="1629201600">- Post update-alternatives approach back from factory for /bin/sh
  (SLE-19670)</changelog>
  <changelog author="schubi@suse.de" date="1634904000">- Using package bash-sh instead of the update-alternative
  mechanism.</changelog>
  <changelog author="werner@suse.de" date="1644580800">- Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234)</changelog>
  <changelog author="werner@suse.de" date="1648123200">- Do use old legacy PreReq to get bash installed before bash-sh
  but do not require bash-sh by bash (bsc#1197448)</changelog>
  <changelog author="werner@suse.de" date="1724241600">- Add patch boo1227807.patch
  * Load completion file eveh if a brace expansion is in the
    command line included (boo#1227807)</changelog>
</package>
<package pkgid="c53a586c040f77662c34f55f61784ee9f206ee36b8b4f1004212e9a83cfaafa8" name="bash-sh" arch="aarch64">
  <version epoch="0" ver="4.4" rel="150400.27.3.2"/>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
  <changelog author="werner@suse.de" date="1629201600">- Post update-alternatives approach back from factory for /bin/sh
  (SLE-19670)</changelog>
  <changelog author="schubi@suse.de" date="1634904000">- Using package bash-sh instead of the update-alternative
  mechanism.</changelog>
  <changelog author="werner@suse.de" date="1644580800">- Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234)</changelog>
  <changelog author="werner@suse.de" date="1648123200">- Do use old legacy PreReq to get bash installed before bash-sh
  but do not require bash-sh by bash (bsc#1197448)</changelog>
  <changelog author="werner@suse.de" date="1724241600">- Add patch boo1227807.patch
  * Load completion file eveh if a brace expansion is in the
    command line included (boo#1227807)</changelog>
</package>
<package pkgid="4a6c4cc5b68226f2454d9ba87dbe771314a81c5b34a6821f06779e5aaf25347e" name="bash-sh" arch="ppc64le">
  <version epoch="0" ver="4.4" rel="150400.27.3.2"/>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
  <changelog author="werner@suse.de" date="1629201600">- Post update-alternatives approach back from factory for /bin/sh
  (SLE-19670)</changelog>
  <changelog author="schubi@suse.de" date="1634904000">- Using package bash-sh instead of the update-alternative
  mechanism.</changelog>
  <changelog author="werner@suse.de" date="1644580800">- Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234)</changelog>
  <changelog author="werner@suse.de" date="1648123200">- Do use old legacy PreReq to get bash installed before bash-sh
  but do not require bash-sh by bash (bsc#1197448)</changelog>
  <changelog author="werner@suse.de" date="1724241600">- Add patch boo1227807.patch
  * Load completion file eveh if a brace expansion is in the
    command line included (boo#1227807)</changelog>
</package>
<package pkgid="cb7b215ac6b8a9e2f0dbe07474343b61bea8b9913b2a2505cefa09714b528398" name="bash-sh" arch="s390x">
  <version epoch="0" ver="4.4" rel="150400.27.3.2"/>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
  <changelog author="werner@suse.de" date="1629201600">- Post update-alternatives approach back from factory for /bin/sh
  (SLE-19670)</changelog>
  <changelog author="schubi@suse.de" date="1634904000">- Using package bash-sh instead of the update-alternative
  mechanism.</changelog>
  <changelog author="werner@suse.de" date="1644580800">- Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234)</changelog>
  <changelog author="werner@suse.de" date="1648123200">- Do use old legacy PreReq to get bash installed before bash-sh
  but do not require bash-sh by bash (bsc#1197448)</changelog>
  <changelog author="werner@suse.de" date="1724241600">- Add patch boo1227807.patch
  * Load completion file eveh if a brace expansion is in the
    command line included (boo#1227807)</changelog>
</package>
<package pkgid="87dc6f56ad33c06d29427ece24764427002f8e8bb49bbd09c7d0297049405391" name="bash-sh" arch="x86_64">
  <version epoch="0" ver="4.4" rel="150400.27.3.2"/>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
  <changelog author="werner@suse.de" date="1629201600">- Post update-alternatives approach back from factory for /bin/sh
  (SLE-19670)</changelog>
  <changelog author="schubi@suse.de" date="1634904000">- Using package bash-sh instead of the update-alternative
  mechanism.</changelog>
  <changelog author="werner@suse.de" date="1644580800">- Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234)</changelog>
  <changelog author="werner@suse.de" date="1648123200">- Do use old legacy PreReq to get bash installed before bash-sh
  but do not require bash-sh by bash (bsc#1197448)</changelog>
  <changelog author="werner@suse.de" date="1724241600">- Add patch boo1227807.patch
  * Load completion file eveh if a brace expansion is in the
    command line included (boo#1227807)</changelog>
</package>
<package pkgid="285b7971012b9a71fd74da8c6daf80eb1029f6e1d31d9417c31b1cb9b0d27172" name="bcc" arch="src">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="35376adf7d3c3c6f399b81223996cf83722908c8a180cd4e331685c276602963" name="bcc-devel" arch="aarch64">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="201112de433198c4c56c97e3cb551677452b89844c665668b3b26a0acdb8e95f" name="bcc-devel" arch="ppc64le">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="c891f341dfefda774d0f29933a569e995b9d6fe63d0d05445b4855ccc882baae" name="bcc-devel" arch="s390x">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="d43310472a7b1d6d789256f0d7db827d8950e64a4b30e68e171a28b40fa97154" name="bcc-devel" arch="x86_64">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="416da9d3331f1bce3fe17a23f760968ff39fd51246f4e8ec8445ff2fefc8d6e4" name="bcc-docs" arch="noarch">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="5653f8b348015b3882dade8f4674b9d9a9718ee1375e103d5bf18c3131e34488" name="bcc-examples" arch="noarch">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="1ce2ff96d7b1fa4149de45239dbcefceb893ab97a6695d10e6407fdc9226de2f" name="bcc-tools" arch="aarch64">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="ba0d570de8c80ada527a16b23a9bc55c3183de46c84547d846f332234767dddb" name="bcc-tools" arch="ppc64le">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="1e0b8ee257a6d55c9154a54b2ff7d7df07f0539cd10e8d49862082b548656a66" name="bcc-tools" arch="s390x">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="b7ad8c15f51d31427d3f1f9b0c81663f9b155d9c7b71eabbe35cb85b9a7d0e4c" name="bcc-tools" arch="x86_64">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="1080c2f96b43d47a195ad3345dadb2a8512bce3fdaefc537cc826665f94f5b90" name="bcel" arch="noarch">
  <version epoch="0" ver="6.10.0" rel="150200.11.6.2"/>
  <changelog author="tchvatal@suse.com" date="1427284800">- Drop gpg-offline
- Drop conditional for manual that is never triggered</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- Buildignore more java implementations</changelog>
  <changelog author="fstrba@suse.com" date="1506513600">- Allow building with any java-devel provider
- Specify java source and target level 1.6 to fix build with jdk9
- Added patch:
  * bcel-5.2-encoding.patch
    + specify the correct encoding of the files</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility</changelog>
  <changelog author="fstrba@suse.com" date="1542283200">- Add maven pom file and generate mvn(...) dependencies for this
  package</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Build against the generic xml-apis provider which allows
  building against bootstrap and non-bootstrap packages according
  of their availability.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- BuildIgnore xalan-j2, xml-apis, xml-resolver, xerces-j2, since
  those packages are not necessary for the build.</changelog>
  <changelog author="pmonreal@suse.com" date="1668081600">- Security fix: [bsc#1205125, CVE-2022-42920]
  * Apache Commons BCEL prior to 6.6.0 allows producing
    arbitrary bytecode via out-of-bounds writing
  * Add bcel-CVE-2022-42920.patch</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to version 6.7.0
  * 6.7.0 (2022-11-28) Maintenance and bug fix release.
  * 6.6.1 (2022-10-29) Maintenance and bug fix release.
  * 6.6.0 (2022-10-08) Minor feature and bug fix release.
  * 6.5.0 (2020-06-05) Minor feature and bug fix release.
  * 6.4.1 (2019-09-26) Bug fix release.
  * 6.4.0 (2019-09-20) Feature and bug fix release.
  * 6.3.1 (2019-03-20) Bug fix release
  * 6.3 (2019-01-23) Experimental Java 9, 10, 11, 12-EA, and 13-EA
    Support
  * 6.2 (2017-12-08) Experimental Java 9 Support
  * 6.1 (2017-09-14) Experimental Java 9 Support
  * 6.0 (2016-07-10) Apache Commons BCEL 6.0 is a major release
    supporting the new features introduced in Java 6, 7 and 8. It
    requires Java 7 or higher to run.
    COMPATIBILITY with 5.2
    + Binary compatible
  - not strictly compatible
  - The constant interface org.apache.bcel.Constants has been
    deprecated. Classes which implemented this interface in 5.2
    now use the constants defined in the org.apache.bcel.Const
    class.
  - The constant interface
    org.apache.bcel.generic.InstructionConstants has been
    deprecated. Classes which implemented this interface in 5.2
    now use the constants defined in the
    org.apache.bcel.generic.InstructionConsts class.
  - Return type of method 'public java.lang.Object
    getElementAt(int)' in org.apache.bcel.verifier
    .VerifierFactoryListModel has been changed to
    java.lang.String.
  - The BCEL classes do no longer implement java.io.Serializable.
    + Source compatible
  - Yes, sort of;
  - The org.apache.bcel.classfile.Visitor interface has been
    enhanced with additional methods. If you implemented it
    directly instead of extending the EmptyVisitor class you'll
    have to implement the new methods.
  - The org.apache.bcel.generic.Visitor interface has been
    enhanced with an additional method. If you implemented it
    directly instead of extending the EmptyVisitor class you'll
    have to implement the new methods.
    + Semantic compatible
  - Yes, except:
  - BCEL 6.0 handles new attributes such as code annotations
    that could only be processed by implementing a custom
    AttributeReader in the previous versions. Code relying on
    this behavior will have to be adjusted since the
    AttributeReader will no longer be called in these cases.
    + For full information about API changes please see the extended
    Clirr report: https://commons.apache.org/bcel/clirr-report.html
- Removed patches:
  * bcel-5.2-encoding.patch
    + part of our own build.xml file generated to build with ant
  * bcel-CVE-2022-42920.patch
    + integrated upstrea</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1703332800">- Update to version 6.8.0
  * 6.8.0 (2023-12-08) Maintenance and bug fix release.
    + New features:
    ~ Add and use InvalidMethodSignatureException extending
    ClassFormatException.
    ~ Increase code coverage in Class2HTMLTestCase with new test
    input Java4Example #186.
    ~ Add verifier tests on some opcodes #180.
    ~ Added signature test cases for class/method, and bad
    signatures #182.
    ~ Add Const.MAJOR_20.
    ~ Add Const.MINOR_20.
    ~ Add Const.MAJOR_21.
    ~ Add Const.MINOR_21.
    ~ [Bcelifier] stackmap support to pass JDK verifier #177.
    ~ Fix SpotBugs [ERROR] Class org.apache.bcel.util.ClassVector
    defines non-transient non-serializable instance field vec
    [org.apache.bcel.util.ClassVector] In ClassVector.java
    SE_BAD_FIELD.
    ~ Fix SpotBugs [ERROR] Switch statement found in
    org.apache.bcel.util.BCELFactory.visitAllocationInstruction(AllocationInstruction)
    where one case falls through to the next case
    [org.apache.bcel.util.BCELFactory,
    org.apache.bcel.util.BCELFactory] At
    BCELFactory.java:[lines 188-191]Another occurrence at
    BCELFactory.java:[lines 192-196] SF_SWITCH_FALLTHROUGH.
    + Fixed bugs:
    ~ When parsing an class with an invalid constant reference,
    ensure ClassParser.parse() throws ClassFormatException, not
    NullPointerException.
    ~ Ensure that references to a constant pool entry with index
    zero trigger a ClassFormatException, not a
    NullPointerException.
    ~ Ensure that references to the unused constant pool entry
    after a long/double entry triggers a ClassFormatException,
    not a NullPointerException.
    ~ Test and coverage of InstructionFactory #190.
    ~ Verifier: test and coverage for SWAP instruction #188.
    ~ Exception parsing Kotlin class with 'fun `method name with
    () in it`()' #205.
    ~ Fix null pointers in AnnotationEntry #213.
    ~ Field not found, search field in both super class and
    implemented interfaces (5x duplicated code to find field by
    name and type is refactored to a new method and now
    supports package-private) #181.
    ~ BCEL-366: Use alternative name for broken classes under
    test #220.
    ~ BCEL-367: Fixes java.lang.IndexOutOfBoundsException for
    ATHROW on empty stack #223.
    ~ BCEL-368: Fixes java.lang.StackOverflowError in
    Select#toString(boolean) #229.
    ~ Fix for type.getType(...) use on non-signature type names
    [#221].
    ~ Fix EmptyVisitorTestCase on Java 21.
    + Changes:
    ~ Bump commons-parent from 54 to 65 #189, #198, #222.
    ~ Bump jna.version from 5.12.1 to 5.13.0 #203.
    ~ Bump kotlin-stdlib from 1.8.10 to 1.9.21 #217, #219, #227,
    [#231], #235, #245, #247.
    ~ Bump commons-io from 2.11.0 to 2.15.1.
    ~ Bump commons-lang3 from 3.12.0 to 3.14.0.
    ~ Bump org.codehaus.mojo:exec-maven-plugin from 3.1.0 to
    3.1.1 #246.</changelog>
  <changelog author="gus.kenion@suse.com" date="1726833600">- Update to version 6.10.0
  * 6.10.0 (2024-06-24) Maintenance and bug fix release. Requires
    a minimum of Java 8.
    + Fix PMD UnnecessaryFullyQualifiedName.
    + Fix PMD EmptyCatchBlock by allowing commented blocks.
    + Fix PMD EmptyControlStatement by allowing commented blocks.
    + Fix SpotBugs RV_RETURN_VALUE_IGNORED_BAD_PRACTICE in
    JasminVisitor.
    + SpotBugs checks should ignore code generated by JavaCC.
    + Fix SpotBugs URF_UNREAD_FIELD in ClassDumper.
    + Fix SpotBugs DM_DEFAULT_ENCODING in JasminVisitor.
    + Fix SpotBugs RCN_REDUNDANT_NULLCHECK_WOULD_HAVE_BEEN_A_NPE in
    ASTFunAppl.
    + Fix SpotBugs RV_ABSOLUTE_VALUE_OF_HASHCODE in
    Mini.Environment.
    + Fix SpotBugs DM_DEFAULT_ENCODING in Mini.MiniC.
    + Fix SpotBugs WMI_WRONG_MAP_ITERATOR in Package.go(String[]).
    + Deprecate TransitiveHull.INGORED in favor of
    TransitiveHull.getIgnored().
    + Add accessors to model and unit tests, Javadoc #183.
    + Add Const.MAJOR_22.
    + Add Const.MINOR_22.
    + Add Const.MAJOR_23.
    + Add Const.MINOR_23.
    + Add Const.MAJOR_24.
    + Add Const.MINOR_24.
    + Bump tests from org.assertj:assertj-core 3.25.3 to 3.26.3
    [#322], #332.
    + Bump tests from org.jetbrains.kotlin:kotlin-stdlib 1.9.23 to
    2.0.0 #309, #318.
    + Bump tests from org.apache.commons:commons-collections4 4.4
    to 4.5.0-M2.
    + Bump org.apache.commons:commons-parent from 69 to 71.
    + Bump org.codehaus.mojo:taglist-maven-plugin from 3.0.0 to
    3.1.0 #331.
  * Includes changes from  6.9.0 Maintenance and bug fix release.
    +  Add Support for Java 16 records #290.
    +  Add null guard for InstructionFactory.createInvoke() #289.
    +  Avoid possible NullPointerException in
    org.apache.bcel.classfile.DescendingVisitor.accept(E[]).
    +  Avoid possible NullPointerException in
    AnnotationEntryGen.getAnnotationAttributes(ConstantPoolGen,
    AnnotationEntryGen[]).
    +  Avoid possible NullPointerException in
    AnnotationEntryGen.copyValues(ElementValuePair[],
    ConstantPoolGen, boolean).
    +  Avoid possible NullPointerException in
    ArrayElementValueGen.ArrayElementValueGen(int,
    ElementValue[], ConstantPoolGen).
    +  Avoid possible NullPointerException in
    org.apache.bcel.generic.ClassGen.setMethods(Method[]).
    +  Avoid possible NullPointerException in
    org.apache.bcel.generic.ClassGen.unpackAnnotations(Attribute[]).
    +  Avoid possible NullPointerException in
    org.apache.bcel.classfile.ParameterAnnotationEntry.createParameterAnnotationEntries(Attribute[]).
    +  Avoid possible NullPointerException in
    org.apache.bcel.generic.ClassGen.ClassGen(JavaClass).
    +  Avoid possible NullPointerException in
    org.apache.bcel.generic.FieldGenOrMethodGen.addAll(Attribute[]).
    +  Avoid possible NullPointerException in
    org.apache.bcel.classfile.ParameterAnnotationEntry.createParameterAnnotationEntries(Attribute[]).
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.MethodParameters.setParameters(MethodParameter[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.ParameterAnnotations.setParameterAnnotationTable(ParameterAnnotationEntry[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.LocalVariableTypeTable.setLocalVariableTable(LocalVariable[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.LocalVariableTable.setLocalVariableTable(LocalVariable[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.LineNumberTable.setLineNumberTable(LineNumber[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.JavaClass.setMethods(Method[] with
    null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.JavaClass.setInterfaces(int[]) with
    null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.JavaClass.setInterfaceNames(String[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.JavaClass.setFields(Field[]) with
    null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.JavaClass.setAttributes(Attribute[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.ConstantPool.setConstantPool(Constant[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.FieldOrMethod.setAttributes(Attribute[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.Annotations.setAnnotationTable(AnnotationEntry[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.ArrayElementValue.ArrayElementValue(int,
    ElementValue[], ConstantPool) with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.BootstrapMethod.BootstrapMethod(int,
    int[]) with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.BootstrapMethod.setBootstrapArguments(int[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.BootstrapMethods.BootstrapMethods(int,
    int, BootstrapMethod[], ConstantPool) with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.BootstrapMethods.setBootstrapMethods(BootstrapMethod[])
    with null.
    +  Avoid NullPointerException calling
    org.apache.bcel.generic.InstructionList.redirectLocalVariables(LocalVariableGen[],
    InstructionHandle, InstructionHandle) with null.
    +  Avoid NullPointerException calling
    org.apache.bcel.generic.InstructionList.redirectExceptionHandlers(CodeExceptionGen[],
    InstructionHandle, InstructionHandle) with null.
    +  Avoid NullPointerException calling
    org.apache.bcel.generic.InstructionList.findHandle(InstructionHandle[],
    int[], int, int) with null.
    +  Avoid NullPointerException calling
    org.apache.bcel.generic.MethodGen.setArgumentTypes(Type[])
    with null.
    +  Avoid NullPointerException calling
    org.apache.bcel.generic.MethodGen.setArgumentNames(String[])
    with null.
    +  Avoid NullPointerException calling
    org.apache.bcel.generic.MethodGen.removeRuntimeAttributes(Attribute[])
    with null.
    +  Avoid NullPointerException calling
    org.apache.bcel.generic.MethodGen.makeMutableVersion(AnnotationEntry[])
    with null.
    +  Bump org.apache.commons:commons-parent from 66 to 69 #283,
    [#297].
    +  Bump org.jetbrains.kotlin:kotlin-stdlib from 1.9.22 to 1.9.23
    [#284].
    +  Bump commons-io:commons-io from 2.15.1 to 2.16.1 #295, #300.</changelog>
</package>
<package pkgid="839945e4639d1113fa9a1113f2545d88b7a00cf9977b16b73cdb29e421f247b4" name="bcel" arch="src">
  <version epoch="0" ver="6.10.0" rel="150200.11.6.2"/>
  <changelog author="mvyskocil@suse.cz" date="1242907200">- update to 5.2
- fixed build under gcj44
- removed javadoc scripplets</changelog>
  <changelog author="mvyskocil@suse.cz" date="1243857600">- fixed archive name (gz -&gt; bz2) in Source</changelog>
  <changelog author="mvyskocil@suse.cz" date="1289217600">- build ignore xml-commons-jaxp-1.3-apis</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="mvyskocil@suse.cz" date="1337083200">- ignore openjdk from build</changelog>
  <changelog author="mvyskocil@suse.com" date="1357560000">- remove xerces-j2-bootstrap dependency (bnc#789163)</changelog>
  <changelog author="mvyskocil@suse.com" date="1377172800">- disable javadoc generation</changelog>
  <changelog author="mvyskocil@suse.com" date="1378209600">- use pristine tarballs
- fix source url
- add gpg verification
- format spec file</changelog>
  <changelog author="tchvatal@suse.com" date="1404820800">- Do not depend on ant-nodeps.</changelog>
  <changelog author="tchvatal@suse.com" date="1427284800">- Drop gpg-offline
- Drop conditional for manual that is never triggered</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- Buildignore more java implementations</changelog>
  <changelog author="fstrba@suse.com" date="1506513600">- Allow building with any java-devel provider
- Specify java source and target level 1.6 to fix build with jdk9
- Added patch:
  * bcel-5.2-encoding.patch
    + specify the correct encoding of the files</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility</changelog>
  <changelog author="fstrba@suse.com" date="1542283200">- Add maven pom file and generate mvn(...) dependencies for this
  package</changelog>
  <changelog author="fstrba@suse.com" date="1544443200">- Build against the generic xml-apis provider which allows
  building against bootstrap and non-bootstrap packages according
  of their availability.</changelog>
  <changelog author="fstrba@suse.com" date="1549022400">- BuildIgnore xalan-j2, xml-apis, xml-resolver, xerces-j2, since
  those packages are not necessary for the build.</changelog>
  <changelog author="pmonreal@suse.com" date="1668081600">- Security fix: [bsc#1205125, CVE-2022-42920]
  * Apache Commons BCEL prior to 6.6.0 allows producing
    arbitrary bytecode via out-of-bounds writing
  * Add bcel-CVE-2022-42920.patch</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to version 6.7.0
  * 6.7.0 (2022-11-28) Maintenance and bug fix release.
  * 6.6.1 (2022-10-29) Maintenance and bug fix release.
  * 6.6.0 (2022-10-08) Minor feature and bug fix release.
  * 6.5.0 (2020-06-05) Minor feature and bug fix release.
  * 6.4.1 (2019-09-26) Bug fix release.
  * 6.4.0 (2019-09-20) Feature and bug fix release.
  * 6.3.1 (2019-03-20) Bug fix release
  * 6.3 (2019-01-23) Experimental Java 9, 10, 11, 12-EA, and 13-EA
    Support
  * 6.2 (2017-12-08) Experimental Java 9 Support
  * 6.1 (2017-09-14) Experimental Java 9 Support
  * 6.0 (2016-07-10) Apache Commons BCEL 6.0 is a major release
    supporting the new features introduced in Java 6, 7 and 8. It
    requires Java 7 or higher to run.
    COMPATIBILITY with 5.2
    + Binary compatible
  - not strictly compatible
  - The constant interface org.apache.bcel.Constants has been
    deprecated. Classes which implemented this interface in 5.2
    now use the constants defined in the org.apache.bcel.Const
    class.
  - The constant interface
    org.apache.bcel.generic.InstructionConstants has been
    deprecated. Classes which implemented this interface in 5.2
    now use the constants defined in the
    org.apache.bcel.generic.InstructionConsts class.
  - Return type of method 'public java.lang.Object
    getElementAt(int)' in org.apache.bcel.verifier
    .VerifierFactoryListModel has been changed to
    java.lang.String.
  - The BCEL classes do no longer implement java.io.Serializable.
    + Source compatible
  - Yes, sort of;
  - The org.apache.bcel.classfile.Visitor interface has been
    enhanced with additional methods. If you implemented it
    directly instead of extending the EmptyVisitor class you'll
    have to implement the new methods.
  - The org.apache.bcel.generic.Visitor interface has been
    enhanced with an additional method. If you implemented it
    directly instead of extending the EmptyVisitor class you'll
    have to implement the new methods.
    + Semantic compatible
  - Yes, except:
  - BCEL 6.0 handles new attributes such as code annotations
    that could only be processed by implementing a custom
    AttributeReader in the previous versions. Code relying on
    this behavior will have to be adjusted since the
    AttributeReader will no longer be called in these cases.
    + For full information about API changes please see the extended
    Clirr report: https://commons.apache.org/bcel/clirr-report.html
- Removed patches:
  * bcel-5.2-encoding.patch
    + part of our own build.xml file generated to build with ant
  * bcel-CVE-2022-42920.patch
    + integrated upstrea</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1703332800">- Update to version 6.8.0
  * 6.8.0 (2023-12-08) Maintenance and bug fix release.
    + New features:
    ~ Add and use InvalidMethodSignatureException extending
    ClassFormatException.
    ~ Increase code coverage in Class2HTMLTestCase with new test
    input Java4Example #186.
    ~ Add verifier tests on some opcodes #180.
    ~ Added signature test cases for class/method, and bad
    signatures #182.
    ~ Add Const.MAJOR_20.
    ~ Add Const.MINOR_20.
    ~ Add Const.MAJOR_21.
    ~ Add Const.MINOR_21.
    ~ [Bcelifier] stackmap support to pass JDK verifier #177.
    ~ Fix SpotBugs [ERROR] Class org.apache.bcel.util.ClassVector
    defines non-transient non-serializable instance field vec
    [org.apache.bcel.util.ClassVector] In ClassVector.java
    SE_BAD_FIELD.
    ~ Fix SpotBugs [ERROR] Switch statement found in
    org.apache.bcel.util.BCELFactory.visitAllocationInstruction(AllocationInstruction)
    where one case falls through to the next case
    [org.apache.bcel.util.BCELFactory,
    org.apache.bcel.util.BCELFactory] At
    BCELFactory.java:[lines 188-191]Another occurrence at
    BCELFactory.java:[lines 192-196] SF_SWITCH_FALLTHROUGH.
    + Fixed bugs:
    ~ When parsing an class with an invalid constant reference,
    ensure ClassParser.parse() throws ClassFormatException, not
    NullPointerException.
    ~ Ensure that references to a constant pool entry with index
    zero trigger a ClassFormatException, not a
    NullPointerException.
    ~ Ensure that references to the unused constant pool entry
    after a long/double entry triggers a ClassFormatException,
    not a NullPointerException.
    ~ Test and coverage of InstructionFactory #190.
    ~ Verifier: test and coverage for SWAP instruction #188.
    ~ Exception parsing Kotlin class with 'fun `method name with
    () in it`()' #205.
    ~ Fix null pointers in AnnotationEntry #213.
    ~ Field not found, search field in both super class and
    implemented interfaces (5x duplicated code to find field by
    name and type is refactored to a new method and now
    supports package-private) #181.
    ~ BCEL-366: Use alternative name for broken classes under
    test #220.
    ~ BCEL-367: Fixes java.lang.IndexOutOfBoundsException for
    ATHROW on empty stack #223.
    ~ BCEL-368: Fixes java.lang.StackOverflowError in
    Select#toString(boolean) #229.
    ~ Fix for type.getType(...) use on non-signature type names
    [#221].
    ~ Fix EmptyVisitorTestCase on Java 21.
    + Changes:
    ~ Bump commons-parent from 54 to 65 #189, #198, #222.
    ~ Bump jna.version from 5.12.1 to 5.13.0 #203.
    ~ Bump kotlin-stdlib from 1.8.10 to 1.9.21 #217, #219, #227,
    [#231], #235, #245, #247.
    ~ Bump commons-io from 2.11.0 to 2.15.1.
    ~ Bump commons-lang3 from 3.12.0 to 3.14.0.
    ~ Bump org.codehaus.mojo:exec-maven-plugin from 3.1.0 to
    3.1.1 #246.</changelog>
  <changelog author="gus.kenion@suse.com" date="1726833600">- Update to version 6.10.0
  * 6.10.0 (2024-06-24) Maintenance and bug fix release. Requires
    a minimum of Java 8.
    + Fix PMD UnnecessaryFullyQualifiedName.
    + Fix PMD EmptyCatchBlock by allowing commented blocks.
    + Fix PMD EmptyControlStatement by allowing commented blocks.
    + Fix SpotBugs RV_RETURN_VALUE_IGNORED_BAD_PRACTICE in
    JasminVisitor.
    + SpotBugs checks should ignore code generated by JavaCC.
    + Fix SpotBugs URF_UNREAD_FIELD in ClassDumper.
    + Fix SpotBugs DM_DEFAULT_ENCODING in JasminVisitor.
    + Fix SpotBugs RCN_REDUNDANT_NULLCHECK_WOULD_HAVE_BEEN_A_NPE in
    ASTFunAppl.
    + Fix SpotBugs RV_ABSOLUTE_VALUE_OF_HASHCODE in
    Mini.Environment.
    + Fix SpotBugs DM_DEFAULT_ENCODING in Mini.MiniC.
    + Fix SpotBugs WMI_WRONG_MAP_ITERATOR in Package.go(String[]).
    + Deprecate TransitiveHull.INGORED in favor of
    TransitiveHull.getIgnored().
    + Add accessors to model and unit tests, Javadoc #183.
    + Add Const.MAJOR_22.
    + Add Const.MINOR_22.
    + Add Const.MAJOR_23.
    + Add Const.MINOR_23.
    + Add Const.MAJOR_24.
    + Add Const.MINOR_24.
    + Bump tests from org.assertj:assertj-core 3.25.3 to 3.26.3
    [#322], #332.
    + Bump tests from org.jetbrains.kotlin:kotlin-stdlib 1.9.23 to
    2.0.0 #309, #318.
    + Bump tests from org.apache.commons:commons-collections4 4.4
    to 4.5.0-M2.
    + Bump org.apache.commons:commons-parent from 69 to 71.
    + Bump org.codehaus.mojo:taglist-maven-plugin from 3.0.0 to
    3.1.0 #331.
  * Includes changes from  6.9.0 Maintenance and bug fix release.
    +  Add Support for Java 16 records #290.
    +  Add null guard for InstructionFactory.createInvoke() #289.
    +  Avoid possible NullPointerException in
    org.apache.bcel.classfile.DescendingVisitor.accept(E[]).
    +  Avoid possible NullPointerException in
    AnnotationEntryGen.getAnnotationAttributes(ConstantPoolGen,
    AnnotationEntryGen[]).
    +  Avoid possible NullPointerException in
    AnnotationEntryGen.copyValues(ElementValuePair[],
    ConstantPoolGen, boolean).
    +  Avoid possible NullPointerException in
    ArrayElementValueGen.ArrayElementValueGen(int,
    ElementValue[], ConstantPoolGen).
    +  Avoid possible NullPointerException in
    org.apache.bcel.generic.ClassGen.setMethods(Method[]).
    +  Avoid possible NullPointerException in
    org.apache.bcel.generic.ClassGen.unpackAnnotations(Attribute[]).
    +  Avoid possible NullPointerException in
    org.apache.bcel.classfile.ParameterAnnotationEntry.createParameterAnnotationEntries(Attribute[]).
    +  Avoid possible NullPointerException in
    org.apache.bcel.generic.ClassGen.ClassGen(JavaClass).
    +  Avoid possible NullPointerException in
    org.apache.bcel.generic.FieldGenOrMethodGen.addAll(Attribute[]).
    +  Avoid possible NullPointerException in
    org.apache.bcel.classfile.ParameterAnnotationEntry.createParameterAnnotationEntries(Attribute[]).
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.MethodParameters.setParameters(MethodParameter[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.ParameterAnnotations.setParameterAnnotationTable(ParameterAnnotationEntry[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.LocalVariableTypeTable.setLocalVariableTable(LocalVariable[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.LocalVariableTable.setLocalVariableTable(LocalVariable[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.LineNumberTable.setLineNumberTable(LineNumber[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.JavaClass.setMethods(Method[] with
    null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.JavaClass.setInterfaces(int[]) with
    null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.JavaClass.setInterfaceNames(String[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.JavaClass.setFields(Field[]) with
    null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.JavaClass.setAttributes(Attribute[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.ConstantPool.setConstantPool(Constant[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.FieldOrMethod.setAttributes(Attribute[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.Annotations.setAnnotationTable(AnnotationEntry[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.ArrayElementValue.ArrayElementValue(int,
    ElementValue[], ConstantPool) with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.BootstrapMethod.BootstrapMethod(int,
    int[]) with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.BootstrapMethod.setBootstrapArguments(int[])
    with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.BootstrapMethods.BootstrapMethods(int,
    int, BootstrapMethod[], ConstantPool) with null.
    +  Avoid NullPointerException after calling
    org.apache.bcel.classfile.BootstrapMethods.setBootstrapMethods(BootstrapMethod[])
    with null.
    +  Avoid NullPointerException calling
    org.apache.bcel.generic.InstructionList.redirectLocalVariables(LocalVariableGen[],
    InstructionHandle, InstructionHandle) with null.
    +  Avoid NullPointerException calling
    org.apache.bcel.generic.InstructionList.redirectExceptionHandlers(CodeExceptionGen[],
    InstructionHandle, InstructionHandle) with null.
    +  Avoid NullPointerException calling
    org.apache.bcel.generic.InstructionList.findHandle(InstructionHandle[],
    int[], int, int) with null.
    +  Avoid NullPointerException calling
    org.apache.bcel.generic.MethodGen.setArgumentTypes(Type[])
    with null.
    +  Avoid NullPointerException calling
    org.apache.bcel.generic.MethodGen.setArgumentNames(String[])
    with null.
    +  Avoid NullPointerException calling
    org.apache.bcel.generic.MethodGen.removeRuntimeAttributes(Attribute[])
    with null.
    +  Avoid NullPointerException calling
    org.apache.bcel.generic.MethodGen.makeMutableVersion(AnnotationEntry[])
    with null.
    +  Bump org.apache.commons:commons-parent from 66 to 69 #283,
    [#297].
    +  Bump org.jetbrains.kotlin:kotlin-stdlib from 1.9.22 to 1.9.23
    [#284].
    +  Bump commons-io:commons-io from 2.15.1 to 2.16.1 #295, #300.</changelog>
</package>
<package pkgid="69c2adcf3e22a483d01dc809644db379b278c5c9d26390d6d77d2d7046cc59cf" name="bea-stax" arch="noarch">
  <version epoch="0" ver="1.2.0" rel="150200.11.3.1"/>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile</changelog>
  <changelog author="mvyskocil@suse.com" date="1357560000">- remove xerces-j2-bootstrap depenency (bnc#789163)</changelog>
  <changelog author="mvyskocil@suse.com" date="1377172800">- don't build javadoc</changelog>
  <changelog author="tchvatal@suse.com" date="1378728000">- Move from jpackage-utils to javapackage-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1495368000">- Cleanup a bit and remove unused patch bea-stax-gcj43-build.patch</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Don't require java-1_5_0-gcj-compat and build with source and
  target level 1.6
- Removed patch:
  * bea-stax-target15.patch
- Added patch:
  * bea-stax-target16.patch
  - change the source and target levels and fix a problem with
    the encoding of one file</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Modified patch:
  * bea-stax-target16.patch -&gt; bea-stax-target8.patch
    + Build with source and target 8 to prepare for a possible
    removal of 1.6 compatibility</changelog>
  <changelog author="fstrba@suse.com" date="1545048000">- Upgrade to released bea-stax 1.2.0 and bea-stax-api 1.0.1
- Add maven pom files</changelog>
  <changelog author="fstrba@suse.com" date="1545220800">- Add LICENSE file to packages</changelog>
  <changelog author="fstrba@suse.com" date="1731067200">- Sanitize the spec file
  * Download sources from their urls.
  * Do not install versioned jar file
  * Use newer javapackages features
  * Build and package javadoc documentation
- Removed patch:
  * bea-stax-gcj-build.patch
    + not needed since we don't build this package with gcj
- Modified patch:
  * bea-stax-target8.patch
    + specify consistently encoding of sources so that newer
    java compilers don't fail on invalid characters</changelog>
</package>
<package pkgid="06a97103dbff8a4d5ea822cb4951c4562bff0c639d5d877dbe40959542619a68" name="bea-stax" arch="src">
  <version epoch="0" ver="1.2.0" rel="150200.11.3.1"/>
  <changelog author="anosek@suse.cz" date="1205150400">- new package needed to build saxon8, initial version 1.2.0,
  based on the JPackage project</changelog>
  <changelog author="anosek@suse.cz" date="1205323200">- fixed Bea-stax contains a Sun proprietary copyright header (bnc#369318)
  - removed problematic file: src/javax/xml/namespace/QName.java</changelog>
  <changelog author="mvyskocil@suse.cz" date="1221220800">- target=1.5 -source=1.5
- build with gcj
- remove a dot in summary to prevent of an rpmlint error</changelog>
  <changelog author="mvyskocil@suse.cz" date="1222862400">- rm of BuildRoot on install was removed
- avoid of another openjdk build cycle:
  - added an explicit BuildRequires on: xerces-j2-bootstrap,
  xml-commons-apis-bootstrap, xml-commons-resolver-bootstrap,
  xml-commons-which-bootstrap
  - and BuildIgnore on: xerces-j2, xml-commons, xml-commons-apis,
  xml-commons-resolver, xml-commons-which</changelog>
  <changelog author="mvyskocil@suse.cz" date="1242907200">- fixed build under gcj44:
  * splitted uncompatible part of old gcj patch to gcj43 one</changelog>
  <changelog author="mvyskocil@suse.cz" date="1283428800">- ignore antlr(-java) to reduce build cycles</changelog>
  <changelog author="mvyskocil@suse.cz" date="1289217600">- build ignore xml-commons-jaxp-1.3-apis</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile</changelog>
  <changelog author="mvyskocil@suse.com" date="1357560000">- remove xerces-j2-bootstrap depenency (bnc#789163)</changelog>
  <changelog author="mvyskocil@suse.com" date="1377172800">- don't build javadoc</changelog>
  <changelog author="tchvatal@suse.com" date="1378728000">- Move from jpackage-utils to javapackage-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1495368000">- Cleanup a bit and remove unused patch bea-stax-gcj43-build.patch</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Don't require java-1_5_0-gcj-compat and build with source and
  target level 1.6
- Removed patch:
  * bea-stax-target15.patch
- Added patch:
  * bea-stax-target16.patch
  - change the source and target levels and fix a problem with
    the encoding of one file</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Modified patch:
  * bea-stax-target16.patch -&gt; bea-stax-target8.patch
    + Build with source and target 8 to prepare for a possible
    removal of 1.6 compatibility</changelog>
  <changelog author="fstrba@suse.com" date="1545048000">- Upgrade to released bea-stax 1.2.0 and bea-stax-api 1.0.1
- Add maven pom files</changelog>
  <changelog author="fstrba@suse.com" date="1545220800">- Add LICENSE file to packages</changelog>
  <changelog author="fstrba@suse.com" date="1731067200">- Sanitize the spec file
  * Download sources from their urls.
  * Do not install versioned jar file
  * Use newer javapackages features
  * Build and package javadoc documentation
- Removed patch:
  * bea-stax-gcj-build.patch
    + not needed since we don't build this package with gcj
- Modified patch:
  * bea-stax-target8.patch
    + specify consistently encoding of sources so that newer
    java compilers don't fail on invalid characters</changelog>
</package>
<package pkgid="5e2ff037017f9ba5d5a2df46ce618e97a4e3ff8d25d48b9d118d6c864e628ff1" name="bea-stax-api" arch="noarch">
  <version epoch="0" ver="1.2.0" rel="150200.11.3.1"/>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile</changelog>
  <changelog author="mvyskocil@suse.com" date="1357560000">- remove xerces-j2-bootstrap depenency (bnc#789163)</changelog>
  <changelog author="mvyskocil@suse.com" date="1377172800">- don't build javadoc</changelog>
  <changelog author="tchvatal@suse.com" date="1378728000">- Move from jpackage-utils to javapackage-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1495368000">- Cleanup a bit and remove unused patch bea-stax-gcj43-build.patch</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Don't require java-1_5_0-gcj-compat and build with source and
  target level 1.6
- Removed patch:
  * bea-stax-target15.patch
- Added patch:
  * bea-stax-target16.patch
  - change the source and target levels and fix a problem with
    the encoding of one file</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Modified patch:
  * bea-stax-target16.patch -&gt; bea-stax-target8.patch
    + Build with source and target 8 to prepare for a possible
    removal of 1.6 compatibility</changelog>
  <changelog author="fstrba@suse.com" date="1545048000">- Upgrade to released bea-stax 1.2.0 and bea-stax-api 1.0.1
- Add maven pom files</changelog>
  <changelog author="fstrba@suse.com" date="1545220800">- Add LICENSE file to packages</changelog>
  <changelog author="fstrba@suse.com" date="1731067200">- Sanitize the spec file
  * Download sources from their urls.
  * Do not install versioned jar file
  * Use newer javapackages features
  * Build and package javadoc documentation
- Removed patch:
  * bea-stax-gcj-build.patch
    + not needed since we don't build this package with gcj
- Modified patch:
  * bea-stax-target8.patch
    + specify consistently encoding of sources so that newer
    java compilers don't fail on invalid characters</changelog>
</package>
<package pkgid="06c1bc118f0312f64ada243f1558187c0835ab438033ba8726f155000676377d" name="beust-jcommander" arch="noarch">
  <version epoch="0" ver="1.83" rel="150200.3.13.1"/>
  <changelog author="fstrba@suse.com" date="1540382400">- Initial packaging built without maven, adapted from Fedora rpm</changelog>
  <changelog author="fstrba@suse.com" date="1540468800">- Build with java source/target levels 8 since the code uses
  String.join() which does not exist before java 8</changelog>
  <changelog author="fstrba@suse.com" date="1544097600">- Fix javadoc build with older JDK versions</changelog>
  <changelog author="jengelh@inai.de" date="1549540800">- Avoid double shipping of documentation.
- Ensure neutrality of descriptions.</changelog>
  <changelog author="fstrba@suse.com" date="1554724800">- Remove reference to pom parent from pom.xml file, since we are
  not building with maven.</changelog>
  <changelog author="fstrba@suse.com" date="1683115200">- Update to version 1.82
  * Fixes:
    + #392: fixed bug when parsing arguments is ignoring case
    sensitivity option
    + Add a test for Parameter order usage
    + add a test for Path converter
    + Add automatic module name to manifest
    + Add check if Boolean parameter is default null, then do not
    flip value
    + Added testing modules
    + Add format tests for DefaultUsageFormatter,
    UnixStyleUsageFormatter
    + add Path converter change #414 to changelog
    + Add test case for issue 367
    + Add testing for UnixStyleUsageFormatter
    + Add unix-style formatter, allow DefaultUsageFormatter to be
    extended easier
    + Allow generics of type &lt;? extends X&gt; and &lt;? super Y&gt; in
    parameters
    + Allow main parameters to be a single field.
    + allow System.out to be replaced by something else (f.e.
    System.err)
    + Allow UsageFormatter to be set in JCommander Builder
    + Change UsageFormatter into an interface
    + Clean up DefaultUsageFormatter
    + Create MyDelegate.java
    + Create UsageFormatter (preliminary)
    + Enable usage() ordering for DynamicParameter
    + Encapsulate MainParameter.
    + encode user input to massage error message
    + Expose more of the UsageFormatter implementations
    + Fields annotated with @ParametersDelegate are now allowed to
    be final.
    + FIX #380 Main parameter doesn't support Converter
    + Fix error message when failing to convert a Path
    + Fixing: squid:ModifiersOrderCheck and squid:S2444
    + Fix locale-related issues in usage formatter tests
    + Get boolean/Boolean getter with "is" prefix
    + GH-477 Environment Variable Default Provider
    + make console configurable by JCommander.Builder
    + Make UsageFormatter abstract, Create DefaultUsageFormatter
    + Only one DefaultConverterFactory
    + Remove String.join usage - resolves #381
    + Remove the generic in IStringConverterFactory
    + Restrict access to JCommander.Options again
    + Support arity for main parameters.
    + Update DefaultParameterizedParser.java
    + Update IParameterizedParser.java
    + Update JCommander.java
    + usage() hides 'Comments:' header when only hidden commands
    exist
    + Use Builder API as constructor is deprecated
    + Use get&lt;fieldname&gt; default getter approach if is&lt;fieldname&gt;
    method is not found
  * Upgrade needed by new code in xmvn 4.2.0
- Fetch sources using source service and clean the tarball of
  unnecessary binary files</changelog>
  <changelog author="fstrba@suse.com" date="1708516800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1716206400">- Update to version 1.83
  * Fixes:
    + Fixed Docs Timestamp
    + Fixed: #563 - JCommander does not recognize command by alias.
    + fixed: missing null check
    + renamed IRule to IParametersValidator
    + `@Parameters(rules = &lt;? extends IRule&gt;)`
    + Unit Test for #532
    + Fixed #532: @-syntax not working with command objects
    + enable testng tests
    + Fix regression with removed usage methods
    + Add OSGi entries in MANIFEST.MF during jar creation</changelog>
</package>
<package pkgid="d03ee7e5606f0315f16c745d13136f2ac34d7322c96273ca990f587661dd7e9e" name="beust-jcommander" arch="src">
  <version epoch="0" ver="1.83" rel="150200.3.13.1"/>
  <changelog author="fstrba@suse.com" date="1540382400">- Initial packaging built without maven, adapted from Fedora rpm</changelog>
  <changelog author="fstrba@suse.com" date="1540468800">- Build with java source/target levels 8 since the code uses
  String.join() which does not exist before java 8</changelog>
  <changelog author="fstrba@suse.com" date="1544097600">- Fix javadoc build with older JDK versions</changelog>
  <changelog author="jengelh@inai.de" date="1549540800">- Avoid double shipping of documentation.
- Ensure neutrality of descriptions.</changelog>
  <changelog author="fstrba@suse.com" date="1554724800">- Remove reference to pom parent from pom.xml file, since we are
  not building with maven.</changelog>
  <changelog author="fstrba@suse.com" date="1683115200">- Update to version 1.82
  * Fixes:
    + #392: fixed bug when parsing arguments is ignoring case
    sensitivity option
    + Add a test for Parameter order usage
    + add a test for Path converter
    + Add automatic module name to manifest
    + Add check if Boolean parameter is default null, then do not
    flip value
    + Added testing modules
    + Add format tests for DefaultUsageFormatter,
    UnixStyleUsageFormatter
    + add Path converter change #414 to changelog
    + Add test case for issue 367
    + Add testing for UnixStyleUsageFormatter
    + Add unix-style formatter, allow DefaultUsageFormatter to be
    extended easier
    + Allow generics of type &lt;? extends X&gt; and &lt;? super Y&gt; in
    parameters
    + Allow main parameters to be a single field.
    + allow System.out to be replaced by something else (f.e.
    System.err)
    + Allow UsageFormatter to be set in JCommander Builder
    + Change UsageFormatter into an interface
    + Clean up DefaultUsageFormatter
    + Create MyDelegate.java
    + Create UsageFormatter (preliminary)
    + Enable usage() ordering for DynamicParameter
    + Encapsulate MainParameter.
    + encode user input to massage error message
    + Expose more of the UsageFormatter implementations
    + Fields annotated with @ParametersDelegate are now allowed to
    be final.
    + FIX #380 Main parameter doesn't support Converter
    + Fix error message when failing to convert a Path
    + Fixing: squid:ModifiersOrderCheck and squid:S2444
    + Fix locale-related issues in usage formatter tests
    + Get boolean/Boolean getter with "is" prefix
    + GH-477 Environment Variable Default Provider
    + make console configurable by JCommander.Builder
    + Make UsageFormatter abstract, Create DefaultUsageFormatter
    + Only one DefaultConverterFactory
    + Remove String.join usage - resolves #381
    + Remove the generic in IStringConverterFactory
    + Restrict access to JCommander.Options again
    + Support arity for main parameters.
    + Update DefaultParameterizedParser.java
    + Update IParameterizedParser.java
    + Update JCommander.java
    + usage() hides 'Comments:' header when only hidden commands
    exist
    + Use Builder API as constructor is deprecated
    + Use get&lt;fieldname&gt; default getter approach if is&lt;fieldname&gt;
    method is not found
  * Upgrade needed by new code in xmvn 4.2.0
- Fetch sources using source service and clean the tarball of
  unnecessary binary files</changelog>
  <changelog author="fstrba@suse.com" date="1708516800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1716206400">- Update to version 1.83
  * Fixes:
    + Fixed Docs Timestamp
    + Fixed: #563 - JCommander does not recognize command by alias.
    + fixed: missing null check
    + renamed IRule to IParametersValidator
    + `@Parameters(rules = &lt;? extends IRule&gt;)`
    + Unit Test for #532
    + Fixed #532: @-syntax not working with command objects
    + enable testng tests
    + Fix regression with removed usage methods
    + Add OSGi entries in MANIFEST.MF during jar creation</changelog>
</package>
<package pkgid="607a2e2d1da36cc12460846f0392dd2fd82bab5baaed37e47a4815ee0dc619b4" name="beust-jcommander-javadoc" arch="noarch">
  <version epoch="0" ver="1.83" rel="150200.3.13.1"/>
  <changelog author="fstrba@suse.com" date="1540382400">- Initial packaging built without maven, adapted from Fedora rpm</changelog>
  <changelog author="fstrba@suse.com" date="1540468800">- Build with java source/target levels 8 since the code uses
  String.join() which does not exist before java 8</changelog>
  <changelog author="fstrba@suse.com" date="1544097600">- Fix javadoc build with older JDK versions</changelog>
  <changelog author="jengelh@inai.de" date="1549540800">- Avoid double shipping of documentation.
- Ensure neutrality of descriptions.</changelog>
  <changelog author="fstrba@suse.com" date="1554724800">- Remove reference to pom parent from pom.xml file, since we are
  not building with maven.</changelog>
  <changelog author="fstrba@suse.com" date="1683115200">- Update to version 1.82
  * Fixes:
    + #392: fixed bug when parsing arguments is ignoring case
    sensitivity option
    + Add a test for Parameter order usage
    + add a test for Path converter
    + Add automatic module name to manifest
    + Add check if Boolean parameter is default null, then do not
    flip value
    + Added testing modules
    + Add format tests for DefaultUsageFormatter,
    UnixStyleUsageFormatter
    + add Path converter change #414 to changelog
    + Add test case for issue 367
    + Add testing for UnixStyleUsageFormatter
    + Add unix-style formatter, allow DefaultUsageFormatter to be
    extended easier
    + Allow generics of type &lt;? extends X&gt; and &lt;? super Y&gt; in
    parameters
    + Allow main parameters to be a single field.
    + allow System.out to be replaced by something else (f.e.
    System.err)
    + Allow UsageFormatter to be set in JCommander Builder
    + Change UsageFormatter into an interface
    + Clean up DefaultUsageFormatter
    + Create MyDelegate.java
    + Create UsageFormatter (preliminary)
    + Enable usage() ordering for DynamicParameter
    + Encapsulate MainParameter.
    + encode user input to massage error message
    + Expose more of the UsageFormatter implementations
    + Fields annotated with @ParametersDelegate are now allowed to
    be final.
    + FIX #380 Main parameter doesn't support Converter
    + Fix error message when failing to convert a Path
    + Fixing: squid:ModifiersOrderCheck and squid:S2444
    + Fix locale-related issues in usage formatter tests
    + Get boolean/Boolean getter with "is" prefix
    + GH-477 Environment Variable Default Provider
    + make console configurable by JCommander.Builder
    + Make UsageFormatter abstract, Create DefaultUsageFormatter
    + Only one DefaultConverterFactory
    + Remove String.join usage - resolves #381
    + Remove the generic in IStringConverterFactory
    + Restrict access to JCommander.Options again
    + Support arity for main parameters.
    + Update DefaultParameterizedParser.java
    + Update IParameterizedParser.java
    + Update JCommander.java
    + usage() hides 'Comments:' header when only hidden commands
    exist
    + Use Builder API as constructor is deprecated
    + Use get&lt;fieldname&gt; default getter approach if is&lt;fieldname&gt;
    method is not found
  * Upgrade needed by new code in xmvn 4.2.0
- Fetch sources using source service and clean the tarball of
  unnecessary binary files</changelog>
  <changelog author="fstrba@suse.com" date="1708516800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1716206400">- Update to version 1.83
  * Fixes:
    + Fixed Docs Timestamp
    + Fixed: #563 - JCommander does not recognize command by alias.
    + fixed: missing null check
    + renamed IRule to IParametersValidator
    + `@Parameters(rules = &lt;? extends IRule&gt;)`
    + Unit Test for #532
    + Fixed #532: @-syntax not working with command objects
    + enable testng tests
    + Fix regression with removed usage methods
    + Add OSGi entries in MANIFEST.MF during jar creation</changelog>
</package>
<package pkgid="ff3dae60d019cb0757e8f4fbf3155d67e4e3388a1d973d2cb6190762a6037e16" name="bind" arch="aarch64">
  <version epoch="0" ver="9.18.28" rel="150600.3.3.1"/>
  <changelog author="josef.moellers@suse.com" date="1657800000">- Update to release 9.16.31
  This is the first of monthly updates of "bind". It is planned
  to update bind when a new upstream maintennace release becomes
  available, which is usually towards the end of a month, see
  https://www.isc.org/blogs/2021-bind-release-model/
  Compared to the previous SUSE release, in this release,
  53 (minor) bugs were fixed
  13 (minor) functional enhancements were made
  3 security issues are now fixed upstream:
    CVE-2022-0396, CVE-2021-25220, CVE-2021-25219
  plus a few minor changes.
  For a full list of changes, please refer to the
  CHANGES file in the source rpm.
  This update obsoletes the following patches:
  * bind-fix-build-with-older-sphinx.patch
  * bind-CVE-2021-25219.patch
  * bind-9.16.27-0001-CVE-2021-25220.patch
  * bind-9.16.27-0002-CVE-2022-0396.patch
  [bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind-9.16.20.tar.xz, bind-9.16.20.tar.xz.sha512.asc,
  bind-fix-build-with-older-sphinx.patch, bind-CVE-2021-25219.patch,
  bind-9.16.27-0001-CVE-2021-25220.patch,
  bind-9.16.27-0002-CVE-2022-0396.patch,
  jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1661256000">- Update to release 9.16.32
  Feature Changes:
  * The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
  disabled on systems where they are disallowed by the security policy
  (e.g. Red Hat Enterprise Linux 9). Primary zones using those algorithms
  need to be migrated to new algorithms prior to running on these systems,
  as graceful migration to different DNSSEC algorithms is not possible when
  RSASHA1 is disallowed by the operating system.
  * Log messages related to fetch limiting have been improved to provide
  more complete information. Specifically, the final counts of allowed
  and spilled fetches are now logged before the counter object is destroyed.
  Bug Fixes:
  * Non-dynamic zones that inherit dnssec-policy from the view or options
  blocks were not marked as inline-signed and therefore never scheduled
  to be re-signed. This has been fixed.
  * The old max-zone-ttl zone option was meant to be superseded by
  the max-zone-ttl option in dnssec-policy; however, the latter option
  was not fully effective. This has been corrected: zones no longer load
  if they contain TTLs greater than the limit configured in dnssec-policy.
  For zones with both the old max-zone-ttl option and dnssec-policy
  configured, the old option is ignored, and a warning is generated.
  * rndc dumpdb -expired was fixed to include expired RRsets,
  even if stale-cache-enable is set to no and
  the cache-cleaning time window has passed.
  [bind-9.16.32.tar.xz, bind-9.16.32.tar.xz.sha512.asc,
  bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind.spec, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724800">- Include a modified createNamedConfInclude script again, as this
  broke compatability with existing configurations.
  A symlink for named.conf.include to /var/lib/named is created to
  allow for a read-only /etc directory.
  However it is still advised to change the existing configuration.
  See README-bind.chrootenv for a guide how to do this.
  [bsc#1203250, vendor-files/tools/createNamedConfInclude,
  vendor-files/docu/README-bind.chrootenv, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724801">- Add systemd drop-in directory for named service
  [bsc#1201689, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1663761600">- Update to release 9.16.33
  Security Fixes:
  * Previously, there was no limit to the number of database lookups
    performed while processing large delegations, which could be
    abused to severely impact the performance of named running as a
    recursive resolver. This has been fixed. (CVE-2022-2795)
  * named running as a resolver with the stale-answer-client-timeout
    option set to 0 could crash with an assertion failure, when
    there was a stale CNAME in the cache for the incoming query.
    This has been fixed. (CVE-2022-3080)
  * A memory leak was fixed that could be externally triggered in the
    DNSSEC verification code for the ECDSA algorithm. (CVE-2022-38177)
  * Memory leaks were fixed that could be externally triggered in the
    DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178)
  Feature Changes:
  * Response Rate Limiting (RRL) code now treats all QNAMEs that are
    subject to wildcard processing within a given zone as the same
    name, to prevent circumventing the limits enforced by RRL.
  * Zones using dnssec-policy now require dynamic DNS or
    inline-signing to be configured explicitly.
  * A backward-compatible approach was implemented for encoding
    internationalized domain names (IDN) in dig and converting the
    domain to IDNA2008 form; if that fails,
    BIND tries an IDNA2003 conversion.
  Bug Fixes:
  * A serve-stale bug was fixed, where BIND would try to return stale
    data from cache for lookups that received duplicate queries or
    queries that would be dropped. This bug resulted in premature
    SERVFAIL responses, and has now been resolved.
  [bsc#1203614, bsc#1203618, bsc#1203619, bsc#1203620, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1668168000">- Update to release 9.16.34
  New Features:
  * Support for parsing and validating the dohpath service
    parameter in SVCB records was added.
  * named now logs the supported cryptographic algorithms during
    startup and in the output of named -V.
  Bug Fixes:
  * Changing just the TSIG key names for primaries in catalog
    zones’ member zones was not effective. This has been fixed.
  Known Issues:
  * Upgrading from BIND 9.16.32 or any older version may require a
    manual configuration change. The following configurations are
    affected:
  - type primary zones configured with dnssec-policy but without
    either allow-update or update-policy,
  - type secondary zones configured with dnssec-policy.
    In these cases please add inline-signing yes; to the individual
    zone configuration(s). Without applying this change, named will
    fail to start. For more details, see
    https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1669291200">- Update to release 9.16.35
  Bug Fixes:
  * A crash was fixed that happened when a dnssec-policy zone that
    used NSEC3 was reconfigured to enable inline-signing.
  * In certain resolution scenarios, quotas could be erroneously
    reached for servers, including any configured forwarders,
    resulting in SERVFAIL answers being sent to clients.
  * rpz-ip rules in response-policy zones could be ineffective in
    some cases if a query had the CD (Checking Disabled) bit set to
    1.
  * Previously, if Internet connectivity issues were experienced
    during the initial startup of named, a BIND resolver with
    dnssec-validation set to auto could enter into a state where it
    would not recover without stopping named, manually deleting the
    managed-keys.bind and managed-keys.bind.jnl files, and starting
    named again.
  * The statistics counter representing the current number of
    clients awaiting recursive resolution results (RecursClients)
    could overflow in certain resolution scenarios.
  * Previously, BIND failed to start on Solaris-based systems with
    hundreds of CPUs.
  * When a DNS resource record’s TTL value was equal to the
    resolver’s configured prefetch “eligibility” value, the record
    was erroneously not treated as eligible for prefetching.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1671710400">- Update to release 9.16.36
  Feature Changes:
  * The auto-dnssec option has been deprecated and will be removed
    in a future BIND 9.19.x release. Please migrate to
    dnssec-policy.
  Bug Fixes:
  * When a catalog zone was removed from the configuration, in some
    cases a dangling pointer could cause the named process to
    crash.
  * When a zone was deleted from a server, a key management object
    related to that zone was inadvertently kept in memory and only
    released upon shutdown. This could lead to constantly
    increasing memory use on servers with a high rate of changes
    affecting the set of zones being served.
  * In certain cases, named waited for the resolution of
    outstanding recursive queries to finish before shutting down.
  * The zone &lt;name&gt;/&lt;class&gt;: final reference detached log message
    was moved from the INFO log level to the DEBUG(1) log level to
    prevent the named-checkzone tool from superfluously logging
    this message in non-debug mode.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1674561600">- Update to release 9.16.37
  Security Fixes:
  * An UPDATE message flood could cause named to exhaust all
    available memory. This flaw was addressed by adding a new
    update-quota option that controls the maximum number of
    outstanding DNS UPDATE messages that named can hold in a queue
    at any given time (default: 100). (CVE-2022-3094)
  * named could crash with an assertion failure when an RRSIG query
    was received and stale-answer-client-timeout was set to a
    non-zero value. This has been fixed. (CVE-2022-3736)
  * named running as a resolver with the
    stale-answer-client-timeout option set to any value greater
    than 0 could crash with an assertion failure, when the
    recursive-clients soft quota was reached. This has been fixed.
    (CVE-2022-3924)
  New Features:
  * The new update-quota option can be used to control the number
    of simultaneous DNS UPDATE messages that can be processed to
    update an authoritative zone on a primary server, or forwarded
    to the primary server by a secondary server. The default is
    100. A new statistics counter has also been added to record
    events when this quota is exceeded, and the version numbers for
    the XML and JSON statistics schemas have been updated.
  Feature Changes:
  * The Differentiated Services Code Point (DSCP) feature in BIND
    has been deprecated. Configuring DSCP values in named.conf now
    causes a warning to be logged. Note that this feature has only
    been partly operational since the new Network Manager was
    introduced in BIND 9.16.0.
  * The catalog zone implementation has been optimized to work with
    hundreds of thousands of member zones.
  Bug Fixes:
  * In certain query resolution scenarios (e.g. when following
    CNAME records), named configured to answer from stale cache
    could return a SERVFAIL response despite a usable, non-stale
    answer being present in the cache. This has been fixed.
  [bsc#1207471, bsc#1207473, bsc#1207475, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1676548800">- Update to release 9.16.38
  Bug Fixes:
  * A constant stream of zone additions and deletions via rndc
    reconfig could cause increased memory consumption due to
    delayed cleaning of view memory. This has been fixed.
  * The speed of the message digest algorithms (MD5, SHA-1, SHA-2),
    and of NSEC3 hashing, has been improved.
  * Building BIND 9 failed when the --enable-dnsrps switch for
    ./configure was used. This has been fixed.
  [jsc#SLE-24600]
- Updated keyring and signature</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1678881600">- Update to release 9.16.39
  Feature Changes:
  * libuv support for receiving multiple UDP messages in a single
    recvmmsg() system call has been tweaked several times between
    libuv versions 1.35.0 and 1.40.0; the current recommended libuv
    version is 1.40.0 or higher. New rules are now in effect for
    running with a different version of libuv than the one used at
    compilation time. These rules may trigger a fatal error at
    startup:
  - Building against or running with libuv versions 1.35.0 and
    1.36.0 is now a fatal error.
  - Running with libuv version higher than 1.34.2 is now a
    fatal error when named is built against libuv version
    1.34.2 or lower.
  - Running with libuv version higher than 1.39.0 is now a
    fatal error when named is built against libuv version
    1.37.0, 1.38.0, 1.38.1, or 1.39.0.
  * This prevents the use of libuv versions that may trigger an
    assertion failure when receiving multiple UDP messages in a
    single system call.
  Bug Fixes:
  * named could crash with an assertion failure when adding a new
    zone into the configuration file for a name which was already
    configured as a member zone for a catalog zone. This has been
    fixed.
  * When named starts up, it sends a query for the DNSSEC key for
    each configured trust anchor to determine whether the key has
    changed. In some unusual cases, the query might depend on a
    zone for which the server is itself authoritative, and would
    have failed if it were sent before the zone was fully loaded.
    This has now been fixed by delaying the key queries until all
    zones have finished loading.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1682424000">- Update to release 9.16.40
  Bug Fixes:
  * Logfiles using timestamp-style suffixes were not always
    correctly removed when the number of files exceeded the limit
    set by versions. This has been fixed for configurations which
    do not explicitly specify a directory path as part of the file
    argument in the channel specification.
  * Performance of DNSSEC validation in zones with many DNSKEY
    records has been improved.</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1684324800">- Update to release 9.16.41
  Bug Fixes:
  * When removing delegations from an opt-out range,
    empty-non-terminal NSEC3 records generated by those delegations
    were not cleaned up. This has been fixed.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1687348800">- Update to release 9.16.42
  Security Fixes:
  * The overmem cleaning process has been improved, to prevent the
    cache from significantly exceeding the configured
    max-cache-size limit. (CVE-2023-2828)
  * A query that prioritizes stale data over lookup triggers a
    fetch to refresh the stale data in cache. If the fetch is
    aborted for exceeding the recursion quota, it was possible for
    named to enter an infinite callback loop and crash due to stack
    overflow. This has been fixed. (CVE-2023-2911)
  Bug Fixes:
  * Previously, it was possible for a delegation from cache to be
    returned to the client after the stale-answer-client-timeout
    duration. This has been fixed.
  [bsc#1212544, bsc#1212567, jsc#SLE-24600]</changelog>
  <changelog author="dmueller@suse.com" date="1688644800">- rebuild bind-utils on libuv updates (bsc#1212090)</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1688990400">- Log named-checkconf output [bsc#1213049]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1689076800">- Add dnstap support
  [jsc#PED-4852]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1695124800">- Update to release 9.16.44
  Bug Fixes:
  * Processing already-queued queries received over TCP could cause
    an assertion failure, when the server was reconfigured at the
    same time or the cache was being flushed. This has been fixed.
  Security Fixes:
  * Previously, sending a specially crafted message over the
    control channel could cause the packet-parsing code to run out
    of available stack memory, causing named to terminate
    unexpectedly. This has been fixed. (CVE-2023-3341)
  [bsc#1215472]
- Switch to pkgconfig(libprotobuf-c) since this now contains the
  required protobuf-c binary</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1708084800">- Update to new Major Version 9.18.24.
  This has many enhancements, bug fixes and changes.
  Breaking Changes:
  * Some options have been removed and some have been deprecated
    and will be removed in the future.
    For a complete list, see:
    https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918
  Major Changes:
  * Support for securing DNS traffic using Transport Layer Security
    (TLS). TLS is used by both DNS-over-TLS (DoT) and
    DNS-over-HTTPS (DoH).
  * Support for zone transfers over TLS (XFR-over-TLS, XoT) for
    both incoming and outgoing zone transfers.
  * The dig tool is now able to send DoT queries (+tls option).
  * Support for OpenSSL 3.0 APIs was added.
  * dnssec-checkds, dnssec-coverage, dnssec-keymgr, which have been
    removed in favor of the dnssec-policy feature
  * python3-bind is deprecated and the subpackage has been removed
  * A number of utilities have been moved from /usr/sbin to
    /usr/bin:
    named-checkconf named-checkzone named-compilezone
    dnssec-dsfromkey dnssec-importkey dnssec-keyfromlabel
    dnssec-keygen dnssec-revoke dnssec-settime dnssec-signzone
    dnssec-verify dnssec-cds named-journalprint nsec3hash
  * The lib directory was renamed from 'named' to 'bind'
  For a complete list of changes, see:
  * Bind Release Notes
    https://bind9.readthedocs.io/en/v9.18.24/notes.html
  * The CHANGES file in the source RPM
  Security Fixes:
  * Validating DNS messages containing a lot of DNSSEC signatures
    could cause excessive CPU load, leading to a denial-of-service
    condition. This has been fixed. (CVE-2023-50387)
    [bsc#1219823]
  * Preparing an NSEC3 closest encloser proof could cause excessive
    CPU load, leading to a denial-of-service condition. This has
    been fixed. (CVE-2023-50868)
    [bsc#1219826]
  * Parsing DNS messages with many different names could cause
    excessive CPU load. This has been fixed. (CVE-2023-4408)
    [bsc#1219851]
  * Specific queries could cause named to crash with an assertion
    failure when nxdomain-redirect was enabled. This has been
    fixed. (CVE-2023-5517)
    [bsc#1219852]
  * A bad interaction between DNS64 and serve-stale could cause
    named to crash with an assertion failure, when both of these
    features were enabled. This has been fixed. (CVE-2023-5679)
    [bsc#1219853]
  * Query patterns that continuously triggered cache database
    maintenance could cause an excessive amount of memory to be
    allocated, exceeding max-cache-size and potentially leading to
    all available memory on the host running named being exhausted.
    This has been fixed. (CVE-2023-6516)
    [bsc#1219854]
  Packaging notes:
  * libnghttps2 added as BuildRequires for tls support
  * named-bootconf.diff patch is obsolete and has been removed
  [jsc#PED-7932]
- Update KillMode to 'control-group' in named.service to handle
  forked processes better.
  [bsc#1215755]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1721908800">- Update to release 9.18.28
  Bug Fixes:
  * Command-line options for IPv4-only (named -4) and IPv6-only
    (named -6) modes are now respected for zone primaries,
    also-notify, and parental-agents.
  * An RPZ response’s SOA record TTL was set to 1 instead of the
    SOA TTL, if add-soa was used. This has been fixed.
  * When a query related to zone maintenance (NOTIFY, SOA) timed
    out close to a view shutdown (triggered e.g. by rndc reload),
    named could crash with an assertion failure. This has been
    fixed.
  * The statistics channel counters that indicated the number of
    currently connected TCP IPv4/IPv6 clients were not properly
    adjusted in certain failure scenarios. This has been fixed.
  * Some servers that could not be reached due to EHOSTDOWN or
    ENETDOWN conditions were incorrectly prioritized during server
    selection. These are now properly handled as unreachable.
  * On some systems the libuv call may return an error code when
    sending a TCP reset for a connection, which triggers an
    assertion failure in named. This error condition is now dealt
    with in a more graceful manner, by logging the incident and
    shutting down the connection.
  * Changes to listen-on statements were ignored on reconfiguration
    unless the port or interface address was changed, making it
    impossible to change a related listener transport type. That
    issue has been fixed.
  * A bug in the keymgr code unintentionally slowed down some
    DNSSEC key rollovers. This has been fixed.
  * Some ISO 8601 durations were accepted erroneously, leading to
    shorter durations than expected. This has been fixed
  * A regression in cache-cleaning code enabled memory use to grow
    significantly more quickly than before, until the configured
    max-cache-size limit was reached. This has been fixed.
  * Using rndc flush inadvertently caused cache cleaning to become
    less effective. This could ultimately lead to the configured
    max-cache-size limit being exceeded and has now been fixed.
  * The logic for cleaning up expired cached DNS records was
    tweaked to be more aggressive. This change helps with enforcing
    max-cache-ttl and max-ncache-ttl in a timely manner.
  * It was possible to trigger a use-after-free assertion when the
    overmem cache cleaning was initiated. This has been fixed.
  New Features:
  * A new option signatures-jitter has been added to dnssec-policy
    to allow signature expirations to be spread out over a period
    of time.
  * The statistics channel now includes counters that indicate the
    number of currently connected TCP IPv4/IPv6 clients.
  * Added RESOLVER.ARPA to the built in empty zones.
  Feature Changes:
  * DNSSEC signatures that are not valid because the current time
    falls outside the signature inception and expiration dates are
    skipped instead of causing an immediate validation failure.
  Security Fixes:
  * A malicious DNS client that sent many queries over TCP but
    never read the responses could cause a server to respond slowly
    or not at all for other clients. This has been fixed.
    (CVE-2024-0760)
    [bsc#1228255]
  * It is possible to craft excessively large resource records
    sets, which have the effect of slowing down database
    processing. This has been addressed by adding a configurable
    limit to the number of records that can be stored per name and
    type in a cache or zone database. The default is 100, which can
    be tuned with the new max-records-per-type option.
  * It is possible to craft excessively large numbers of resource
    record types for a given owner name, which has the effect of
    slowing down database processing. This has been addressed by
    adding a configurable limit to the number of records that can
    be stored per name and type in a cache or zone database. The
    default is 100, which can be tuned with the new
    max-types-per-name option. (CVE-2024-1737)
    [bsc#1228256]
  * Validating DNS messages signed using the SIG(0) protocol (RFC
    2931) could cause excessive CPU load, leading to a
    denial-of-service condition. Support for SIG(0) message
    validation was removed from this version of named.
    (CVE-2024-1975)
    [bsc#1228257]
  * Due to a logic error, lookups that triggered serving stale data
    and required lookups in local authoritative zone data could
    have resulted in an assertion failure. This has been fixed.
  * Potential data races were found in our DoH implementation,
    related to HTTP/2 session object management and endpoints set
    object management after reconfiguration. These issues have been
    fixed.
  * When looking up the NS records of parent zones as part of
    looking up DS records, it was possible for named to trigger an
    assertion failure if serve-stale was enabled. This has been
    fixed. (CVE-2024-4076)
    [bsc#1228258]</changelog>
</package>
<package pkgid="09901a71511bbd5cd61814813f5c5477914750535ae952ce1c22d48be5fa0318" name="bind" arch="ppc64le">
  <version epoch="0" ver="9.18.28" rel="150600.3.3.1"/>
  <changelog author="josef.moellers@suse.com" date="1657800000">- Update to release 9.16.31
  This is the first of monthly updates of "bind". It is planned
  to update bind when a new upstream maintennace release becomes
  available, which is usually towards the end of a month, see
  https://www.isc.org/blogs/2021-bind-release-model/
  Compared to the previous SUSE release, in this release,
  53 (minor) bugs were fixed
  13 (minor) functional enhancements were made
  3 security issues are now fixed upstream:
    CVE-2022-0396, CVE-2021-25220, CVE-2021-25219
  plus a few minor changes.
  For a full list of changes, please refer to the
  CHANGES file in the source rpm.
  This update obsoletes the following patches:
  * bind-fix-build-with-older-sphinx.patch
  * bind-CVE-2021-25219.patch
  * bind-9.16.27-0001-CVE-2021-25220.patch
  * bind-9.16.27-0002-CVE-2022-0396.patch
  [bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind-9.16.20.tar.xz, bind-9.16.20.tar.xz.sha512.asc,
  bind-fix-build-with-older-sphinx.patch, bind-CVE-2021-25219.patch,
  bind-9.16.27-0001-CVE-2021-25220.patch,
  bind-9.16.27-0002-CVE-2022-0396.patch,
  jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1661256000">- Update to release 9.16.32
  Feature Changes:
  * The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
  disabled on systems where they are disallowed by the security policy
  (e.g. Red Hat Enterprise Linux 9). Primary zones using those algorithms
  need to be migrated to new algorithms prior to running on these systems,
  as graceful migration to different DNSSEC algorithms is not possible when
  RSASHA1 is disallowed by the operating system.
  * Log messages related to fetch limiting have been improved to provide
  more complete information. Specifically, the final counts of allowed
  and spilled fetches are now logged before the counter object is destroyed.
  Bug Fixes:
  * Non-dynamic zones that inherit dnssec-policy from the view or options
  blocks were not marked as inline-signed and therefore never scheduled
  to be re-signed. This has been fixed.
  * The old max-zone-ttl zone option was meant to be superseded by
  the max-zone-ttl option in dnssec-policy; however, the latter option
  was not fully effective. This has been corrected: zones no longer load
  if they contain TTLs greater than the limit configured in dnssec-policy.
  For zones with both the old max-zone-ttl option and dnssec-policy
  configured, the old option is ignored, and a warning is generated.
  * rndc dumpdb -expired was fixed to include expired RRsets,
  even if stale-cache-enable is set to no and
  the cache-cleaning time window has passed.
  [bind-9.16.32.tar.xz, bind-9.16.32.tar.xz.sha512.asc,
  bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind.spec, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724800">- Include a modified createNamedConfInclude script again, as this
  broke compatability with existing configurations.
  A symlink for named.conf.include to /var/lib/named is created to
  allow for a read-only /etc directory.
  However it is still advised to change the existing configuration.
  See README-bind.chrootenv for a guide how to do this.
  [bsc#1203250, vendor-files/tools/createNamedConfInclude,
  vendor-files/docu/README-bind.chrootenv, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724801">- Add systemd drop-in directory for named service
  [bsc#1201689, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1663761600">- Update to release 9.16.33
  Security Fixes:
  * Previously, there was no limit to the number of database lookups
    performed while processing large delegations, which could be
    abused to severely impact the performance of named running as a
    recursive resolver. This has been fixed. (CVE-2022-2795)
  * named running as a resolver with the stale-answer-client-timeout
    option set to 0 could crash with an assertion failure, when
    there was a stale CNAME in the cache for the incoming query.
    This has been fixed. (CVE-2022-3080)
  * A memory leak was fixed that could be externally triggered in the
    DNSSEC verification code for the ECDSA algorithm. (CVE-2022-38177)
  * Memory leaks were fixed that could be externally triggered in the
    DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178)
  Feature Changes:
  * Response Rate Limiting (RRL) code now treats all QNAMEs that are
    subject to wildcard processing within a given zone as the same
    name, to prevent circumventing the limits enforced by RRL.
  * Zones using dnssec-policy now require dynamic DNS or
    inline-signing to be configured explicitly.
  * A backward-compatible approach was implemented for encoding
    internationalized domain names (IDN) in dig and converting the
    domain to IDNA2008 form; if that fails,
    BIND tries an IDNA2003 conversion.
  Bug Fixes:
  * A serve-stale bug was fixed, where BIND would try to return stale
    data from cache for lookups that received duplicate queries or
    queries that would be dropped. This bug resulted in premature
    SERVFAIL responses, and has now been resolved.
  [bsc#1203614, bsc#1203618, bsc#1203619, bsc#1203620, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1668168000">- Update to release 9.16.34
  New Features:
  * Support for parsing and validating the dohpath service
    parameter in SVCB records was added.
  * named now logs the supported cryptographic algorithms during
    startup and in the output of named -V.
  Bug Fixes:
  * Changing just the TSIG key names for primaries in catalog
    zones’ member zones was not effective. This has been fixed.
  Known Issues:
  * Upgrading from BIND 9.16.32 or any older version may require a
    manual configuration change. The following configurations are
    affected:
  - type primary zones configured with dnssec-policy but without
    either allow-update or update-policy,
  - type secondary zones configured with dnssec-policy.
    In these cases please add inline-signing yes; to the individual
    zone configuration(s). Without applying this change, named will
    fail to start. For more details, see
    https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1669291200">- Update to release 9.16.35
  Bug Fixes:
  * A crash was fixed that happened when a dnssec-policy zone that
    used NSEC3 was reconfigured to enable inline-signing.
  * In certain resolution scenarios, quotas could be erroneously
    reached for servers, including any configured forwarders,
    resulting in SERVFAIL answers being sent to clients.
  * rpz-ip rules in response-policy zones could be ineffective in
    some cases if a query had the CD (Checking Disabled) bit set to
    1.
  * Previously, if Internet connectivity issues were experienced
    during the initial startup of named, a BIND resolver with
    dnssec-validation set to auto could enter into a state where it
    would not recover without stopping named, manually deleting the
    managed-keys.bind and managed-keys.bind.jnl files, and starting
    named again.
  * The statistics counter representing the current number of
    clients awaiting recursive resolution results (RecursClients)
    could overflow in certain resolution scenarios.
  * Previously, BIND failed to start on Solaris-based systems with
    hundreds of CPUs.
  * When a DNS resource record’s TTL value was equal to the
    resolver’s configured prefetch “eligibility” value, the record
    was erroneously not treated as eligible for prefetching.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1671710400">- Update to release 9.16.36
  Feature Changes:
  * The auto-dnssec option has been deprecated and will be removed
    in a future BIND 9.19.x release. Please migrate to
    dnssec-policy.
  Bug Fixes:
  * When a catalog zone was removed from the configuration, in some
    cases a dangling pointer could cause the named process to
    crash.
  * When a zone was deleted from a server, a key management object
    related to that zone was inadvertently kept in memory and only
    released upon shutdown. This could lead to constantly
    increasing memory use on servers with a high rate of changes
    affecting the set of zones being served.
  * In certain cases, named waited for the resolution of
    outstanding recursive queries to finish before shutting down.
  * The zone &lt;name&gt;/&lt;class&gt;: final reference detached log message
    was moved from the INFO log level to the DEBUG(1) log level to
    prevent the named-checkzone tool from superfluously logging
    this message in non-debug mode.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1674561600">- Update to release 9.16.37
  Security Fixes:
  * An UPDATE message flood could cause named to exhaust all
    available memory. This flaw was addressed by adding a new
    update-quota option that controls the maximum number of
    outstanding DNS UPDATE messages that named can hold in a queue
    at any given time (default: 100). (CVE-2022-3094)
  * named could crash with an assertion failure when an RRSIG query
    was received and stale-answer-client-timeout was set to a
    non-zero value. This has been fixed. (CVE-2022-3736)
  * named running as a resolver with the
    stale-answer-client-timeout option set to any value greater
    than 0 could crash with an assertion failure, when the
    recursive-clients soft quota was reached. This has been fixed.
    (CVE-2022-3924)
  New Features:
  * The new update-quota option can be used to control the number
    of simultaneous DNS UPDATE messages that can be processed to
    update an authoritative zone on a primary server, or forwarded
    to the primary server by a secondary server. The default is
    100. A new statistics counter has also been added to record
    events when this quota is exceeded, and the version numbers for
    the XML and JSON statistics schemas have been updated.
  Feature Changes:
  * The Differentiated Services Code Point (DSCP) feature in BIND
    has been deprecated. Configuring DSCP values in named.conf now
    causes a warning to be logged. Note that this feature has only
    been partly operational since the new Network Manager was
    introduced in BIND 9.16.0.
  * The catalog zone implementation has been optimized to work with
    hundreds of thousands of member zones.
  Bug Fixes:
  * In certain query resolution scenarios (e.g. when following
    CNAME records), named configured to answer from stale cache
    could return a SERVFAIL response despite a usable, non-stale
    answer being present in the cache. This has been fixed.
  [bsc#1207471, bsc#1207473, bsc#1207475, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1676548800">- Update to release 9.16.38
  Bug Fixes:
  * A constant stream of zone additions and deletions via rndc
    reconfig could cause increased memory consumption due to
    delayed cleaning of view memory. This has been fixed.
  * The speed of the message digest algorithms (MD5, SHA-1, SHA-2),
    and of NSEC3 hashing, has been improved.
  * Building BIND 9 failed when the --enable-dnsrps switch for
    ./configure was used. This has been fixed.
  [jsc#SLE-24600]
- Updated keyring and signature</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1678881600">- Update to release 9.16.39
  Feature Changes:
  * libuv support for receiving multiple UDP messages in a single
    recvmmsg() system call has been tweaked several times between
    libuv versions 1.35.0 and 1.40.0; the current recommended libuv
    version is 1.40.0 or higher. New rules are now in effect for
    running with a different version of libuv than the one used at
    compilation time. These rules may trigger a fatal error at
    startup:
  - Building against or running with libuv versions 1.35.0 and
    1.36.0 is now a fatal error.
  - Running with libuv version higher than 1.34.2 is now a
    fatal error when named is built against libuv version
    1.34.2 or lower.
  - Running with libuv version higher than 1.39.0 is now a
    fatal error when named is built against libuv version
    1.37.0, 1.38.0, 1.38.1, or 1.39.0.
  * This prevents the use of libuv versions that may trigger an
    assertion failure when receiving multiple UDP messages in a
    single system call.
  Bug Fixes:
  * named could crash with an assertion failure when adding a new
    zone into the configuration file for a name which was already
    configured as a member zone for a catalog zone. This has been
    fixed.
  * When named starts up, it sends a query for the DNSSEC key for
    each configured trust anchor to determine whether the key has
    changed. In some unusual cases, the query might depend on a
    zone for which the server is itself authoritative, and would
    have failed if it were sent before the zone was fully loaded.
    This has now been fixed by delaying the key queries until all
    zones have finished loading.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1682424000">- Update to release 9.16.40
  Bug Fixes:
  * Logfiles using timestamp-style suffixes were not always
    correctly removed when the number of files exceeded the limit
    set by versions. This has been fixed for configurations which
    do not explicitly specify a directory path as part of the file
    argument in the channel specification.
  * Performance of DNSSEC validation in zones with many DNSKEY
    records has been improved.</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1684324800">- Update to release 9.16.41
  Bug Fixes:
  * When removing delegations from an opt-out range,
    empty-non-terminal NSEC3 records generated by those delegations
    were not cleaned up. This has been fixed.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1687348800">- Update to release 9.16.42
  Security Fixes:
  * The overmem cleaning process has been improved, to prevent the
    cache from significantly exceeding the configured
    max-cache-size limit. (CVE-2023-2828)
  * A query that prioritizes stale data over lookup triggers a
    fetch to refresh the stale data in cache. If the fetch is
    aborted for exceeding the recursion quota, it was possible for
    named to enter an infinite callback loop and crash due to stack
    overflow. This has been fixed. (CVE-2023-2911)
  Bug Fixes:
  * Previously, it was possible for a delegation from cache to be
    returned to the client after the stale-answer-client-timeout
    duration. This has been fixed.
  [bsc#1212544, bsc#1212567, jsc#SLE-24600]</changelog>
  <changelog author="dmueller@suse.com" date="1688644800">- rebuild bind-utils on libuv updates (bsc#1212090)</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1688990400">- Log named-checkconf output [bsc#1213049]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1689076800">- Add dnstap support
  [jsc#PED-4852]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1695124800">- Update to release 9.16.44
  Bug Fixes:
  * Processing already-queued queries received over TCP could cause
    an assertion failure, when the server was reconfigured at the
    same time or the cache was being flushed. This has been fixed.
  Security Fixes:
  * Previously, sending a specially crafted message over the
    control channel could cause the packet-parsing code to run out
    of available stack memory, causing named to terminate
    unexpectedly. This has been fixed. (CVE-2023-3341)
  [bsc#1215472]
- Switch to pkgconfig(libprotobuf-c) since this now contains the
  required protobuf-c binary</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1708084800">- Update to new Major Version 9.18.24.
  This has many enhancements, bug fixes and changes.
  Breaking Changes:
  * Some options have been removed and some have been deprecated
    and will be removed in the future.
    For a complete list, see:
    https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918
  Major Changes:
  * Support for securing DNS traffic using Transport Layer Security
    (TLS). TLS is used by both DNS-over-TLS (DoT) and
    DNS-over-HTTPS (DoH).
  * Support for zone transfers over TLS (XFR-over-TLS, XoT) for
    both incoming and outgoing zone transfers.
  * The dig tool is now able to send DoT queries (+tls option).
  * Support for OpenSSL 3.0 APIs was added.
  * dnssec-checkds, dnssec-coverage, dnssec-keymgr, which have been
    removed in favor of the dnssec-policy feature
  * python3-bind is deprecated and the subpackage has been removed
  * A number of utilities have been moved from /usr/sbin to
    /usr/bin:
    named-checkconf named-checkzone named-compilezone
    dnssec-dsfromkey dnssec-importkey dnssec-keyfromlabel
    dnssec-keygen dnssec-revoke dnssec-settime dnssec-signzone
    dnssec-verify dnssec-cds named-journalprint nsec3hash
  * The lib directory was renamed from 'named' to 'bind'
  For a complete list of changes, see:
  * Bind Release Notes
    https://bind9.readthedocs.io/en/v9.18.24/notes.html
  * The CHANGES file in the source RPM
  Security Fixes:
  * Validating DNS messages containing a lot of DNSSEC signatures
    could cause excessive CPU load, leading to a denial-of-service
    condition. This has been fixed. (CVE-2023-50387)
    [bsc#1219823]
  * Preparing an NSEC3 closest encloser proof could cause excessive
    CPU load, leading to a denial-of-service condition. This has
    been fixed. (CVE-2023-50868)
    [bsc#1219826]
  * Parsing DNS messages with many different names could cause
    excessive CPU load. This has been fixed. (CVE-2023-4408)
    [bsc#1219851]
  * Specific queries could cause named to crash with an assertion
    failure when nxdomain-redirect was enabled. This has been
    fixed. (CVE-2023-5517)
    [bsc#1219852]
  * A bad interaction between DNS64 and serve-stale could cause
    named to crash with an assertion failure, when both of these
    features were enabled. This has been fixed. (CVE-2023-5679)
    [bsc#1219853]
  * Query patterns that continuously triggered cache database
    maintenance could cause an excessive amount of memory to be
    allocated, exceeding max-cache-size and potentially leading to
    all available memory on the host running named being exhausted.
    This has been fixed. (CVE-2023-6516)
    [bsc#1219854]
  Packaging notes:
  * libnghttps2 added as BuildRequires for tls support
  * named-bootconf.diff patch is obsolete and has been removed
  [jsc#PED-7932]
- Update KillMode to 'control-group' in named.service to handle
  forked processes better.
  [bsc#1215755]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1721908800">- Update to release 9.18.28
  Bug Fixes:
  * Command-line options for IPv4-only (named -4) and IPv6-only
    (named -6) modes are now respected for zone primaries,
    also-notify, and parental-agents.
  * An RPZ response’s SOA record TTL was set to 1 instead of the
    SOA TTL, if add-soa was used. This has been fixed.
  * When a query related to zone maintenance (NOTIFY, SOA) timed
    out close to a view shutdown (triggered e.g. by rndc reload),
    named could crash with an assertion failure. This has been
    fixed.
  * The statistics channel counters that indicated the number of
    currently connected TCP IPv4/IPv6 clients were not properly
    adjusted in certain failure scenarios. This has been fixed.
  * Some servers that could not be reached due to EHOSTDOWN or
    ENETDOWN conditions were incorrectly prioritized during server
    selection. These are now properly handled as unreachable.
  * On some systems the libuv call may return an error code when
    sending a TCP reset for a connection, which triggers an
    assertion failure in named. This error condition is now dealt
    with in a more graceful manner, by logging the incident and
    shutting down the connection.
  * Changes to listen-on statements were ignored on reconfiguration
    unless the port or interface address was changed, making it
    impossible to change a related listener transport type. That
    issue has been fixed.
  * A bug in the keymgr code unintentionally slowed down some
    DNSSEC key rollovers. This has been fixed.
  * Some ISO 8601 durations were accepted erroneously, leading to
    shorter durations than expected. This has been fixed
  * A regression in cache-cleaning code enabled memory use to grow
    significantly more quickly than before, until the configured
    max-cache-size limit was reached. This has been fixed.
  * Using rndc flush inadvertently caused cache cleaning to become
    less effective. This could ultimately lead to the configured
    max-cache-size limit being exceeded and has now been fixed.
  * The logic for cleaning up expired cached DNS records was
    tweaked to be more aggressive. This change helps with enforcing
    max-cache-ttl and max-ncache-ttl in a timely manner.
  * It was possible to trigger a use-after-free assertion when the
    overmem cache cleaning was initiated. This has been fixed.
  New Features:
  * A new option signatures-jitter has been added to dnssec-policy
    to allow signature expirations to be spread out over a period
    of time.
  * The statistics channel now includes counters that indicate the
    number of currently connected TCP IPv4/IPv6 clients.
  * Added RESOLVER.ARPA to the built in empty zones.
  Feature Changes:
  * DNSSEC signatures that are not valid because the current time
    falls outside the signature inception and expiration dates are
    skipped instead of causing an immediate validation failure.
  Security Fixes:
  * A malicious DNS client that sent many queries over TCP but
    never read the responses could cause a server to respond slowly
    or not at all for other clients. This has been fixed.
    (CVE-2024-0760)
    [bsc#1228255]
  * It is possible to craft excessively large resource records
    sets, which have the effect of slowing down database
    processing. This has been addressed by adding a configurable
    limit to the number of records that can be stored per name and
    type in a cache or zone database. The default is 100, which can
    be tuned with the new max-records-per-type option.
  * It is possible to craft excessively large numbers of resource
    record types for a given owner name, which has the effect of
    slowing down database processing. This has been addressed by
    adding a configurable limit to the number of records that can
    be stored per name and type in a cache or zone database. The
    default is 100, which can be tuned with the new
    max-types-per-name option. (CVE-2024-1737)
    [bsc#1228256]
  * Validating DNS messages signed using the SIG(0) protocol (RFC
    2931) could cause excessive CPU load, leading to a
    denial-of-service condition. Support for SIG(0) message
    validation was removed from this version of named.
    (CVE-2024-1975)
    [bsc#1228257]
  * Due to a logic error, lookups that triggered serving stale data
    and required lookups in local authoritative zone data could
    have resulted in an assertion failure. This has been fixed.
  * Potential data races were found in our DoH implementation,
    related to HTTP/2 session object management and endpoints set
    object management after reconfiguration. These issues have been
    fixed.
  * When looking up the NS records of parent zones as part of
    looking up DS records, it was possible for named to trigger an
    assertion failure if serve-stale was enabled. This has been
    fixed. (CVE-2024-4076)
    [bsc#1228258]</changelog>
</package>
<package pkgid="a96ae6bcf7dc79b7e5b9f56ae83442d3f0f73491a3e64869f09467bd38eea543" name="bind" arch="s390x">
  <version epoch="0" ver="9.18.28" rel="150600.3.3.1"/>
  <changelog author="josef.moellers@suse.com" date="1657800000">- Update to release 9.16.31
  This is the first of monthly updates of "bind". It is planned
  to update bind when a new upstream maintennace release becomes
  available, which is usually towards the end of a month, see
  https://www.isc.org/blogs/2021-bind-release-model/
  Compared to the previous SUSE release, in this release,
  53 (minor) bugs were fixed
  13 (minor) functional enhancements were made
  3 security issues are now fixed upstream:
    CVE-2022-0396, CVE-2021-25220, CVE-2021-25219
  plus a few minor changes.
  For a full list of changes, please refer to the
  CHANGES file in the source rpm.
  This update obsoletes the following patches:
  * bind-fix-build-with-older-sphinx.patch
  * bind-CVE-2021-25219.patch
  * bind-9.16.27-0001-CVE-2021-25220.patch
  * bind-9.16.27-0002-CVE-2022-0396.patch
  [bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind-9.16.20.tar.xz, bind-9.16.20.tar.xz.sha512.asc,
  bind-fix-build-with-older-sphinx.patch, bind-CVE-2021-25219.patch,
  bind-9.16.27-0001-CVE-2021-25220.patch,
  bind-9.16.27-0002-CVE-2022-0396.patch,
  jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1661256000">- Update to release 9.16.32
  Feature Changes:
  * The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
  disabled on systems where they are disallowed by the security policy
  (e.g. Red Hat Enterprise Linux 9). Primary zones using those algorithms
  need to be migrated to new algorithms prior to running on these systems,
  as graceful migration to different DNSSEC algorithms is not possible when
  RSASHA1 is disallowed by the operating system.
  * Log messages related to fetch limiting have been improved to provide
  more complete information. Specifically, the final counts of allowed
  and spilled fetches are now logged before the counter object is destroyed.
  Bug Fixes:
  * Non-dynamic zones that inherit dnssec-policy from the view or options
  blocks were not marked as inline-signed and therefore never scheduled
  to be re-signed. This has been fixed.
  * The old max-zone-ttl zone option was meant to be superseded by
  the max-zone-ttl option in dnssec-policy; however, the latter option
  was not fully effective. This has been corrected: zones no longer load
  if they contain TTLs greater than the limit configured in dnssec-policy.
  For zones with both the old max-zone-ttl option and dnssec-policy
  configured, the old option is ignored, and a warning is generated.
  * rndc dumpdb -expired was fixed to include expired RRsets,
  even if stale-cache-enable is set to no and
  the cache-cleaning time window has passed.
  [bind-9.16.32.tar.xz, bind-9.16.32.tar.xz.sha512.asc,
  bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind.spec, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724800">- Include a modified createNamedConfInclude script again, as this
  broke compatability with existing configurations.
  A symlink for named.conf.include to /var/lib/named is created to
  allow for a read-only /etc directory.
  However it is still advised to change the existing configuration.
  See README-bind.chrootenv for a guide how to do this.
  [bsc#1203250, vendor-files/tools/createNamedConfInclude,
  vendor-files/docu/README-bind.chrootenv, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724801">- Add systemd drop-in directory for named service
  [bsc#1201689, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1663761600">- Update to release 9.16.33
  Security Fixes:
  * Previously, there was no limit to the number of database lookups
    performed while processing large delegations, which could be
    abused to severely impact the performance of named running as a
    recursive resolver. This has been fixed. (CVE-2022-2795)
  * named running as a resolver with the stale-answer-client-timeout
    option set to 0 could crash with an assertion failure, when
    there was a stale CNAME in the cache for the incoming query.
    This has been fixed. (CVE-2022-3080)
  * A memory leak was fixed that could be externally triggered in the
    DNSSEC verification code for the ECDSA algorithm. (CVE-2022-38177)
  * Memory leaks were fixed that could be externally triggered in the
    DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178)
  Feature Changes:
  * Response Rate Limiting (RRL) code now treats all QNAMEs that are
    subject to wildcard processing within a given zone as the same
    name, to prevent circumventing the limits enforced by RRL.
  * Zones using dnssec-policy now require dynamic DNS or
    inline-signing to be configured explicitly.
  * A backward-compatible approach was implemented for encoding
    internationalized domain names (IDN) in dig and converting the
    domain to IDNA2008 form; if that fails,
    BIND tries an IDNA2003 conversion.
  Bug Fixes:
  * A serve-stale bug was fixed, where BIND would try to return stale
    data from cache for lookups that received duplicate queries or
    queries that would be dropped. This bug resulted in premature
    SERVFAIL responses, and has now been resolved.
  [bsc#1203614, bsc#1203618, bsc#1203619, bsc#1203620, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1668168000">- Update to release 9.16.34
  New Features:
  * Support for parsing and validating the dohpath service
    parameter in SVCB records was added.
  * named now logs the supported cryptographic algorithms during
    startup and in the output of named -V.
  Bug Fixes:
  * Changing just the TSIG key names for primaries in catalog
    zones’ member zones was not effective. This has been fixed.
  Known Issues:
  * Upgrading from BIND 9.16.32 or any older version may require a
    manual configuration change. The following configurations are
    affected:
  - type primary zones configured with dnssec-policy but without
    either allow-update or update-policy,
  - type secondary zones configured with dnssec-policy.
    In these cases please add inline-signing yes; to the individual
    zone configuration(s). Without applying this change, named will
    fail to start. For more details, see
    https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1669291200">- Update to release 9.16.35
  Bug Fixes:
  * A crash was fixed that happened when a dnssec-policy zone that
    used NSEC3 was reconfigured to enable inline-signing.
  * In certain resolution scenarios, quotas could be erroneously
    reached for servers, including any configured forwarders,
    resulting in SERVFAIL answers being sent to clients.
  * rpz-ip rules in response-policy zones could be ineffective in
    some cases if a query had the CD (Checking Disabled) bit set to
    1.
  * Previously, if Internet connectivity issues were experienced
    during the initial startup of named, a BIND resolver with
    dnssec-validation set to auto could enter into a state where it
    would not recover without stopping named, manually deleting the
    managed-keys.bind and managed-keys.bind.jnl files, and starting
    named again.
  * The statistics counter representing the current number of
    clients awaiting recursive resolution results (RecursClients)
    could overflow in certain resolution scenarios.
  * Previously, BIND failed to start on Solaris-based systems with
    hundreds of CPUs.
  * When a DNS resource record’s TTL value was equal to the
    resolver’s configured prefetch “eligibility” value, the record
    was erroneously not treated as eligible for prefetching.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1671710400">- Update to release 9.16.36
  Feature Changes:
  * The auto-dnssec option has been deprecated and will be removed
    in a future BIND 9.19.x release. Please migrate to
    dnssec-policy.
  Bug Fixes:
  * When a catalog zone was removed from the configuration, in some
    cases a dangling pointer could cause the named process to
    crash.
  * When a zone was deleted from a server, a key management object
    related to that zone was inadvertently kept in memory and only
    released upon shutdown. This could lead to constantly
    increasing memory use on servers with a high rate of changes
    affecting the set of zones being served.
  * In certain cases, named waited for the resolution of
    outstanding recursive queries to finish before shutting down.
  * The zone &lt;name&gt;/&lt;class&gt;: final reference detached log message
    was moved from the INFO log level to the DEBUG(1) log level to
    prevent the named-checkzone tool from superfluously logging
    this message in non-debug mode.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1674561600">- Update to release 9.16.37
  Security Fixes:
  * An UPDATE message flood could cause named to exhaust all
    available memory. This flaw was addressed by adding a new
    update-quota option that controls the maximum number of
    outstanding DNS UPDATE messages that named can hold in a queue
    at any given time (default: 100). (CVE-2022-3094)
  * named could crash with an assertion failure when an RRSIG query
    was received and stale-answer-client-timeout was set to a
    non-zero value. This has been fixed. (CVE-2022-3736)
  * named running as a resolver with the
    stale-answer-client-timeout option set to any value greater
    than 0 could crash with an assertion failure, when the
    recursive-clients soft quota was reached. This has been fixed.
    (CVE-2022-3924)
  New Features:
  * The new update-quota option can be used to control the number
    of simultaneous DNS UPDATE messages that can be processed to
    update an authoritative zone on a primary server, or forwarded
    to the primary server by a secondary server. The default is
    100. A new statistics counter has also been added to record
    events when this quota is exceeded, and the version numbers for
    the XML and JSON statistics schemas have been updated.
  Feature Changes:
  * The Differentiated Services Code Point (DSCP) feature in BIND
    has been deprecated. Configuring DSCP values in named.conf now
    causes a warning to be logged. Note that this feature has only
    been partly operational since the new Network Manager was
    introduced in BIND 9.16.0.
  * The catalog zone implementation has been optimized to work with
    hundreds of thousands of member zones.
  Bug Fixes:
  * In certain query resolution scenarios (e.g. when following
    CNAME records), named configured to answer from stale cache
    could return a SERVFAIL response despite a usable, non-stale
    answer being present in the cache. This has been fixed.
  [bsc#1207471, bsc#1207473, bsc#1207475, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1676548800">- Update to release 9.16.38
  Bug Fixes:
  * A constant stream of zone additions and deletions via rndc
    reconfig could cause increased memory consumption due to
    delayed cleaning of view memory. This has been fixed.
  * The speed of the message digest algorithms (MD5, SHA-1, SHA-2),
    and of NSEC3 hashing, has been improved.
  * Building BIND 9 failed when the --enable-dnsrps switch for
    ./configure was used. This has been fixed.
  [jsc#SLE-24600]
- Updated keyring and signature</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1678881600">- Update to release 9.16.39
  Feature Changes:
  * libuv support for receiving multiple UDP messages in a single
    recvmmsg() system call has been tweaked several times between
    libuv versions 1.35.0 and 1.40.0; the current recommended libuv
    version is 1.40.0 or higher. New rules are now in effect for
    running with a different version of libuv than the one used at
    compilation time. These rules may trigger a fatal error at
    startup:
  - Building against or running with libuv versions 1.35.0 and
    1.36.0 is now a fatal error.
  - Running with libuv version higher than 1.34.2 is now a
    fatal error when named is built against libuv version
    1.34.2 or lower.
  - Running with libuv version higher than 1.39.0 is now a
    fatal error when named is built against libuv version
    1.37.0, 1.38.0, 1.38.1, or 1.39.0.
  * This prevents the use of libuv versions that may trigger an
    assertion failure when receiving multiple UDP messages in a
    single system call.
  Bug Fixes:
  * named could crash with an assertion failure when adding a new
    zone into the configuration file for a name which was already
    configured as a member zone for a catalog zone. This has been
    fixed.
  * When named starts up, it sends a query for the DNSSEC key for
    each configured trust anchor to determine whether the key has
    changed. In some unusual cases, the query might depend on a
    zone for which the server is itself authoritative, and would
    have failed if it were sent before the zone was fully loaded.
    This has now been fixed by delaying the key queries until all
    zones have finished loading.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1682424000">- Update to release 9.16.40
  Bug Fixes:
  * Logfiles using timestamp-style suffixes were not always
    correctly removed when the number of files exceeded the limit
    set by versions. This has been fixed for configurations which
    do not explicitly specify a directory path as part of the file
    argument in the channel specification.
  * Performance of DNSSEC validation in zones with many DNSKEY
    records has been improved.</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1684324800">- Update to release 9.16.41
  Bug Fixes:
  * When removing delegations from an opt-out range,
    empty-non-terminal NSEC3 records generated by those delegations
    were not cleaned up. This has been fixed.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1687348800">- Update to release 9.16.42
  Security Fixes:
  * The overmem cleaning process has been improved, to prevent the
    cache from significantly exceeding the configured
    max-cache-size limit. (CVE-2023-2828)
  * A query that prioritizes stale data over lookup triggers a
    fetch to refresh the stale data in cache. If the fetch is
    aborted for exceeding the recursion quota, it was possible for
    named to enter an infinite callback loop and crash due to stack
    overflow. This has been fixed. (CVE-2023-2911)
  Bug Fixes:
  * Previously, it was possible for a delegation from cache to be
    returned to the client after the stale-answer-client-timeout
    duration. This has been fixed.
  [bsc#1212544, bsc#1212567, jsc#SLE-24600]</changelog>
  <changelog author="dmueller@suse.com" date="1688644800">- rebuild bind-utils on libuv updates (bsc#1212090)</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1688990400">- Log named-checkconf output [bsc#1213049]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1689076800">- Add dnstap support
  [jsc#PED-4852]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1695124800">- Update to release 9.16.44
  Bug Fixes:
  * Processing already-queued queries received over TCP could cause
    an assertion failure, when the server was reconfigured at the
    same time or the cache was being flushed. This has been fixed.
  Security Fixes:
  * Previously, sending a specially crafted message over the
    control channel could cause the packet-parsing code to run out
    of available stack memory, causing named to terminate
    unexpectedly. This has been fixed. (CVE-2023-3341)
  [bsc#1215472]
- Switch to pkgconfig(libprotobuf-c) since this now contains the
  required protobuf-c binary</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1708084800">- Update to new Major Version 9.18.24.
  This has many enhancements, bug fixes and changes.
  Breaking Changes:
  * Some options have been removed and some have been deprecated
    and will be removed in the future.
    For a complete list, see:
    https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918
  Major Changes:
  * Support for securing DNS traffic using Transport Layer Security
    (TLS). TLS is used by both DNS-over-TLS (DoT) and
    DNS-over-HTTPS (DoH).
  * Support for zone transfers over TLS (XFR-over-TLS, XoT) for
    both incoming and outgoing zone transfers.
  * The dig tool is now able to send DoT queries (+tls option).
  * Support for OpenSSL 3.0 APIs was added.
  * dnssec-checkds, dnssec-coverage, dnssec-keymgr, which have been
    removed in favor of the dnssec-policy feature
  * python3-bind is deprecated and the subpackage has been removed
  * A number of utilities have been moved from /usr/sbin to
    /usr/bin:
    named-checkconf named-checkzone named-compilezone
    dnssec-dsfromkey dnssec-importkey dnssec-keyfromlabel
    dnssec-keygen dnssec-revoke dnssec-settime dnssec-signzone
    dnssec-verify dnssec-cds named-journalprint nsec3hash
  * The lib directory was renamed from 'named' to 'bind'
  For a complete list of changes, see:
  * Bind Release Notes
    https://bind9.readthedocs.io/en/v9.18.24/notes.html
  * The CHANGES file in the source RPM
  Security Fixes:
  * Validating DNS messages containing a lot of DNSSEC signatures
    could cause excessive CPU load, leading to a denial-of-service
    condition. This has been fixed. (CVE-2023-50387)
    [bsc#1219823]
  * Preparing an NSEC3 closest encloser proof could cause excessive
    CPU load, leading to a denial-of-service condition. This has
    been fixed. (CVE-2023-50868)
    [bsc#1219826]
  * Parsing DNS messages with many different names could cause
    excessive CPU load. This has been fixed. (CVE-2023-4408)
    [bsc#1219851]
  * Specific queries could cause named to crash with an assertion
    failure when nxdomain-redirect was enabled. This has been
    fixed. (CVE-2023-5517)
    [bsc#1219852]
  * A bad interaction between DNS64 and serve-stale could cause
    named to crash with an assertion failure, when both of these
    features were enabled. This has been fixed. (CVE-2023-5679)
    [bsc#1219853]
  * Query patterns that continuously triggered cache database
    maintenance could cause an excessive amount of memory to be
    allocated, exceeding max-cache-size and potentially leading to
    all available memory on the host running named being exhausted.
    This has been fixed. (CVE-2023-6516)
    [bsc#1219854]
  Packaging notes:
  * libnghttps2 added as BuildRequires for tls support
  * named-bootconf.diff patch is obsolete and has been removed
  [jsc#PED-7932]
- Update KillMode to 'control-group' in named.service to handle
  forked processes better.
  [bsc#1215755]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1721908800">- Update to release 9.18.28
  Bug Fixes:
  * Command-line options for IPv4-only (named -4) and IPv6-only
    (named -6) modes are now respected for zone primaries,
    also-notify, and parental-agents.
  * An RPZ response’s SOA record TTL was set to 1 instead of the
    SOA TTL, if add-soa was used. This has been fixed.
  * When a query related to zone maintenance (NOTIFY, SOA) timed
    out close to a view shutdown (triggered e.g. by rndc reload),
    named could crash with an assertion failure. This has been
    fixed.
  * The statistics channel counters that indicated the number of
    currently connected TCP IPv4/IPv6 clients were not properly
    adjusted in certain failure scenarios. This has been fixed.
  * Some servers that could not be reached due to EHOSTDOWN or
    ENETDOWN conditions were incorrectly prioritized during server
    selection. These are now properly handled as unreachable.
  * On some systems the libuv call may return an error code when
    sending a TCP reset for a connection, which triggers an
    assertion failure in named. This error condition is now dealt
    with in a more graceful manner, by logging the incident and
    shutting down the connection.
  * Changes to listen-on statements were ignored on reconfiguration
    unless the port or interface address was changed, making it
    impossible to change a related listener transport type. That
    issue has been fixed.
  * A bug in the keymgr code unintentionally slowed down some
    DNSSEC key rollovers. This has been fixed.
  * Some ISO 8601 durations were accepted erroneously, leading to
    shorter durations than expected. This has been fixed
  * A regression in cache-cleaning code enabled memory use to grow
    significantly more quickly than before, until the configured
    max-cache-size limit was reached. This has been fixed.
  * Using rndc flush inadvertently caused cache cleaning to become
    less effective. This could ultimately lead to the configured
    max-cache-size limit being exceeded and has now been fixed.
  * The logic for cleaning up expired cached DNS records was
    tweaked to be more aggressive. This change helps with enforcing
    max-cache-ttl and max-ncache-ttl in a timely manner.
  * It was possible to trigger a use-after-free assertion when the
    overmem cache cleaning was initiated. This has been fixed.
  New Features:
  * A new option signatures-jitter has been added to dnssec-policy
    to allow signature expirations to be spread out over a period
    of time.
  * The statistics channel now includes counters that indicate the
    number of currently connected TCP IPv4/IPv6 clients.
  * Added RESOLVER.ARPA to the built in empty zones.
  Feature Changes:
  * DNSSEC signatures that are not valid because the current time
    falls outside the signature inception and expiration dates are
    skipped instead of causing an immediate validation failure.
  Security Fixes:
  * A malicious DNS client that sent many queries over TCP but
    never read the responses could cause a server to respond slowly
    or not at all for other clients. This has been fixed.
    (CVE-2024-0760)
    [bsc#1228255]
  * It is possible to craft excessively large resource records
    sets, which have the effect of slowing down database
    processing. This has been addressed by adding a configurable
    limit to the number of records that can be stored per name and
    type in a cache or zone database. The default is 100, which can
    be tuned with the new max-records-per-type option.
  * It is possible to craft excessively large numbers of resource
    record types for a given owner name, which has the effect of
    slowing down database processing. This has been addressed by
    adding a configurable limit to the number of records that can
    be stored per name and type in a cache or zone database. The
    default is 100, which can be tuned with the new
    max-types-per-name option. (CVE-2024-1737)
    [bsc#1228256]
  * Validating DNS messages signed using the SIG(0) protocol (RFC
    2931) could cause excessive CPU load, leading to a
    denial-of-service condition. Support for SIG(0) message
    validation was removed from this version of named.
    (CVE-2024-1975)
    [bsc#1228257]
  * Due to a logic error, lookups that triggered serving stale data
    and required lookups in local authoritative zone data could
    have resulted in an assertion failure. This has been fixed.
  * Potential data races were found in our DoH implementation,
    related to HTTP/2 session object management and endpoints set
    object management after reconfiguration. These issues have been
    fixed.
  * When looking up the NS records of parent zones as part of
    looking up DS records, it was possible for named to trigger an
    assertion failure if serve-stale was enabled. This has been
    fixed. (CVE-2024-4076)
    [bsc#1228258]</changelog>
</package>
<package pkgid="550908d69c1d05938cc7bd417278a8601b013d45cf3005effbb55e9ad1993d04" name="bind" arch="src">
  <version epoch="0" ver="9.18.28" rel="150600.3.3.1"/>
  <changelog author="josef.moellers@suse.com" date="1657800000">- Update to release 9.16.31
  This is the first of monthly updates of "bind". It is planned
  to update bind when a new upstream maintennace release becomes
  available, which is usually towards the end of a month, see
  https://www.isc.org/blogs/2021-bind-release-model/
  Compared to the previous SUSE release, in this release,
  53 (minor) bugs were fixed
  13 (minor) functional enhancements were made
  3 security issues are now fixed upstream:
    CVE-2022-0396, CVE-2021-25220, CVE-2021-25219
  plus a few minor changes.
  For a full list of changes, please refer to the
  CHANGES file in the source rpm.
  This update obsoletes the following patches:
  * bind-fix-build-with-older-sphinx.patch
  * bind-CVE-2021-25219.patch
  * bind-9.16.27-0001-CVE-2021-25220.patch
  * bind-9.16.27-0002-CVE-2022-0396.patch
  [bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind-9.16.20.tar.xz, bind-9.16.20.tar.xz.sha512.asc,
  bind-fix-build-with-older-sphinx.patch, bind-CVE-2021-25219.patch,
  bind-9.16.27-0001-CVE-2021-25220.patch,
  bind-9.16.27-0002-CVE-2022-0396.patch,
  jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1661256000">- Update to release 9.16.32
  Feature Changes:
  * The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
  disabled on systems where they are disallowed by the security policy
  (e.g. Red Hat Enterprise Linux 9). Primary zones using those algorithms
  need to be migrated to new algorithms prior to running on these systems,
  as graceful migration to different DNSSEC algorithms is not possible when
  RSASHA1 is disallowed by the operating system.
  * Log messages related to fetch limiting have been improved to provide
  more complete information. Specifically, the final counts of allowed
  and spilled fetches are now logged before the counter object is destroyed.
  Bug Fixes:
  * Non-dynamic zones that inherit dnssec-policy from the view or options
  blocks were not marked as inline-signed and therefore never scheduled
  to be re-signed. This has been fixed.
  * The old max-zone-ttl zone option was meant to be superseded by
  the max-zone-ttl option in dnssec-policy; however, the latter option
  was not fully effective. This has been corrected: zones no longer load
  if they contain TTLs greater than the limit configured in dnssec-policy.
  For zones with both the old max-zone-ttl option and dnssec-policy
  configured, the old option is ignored, and a warning is generated.
  * rndc dumpdb -expired was fixed to include expired RRsets,
  even if stale-cache-enable is set to no and
  the cache-cleaning time window has passed.
  [bind-9.16.32.tar.xz, bind-9.16.32.tar.xz.sha512.asc,
  bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind.spec, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724800">- Include a modified createNamedConfInclude script again, as this
  broke compatability with existing configurations.
  A symlink for named.conf.include to /var/lib/named is created to
  allow for a read-only /etc directory.
  However it is still advised to change the existing configuration.
  See README-bind.chrootenv for a guide how to do this.
  [bsc#1203250, vendor-files/tools/createNamedConfInclude,
  vendor-files/docu/README-bind.chrootenv, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724801">- Add systemd drop-in directory for named service
  [bsc#1201689, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1663761600">- Update to release 9.16.33
  Security Fixes:
  * Previously, there was no limit to the number of database lookups
    performed while processing large delegations, which could be
    abused to severely impact the performance of named running as a
    recursive resolver. This has been fixed. (CVE-2022-2795)
  * named running as a resolver with the stale-answer-client-timeout
    option set to 0 could crash with an assertion failure, when
    there was a stale CNAME in the cache for the incoming query.
    This has been fixed. (CVE-2022-3080)
  * A memory leak was fixed that could be externally triggered in the
    DNSSEC verification code for the ECDSA algorithm. (CVE-2022-38177)
  * Memory leaks were fixed that could be externally triggered in the
    DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178)
  Feature Changes:
  * Response Rate Limiting (RRL) code now treats all QNAMEs that are
    subject to wildcard processing within a given zone as the same
    name, to prevent circumventing the limits enforced by RRL.
  * Zones using dnssec-policy now require dynamic DNS or
    inline-signing to be configured explicitly.
  * A backward-compatible approach was implemented for encoding
    internationalized domain names (IDN) in dig and converting the
    domain to IDNA2008 form; if that fails,
    BIND tries an IDNA2003 conversion.
  Bug Fixes:
  * A serve-stale bug was fixed, where BIND would try to return stale
    data from cache for lookups that received duplicate queries or
    queries that would be dropped. This bug resulted in premature
    SERVFAIL responses, and has now been resolved.
  [bsc#1203614, bsc#1203618, bsc#1203619, bsc#1203620, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1668168000">- Update to release 9.16.34
  New Features:
  * Support for parsing and validating the dohpath service
    parameter in SVCB records was added.
  * named now logs the supported cryptographic algorithms during
    startup and in the output of named -V.
  Bug Fixes:
  * Changing just the TSIG key names for primaries in catalog
    zones’ member zones was not effective. This has been fixed.
  Known Issues:
  * Upgrading from BIND 9.16.32 or any older version may require a
    manual configuration change. The following configurations are
    affected:
  - type primary zones configured with dnssec-policy but without
    either allow-update or update-policy,
  - type secondary zones configured with dnssec-policy.
    In these cases please add inline-signing yes; to the individual
    zone configuration(s). Without applying this change, named will
    fail to start. For more details, see
    https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1669291200">- Update to release 9.16.35
  Bug Fixes:
  * A crash was fixed that happened when a dnssec-policy zone that
    used NSEC3 was reconfigured to enable inline-signing.
  * In certain resolution scenarios, quotas could be erroneously
    reached for servers, including any configured forwarders,
    resulting in SERVFAIL answers being sent to clients.
  * rpz-ip rules in response-policy zones could be ineffective in
    some cases if a query had the CD (Checking Disabled) bit set to
    1.
  * Previously, if Internet connectivity issues were experienced
    during the initial startup of named, a BIND resolver with
    dnssec-validation set to auto could enter into a state where it
    would not recover without stopping named, manually deleting the
    managed-keys.bind and managed-keys.bind.jnl files, and starting
    named again.
  * The statistics counter representing the current number of
    clients awaiting recursive resolution results (RecursClients)
    could overflow in certain resolution scenarios.
  * Previously, BIND failed to start on Solaris-based systems with
    hundreds of CPUs.
  * When a DNS resource record’s TTL value was equal to the
    resolver’s configured prefetch “eligibility” value, the record
    was erroneously not treated as eligible for prefetching.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1671710400">- Update to release 9.16.36
  Feature Changes:
  * The auto-dnssec option has been deprecated and will be removed
    in a future BIND 9.19.x release. Please migrate to
    dnssec-policy.
  Bug Fixes:
  * When a catalog zone was removed from the configuration, in some
    cases a dangling pointer could cause the named process to
    crash.
  * When a zone was deleted from a server, a key management object
    related to that zone was inadvertently kept in memory and only
    released upon shutdown. This could lead to constantly
    increasing memory use on servers with a high rate of changes
    affecting the set of zones being served.
  * In certain cases, named waited for the resolution of
    outstanding recursive queries to finish before shutting down.
  * The zone &lt;name&gt;/&lt;class&gt;: final reference detached log message
    was moved from the INFO log level to the DEBUG(1) log level to
    prevent the named-checkzone tool from superfluously logging
    this message in non-debug mode.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1674561600">- Update to release 9.16.37
  Security Fixes:
  * An UPDATE message flood could cause named to exhaust all
    available memory. This flaw was addressed by adding a new
    update-quota option that controls the maximum number of
    outstanding DNS UPDATE messages that named can hold in a queue
    at any given time (default: 100). (CVE-2022-3094)
  * named could crash with an assertion failure when an RRSIG query
    was received and stale-answer-client-timeout was set to a
    non-zero value. This has been fixed. (CVE-2022-3736)
  * named running as a resolver with the
    stale-answer-client-timeout option set to any value greater
    than 0 could crash with an assertion failure, when the
    recursive-clients soft quota was reached. This has been fixed.
    (CVE-2022-3924)
  New Features:
  * The new update-quota option can be used to control the number
    of simultaneous DNS UPDATE messages that can be processed to
    update an authoritative zone on a primary server, or forwarded
    to the primary server by a secondary server. The default is
    100. A new statistics counter has also been added to record
    events when this quota is exceeded, and the version numbers for
    the XML and JSON statistics schemas have been updated.
  Feature Changes:
  * The Differentiated Services Code Point (DSCP) feature in BIND
    has been deprecated. Configuring DSCP values in named.conf now
    causes a warning to be logged. Note that this feature has only
    been partly operational since the new Network Manager was
    introduced in BIND 9.16.0.
  * The catalog zone implementation has been optimized to work with
    hundreds of thousands of member zones.
  Bug Fixes:
  * In certain query resolution scenarios (e.g. when following
    CNAME records), named configured to answer from stale cache
    could return a SERVFAIL response despite a usable, non-stale
    answer being present in the cache. This has been fixed.
  [bsc#1207471, bsc#1207473, bsc#1207475, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1676548800">- Update to release 9.16.38
  Bug Fixes:
  * A constant stream of zone additions and deletions via rndc
    reconfig could cause increased memory consumption due to
    delayed cleaning of view memory. This has been fixed.
  * The speed of the message digest algorithms (MD5, SHA-1, SHA-2),
    and of NSEC3 hashing, has been improved.
  * Building BIND 9 failed when the --enable-dnsrps switch for
    ./configure was used. This has been fixed.
  [jsc#SLE-24600]
- Updated keyring and signature</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1678881600">- Update to release 9.16.39
  Feature Changes:
  * libuv support for receiving multiple UDP messages in a single
    recvmmsg() system call has been tweaked several times between
    libuv versions 1.35.0 and 1.40.0; the current recommended libuv
    version is 1.40.0 or higher. New rules are now in effect for
    running with a different version of libuv than the one used at
    compilation time. These rules may trigger a fatal error at
    startup:
  - Building against or running with libuv versions 1.35.0 and
    1.36.0 is now a fatal error.
  - Running with libuv version higher than 1.34.2 is now a
    fatal error when named is built against libuv version
    1.34.2 or lower.
  - Running with libuv version higher than 1.39.0 is now a
    fatal error when named is built against libuv version
    1.37.0, 1.38.0, 1.38.1, or 1.39.0.
  * This prevents the use of libuv versions that may trigger an
    assertion failure when receiving multiple UDP messages in a
    single system call.
  Bug Fixes:
  * named could crash with an assertion failure when adding a new
    zone into the configuration file for a name which was already
    configured as a member zone for a catalog zone. This has been
    fixed.
  * When named starts up, it sends a query for the DNSSEC key for
    each configured trust anchor to determine whether the key has
    changed. In some unusual cases, the query might depend on a
    zone for which the server is itself authoritative, and would
    have failed if it were sent before the zone was fully loaded.
    This has now been fixed by delaying the key queries until all
    zones have finished loading.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1682424000">- Update to release 9.16.40
  Bug Fixes:
  * Logfiles using timestamp-style suffixes were not always
    correctly removed when the number of files exceeded the limit
    set by versions. This has been fixed for configurations which
    do not explicitly specify a directory path as part of the file
    argument in the channel specification.
  * Performance of DNSSEC validation in zones with many DNSKEY
    records has been improved.</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1684324800">- Update to release 9.16.41
  Bug Fixes:
  * When removing delegations from an opt-out range,
    empty-non-terminal NSEC3 records generated by those delegations
    were not cleaned up. This has been fixed.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1687348800">- Update to release 9.16.42
  Security Fixes:
  * The overmem cleaning process has been improved, to prevent the
    cache from significantly exceeding the configured
    max-cache-size limit. (CVE-2023-2828)
  * A query that prioritizes stale data over lookup triggers a
    fetch to refresh the stale data in cache. If the fetch is
    aborted for exceeding the recursion quota, it was possible for
    named to enter an infinite callback loop and crash due to stack
    overflow. This has been fixed. (CVE-2023-2911)
  Bug Fixes:
  * Previously, it was possible for a delegation from cache to be
    returned to the client after the stale-answer-client-timeout
    duration. This has been fixed.
  [bsc#1212544, bsc#1212567, jsc#SLE-24600]</changelog>
  <changelog author="dmueller@suse.com" date="1688644800">- rebuild bind-utils on libuv updates (bsc#1212090)</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1688990400">- Log named-checkconf output [bsc#1213049]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1689076800">- Add dnstap support
  [jsc#PED-4852]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1695124800">- Update to release 9.16.44
  Bug Fixes:
  * Processing already-queued queries received over TCP could cause
    an assertion failure, when the server was reconfigured at the
    same time or the cache was being flushed. This has been fixed.
  Security Fixes:
  * Previously, sending a specially crafted message over the
    control channel could cause the packet-parsing code to run out
    of available stack memory, causing named to terminate
    unexpectedly. This has been fixed. (CVE-2023-3341)
  [bsc#1215472]
- Switch to pkgconfig(libprotobuf-c) since this now contains the
  required protobuf-c binary</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1708084800">- Update to new Major Version 9.18.24.
  This has many enhancements, bug fixes and changes.
  Breaking Changes:
  * Some options have been removed and some have been deprecated
    and will be removed in the future.
    For a complete list, see:
    https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918
  Major Changes:
  * Support for securing DNS traffic using Transport Layer Security
    (TLS). TLS is used by both DNS-over-TLS (DoT) and
    DNS-over-HTTPS (DoH).
  * Support for zone transfers over TLS (XFR-over-TLS, XoT) for
    both incoming and outgoing zone transfers.
  * The dig tool is now able to send DoT queries (+tls option).
  * Support for OpenSSL 3.0 APIs was added.
  * dnssec-checkds, dnssec-coverage, dnssec-keymgr, which have been
    removed in favor of the dnssec-policy feature
  * python3-bind is deprecated and the subpackage has been removed
  * A number of utilities have been moved from /usr/sbin to
    /usr/bin:
    named-checkconf named-checkzone named-compilezone
    dnssec-dsfromkey dnssec-importkey dnssec-keyfromlabel
    dnssec-keygen dnssec-revoke dnssec-settime dnssec-signzone
    dnssec-verify dnssec-cds named-journalprint nsec3hash
  * The lib directory was renamed from 'named' to 'bind'
  For a complete list of changes, see:
  * Bind Release Notes
    https://bind9.readthedocs.io/en/v9.18.24/notes.html
  * The CHANGES file in the source RPM
  Security Fixes:
  * Validating DNS messages containing a lot of DNSSEC signatures
    could cause excessive CPU load, leading to a denial-of-service
    condition. This has been fixed. (CVE-2023-50387)
    [bsc#1219823]
  * Preparing an NSEC3 closest encloser proof could cause excessive
    CPU load, leading to a denial-of-service condition. This has
    been fixed. (CVE-2023-50868)
    [bsc#1219826]
  * Parsing DNS messages with many different names could cause
    excessive CPU load. This has been fixed. (CVE-2023-4408)
    [bsc#1219851]
  * Specific queries could cause named to crash with an assertion
    failure when nxdomain-redirect was enabled. This has been
    fixed. (CVE-2023-5517)
    [bsc#1219852]
  * A bad interaction between DNS64 and serve-stale could cause
    named to crash with an assertion failure, when both of these
    features were enabled. This has been fixed. (CVE-2023-5679)
    [bsc#1219853]
  * Query patterns that continuously triggered cache database
    maintenance could cause an excessive amount of memory to be
    allocated, exceeding max-cache-size and potentially leading to
    all available memory on the host running named being exhausted.
    This has been fixed. (CVE-2023-6516)
    [bsc#1219854]
  Packaging notes:
  * libnghttps2 added as BuildRequires for tls support
  * named-bootconf.diff patch is obsolete and has been removed
  [jsc#PED-7932]
- Update KillMode to 'control-group' in named.service to handle
  forked processes better.
  [bsc#1215755]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1721908800">- Update to release 9.18.28
  Bug Fixes:
  * Command-line options for IPv4-only (named -4) and IPv6-only
    (named -6) modes are now respected for zone primaries,
    also-notify, and parental-agents.
  * An RPZ response’s SOA record TTL was set to 1 instead of the
    SOA TTL, if add-soa was used. This has been fixed.
  * When a query related to zone maintenance (NOTIFY, SOA) timed
    out close to a view shutdown (triggered e.g. by rndc reload),
    named could crash with an assertion failure. This has been
    fixed.
  * The statistics channel counters that indicated the number of
    currently connected TCP IPv4/IPv6 clients were not properly
    adjusted in certain failure scenarios. This has been fixed.
  * Some servers that could not be reached due to EHOSTDOWN or
    ENETDOWN conditions were incorrectly prioritized during server
    selection. These are now properly handled as unreachable.
  * On some systems the libuv call may return an error code when
    sending a TCP reset for a connection, which triggers an
    assertion failure in named. This error condition is now dealt
    with in a more graceful manner, by logging the incident and
    shutting down the connection.
  * Changes to listen-on statements were ignored on reconfiguration
    unless the port or interface address was changed, making it
    impossible to change a related listener transport type. That
    issue has been fixed.
  * A bug in the keymgr code unintentionally slowed down some
    DNSSEC key rollovers. This has been fixed.
  * Some ISO 8601 durations were accepted erroneously, leading to
    shorter durations than expected. This has been fixed
  * A regression in cache-cleaning code enabled memory use to grow
    significantly more quickly than before, until the configured
    max-cache-size limit was reached. This has been fixed.
  * Using rndc flush inadvertently caused cache cleaning to become
    less effective. This could ultimately lead to the configured
    max-cache-size limit being exceeded and has now been fixed.
  * The logic for cleaning up expired cached DNS records was
    tweaked to be more aggressive. This change helps with enforcing
    max-cache-ttl and max-ncache-ttl in a timely manner.
  * It was possible to trigger a use-after-free assertion when the
    overmem cache cleaning was initiated. This has been fixed.
  New Features:
  * A new option signatures-jitter has been added to dnssec-policy
    to allow signature expirations to be spread out over a period
    of time.
  * The statistics channel now includes counters that indicate the
    number of currently connected TCP IPv4/IPv6 clients.
  * Added RESOLVER.ARPA to the built in empty zones.
  Feature Changes:
  * DNSSEC signatures that are not valid because the current time
    falls outside the signature inception and expiration dates are
    skipped instead of causing an immediate validation failure.
  Security Fixes:
  * A malicious DNS client that sent many queries over TCP but
    never read the responses could cause a server to respond slowly
    or not at all for other clients. This has been fixed.
    (CVE-2024-0760)
    [bsc#1228255]
  * It is possible to craft excessively large resource records
    sets, which have the effect of slowing down database
    processing. This has been addressed by adding a configurable
    limit to the number of records that can be stored per name and
    type in a cache or zone database. The default is 100, which can
    be tuned with the new max-records-per-type option.
  * It is possible to craft excessively large numbers of resource
    record types for a given owner name, which has the effect of
    slowing down database processing. This has been addressed by
    adding a configurable limit to the number of records that can
    be stored per name and type in a cache or zone database. The
    default is 100, which can be tuned with the new
    max-types-per-name option. (CVE-2024-1737)
    [bsc#1228256]
  * Validating DNS messages signed using the SIG(0) protocol (RFC
    2931) could cause excessive CPU load, leading to a
    denial-of-service condition. Support for SIG(0) message
    validation was removed from this version of named.
    (CVE-2024-1975)
    [bsc#1228257]
  * Due to a logic error, lookups that triggered serving stale data
    and required lookups in local authoritative zone data could
    have resulted in an assertion failure. This has been fixed.
  * Potential data races were found in our DoH implementation,
    related to HTTP/2 session object management and endpoints set
    object management after reconfiguration. These issues have been
    fixed.
  * When looking up the NS records of parent zones as part of
    looking up DS records, it was possible for named to trigger an
    assertion failure if serve-stale was enabled. This has been
    fixed. (CVE-2024-4076)
    [bsc#1228258]</changelog>
</package>
<package pkgid="b88dda90f02191af188963ac2a9ddd9bfc4d706519104e67bd09e0c10f871d61" name="bind" arch="x86_64">
  <version epoch="0" ver="9.18.28" rel="150600.3.3.1"/>
  <changelog author="josef.moellers@suse.com" date="1657800000">- Update to release 9.16.31
  This is the first of monthly updates of "bind". It is planned
  to update bind when a new upstream maintennace release becomes
  available, which is usually towards the end of a month, see
  https://www.isc.org/blogs/2021-bind-release-model/
  Compared to the previous SUSE release, in this release,
  53 (minor) bugs were fixed
  13 (minor) functional enhancements were made
  3 security issues are now fixed upstream:
    CVE-2022-0396, CVE-2021-25220, CVE-2021-25219
  plus a few minor changes.
  For a full list of changes, please refer to the
  CHANGES file in the source rpm.
  This update obsoletes the following patches:
  * bind-fix-build-with-older-sphinx.patch
  * bind-CVE-2021-25219.patch
  * bind-9.16.27-0001-CVE-2021-25220.patch
  * bind-9.16.27-0002-CVE-2022-0396.patch
  [bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind-9.16.20.tar.xz, bind-9.16.20.tar.xz.sha512.asc,
  bind-fix-build-with-older-sphinx.patch, bind-CVE-2021-25219.patch,
  bind-9.16.27-0001-CVE-2021-25220.patch,
  bind-9.16.27-0002-CVE-2022-0396.patch,
  jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1661256000">- Update to release 9.16.32
  Feature Changes:
  * The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
  disabled on systems where they are disallowed by the security policy
  (e.g. Red Hat Enterprise Linux 9). Primary zones using those algorithms
  need to be migrated to new algorithms prior to running on these systems,
  as graceful migration to different DNSSEC algorithms is not possible when
  RSASHA1 is disallowed by the operating system.
  * Log messages related to fetch limiting have been improved to provide
  more complete information. Specifically, the final counts of allowed
  and spilled fetches are now logged before the counter object is destroyed.
  Bug Fixes:
  * Non-dynamic zones that inherit dnssec-policy from the view or options
  blocks were not marked as inline-signed and therefore never scheduled
  to be re-signed. This has been fixed.
  * The old max-zone-ttl zone option was meant to be superseded by
  the max-zone-ttl option in dnssec-policy; however, the latter option
  was not fully effective. This has been corrected: zones no longer load
  if they contain TTLs greater than the limit configured in dnssec-policy.
  For zones with both the old max-zone-ttl option and dnssec-policy
  configured, the old option is ignored, and a warning is generated.
  * rndc dumpdb -expired was fixed to include expired RRsets,
  even if stale-cache-enable is set to no and
  the cache-cleaning time window has passed.
  [bind-9.16.32.tar.xz, bind-9.16.32.tar.xz.sha512.asc,
  bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind.spec, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724800">- Include a modified createNamedConfInclude script again, as this
  broke compatability with existing configurations.
  A symlink for named.conf.include to /var/lib/named is created to
  allow for a read-only /etc directory.
  However it is still advised to change the existing configuration.
  See README-bind.chrootenv for a guide how to do this.
  [bsc#1203250, vendor-files/tools/createNamedConfInclude,
  vendor-files/docu/README-bind.chrootenv, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724801">- Add systemd drop-in directory for named service
  [bsc#1201689, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1663761600">- Update to release 9.16.33
  Security Fixes:
  * Previously, there was no limit to the number of database lookups
    performed while processing large delegations, which could be
    abused to severely impact the performance of named running as a
    recursive resolver. This has been fixed. (CVE-2022-2795)
  * named running as a resolver with the stale-answer-client-timeout
    option set to 0 could crash with an assertion failure, when
    there was a stale CNAME in the cache for the incoming query.
    This has been fixed. (CVE-2022-3080)
  * A memory leak was fixed that could be externally triggered in the
    DNSSEC verification code for the ECDSA algorithm. (CVE-2022-38177)
  * Memory leaks were fixed that could be externally triggered in the
    DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178)
  Feature Changes:
  * Response Rate Limiting (RRL) code now treats all QNAMEs that are
    subject to wildcard processing within a given zone as the same
    name, to prevent circumventing the limits enforced by RRL.
  * Zones using dnssec-policy now require dynamic DNS or
    inline-signing to be configured explicitly.
  * A backward-compatible approach was implemented for encoding
    internationalized domain names (IDN) in dig and converting the
    domain to IDNA2008 form; if that fails,
    BIND tries an IDNA2003 conversion.
  Bug Fixes:
  * A serve-stale bug was fixed, where BIND would try to return stale
    data from cache for lookups that received duplicate queries or
    queries that would be dropped. This bug resulted in premature
    SERVFAIL responses, and has now been resolved.
  [bsc#1203614, bsc#1203618, bsc#1203619, bsc#1203620, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1668168000">- Update to release 9.16.34
  New Features:
  * Support for parsing and validating the dohpath service
    parameter in SVCB records was added.
  * named now logs the supported cryptographic algorithms during
    startup and in the output of named -V.
  Bug Fixes:
  * Changing just the TSIG key names for primaries in catalog
    zones’ member zones was not effective. This has been fixed.
  Known Issues:
  * Upgrading from BIND 9.16.32 or any older version may require a
    manual configuration change. The following configurations are
    affected:
  - type primary zones configured with dnssec-policy but without
    either allow-update or update-policy,
  - type secondary zones configured with dnssec-policy.
    In these cases please add inline-signing yes; to the individual
    zone configuration(s). Without applying this change, named will
    fail to start. For more details, see
    https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1669291200">- Update to release 9.16.35
  Bug Fixes:
  * A crash was fixed that happened when a dnssec-policy zone that
    used NSEC3 was reconfigured to enable inline-signing.
  * In certain resolution scenarios, quotas could be erroneously
    reached for servers, including any configured forwarders,
    resulting in SERVFAIL answers being sent to clients.
  * rpz-ip rules in response-policy zones could be ineffective in
    some cases if a query had the CD (Checking Disabled) bit set to
    1.
  * Previously, if Internet connectivity issues were experienced
    during the initial startup of named, a BIND resolver with
    dnssec-validation set to auto could enter into a state where it
    would not recover without stopping named, manually deleting the
    managed-keys.bind and managed-keys.bind.jnl files, and starting
    named again.
  * The statistics counter representing the current number of
    clients awaiting recursive resolution results (RecursClients)
    could overflow in certain resolution scenarios.
  * Previously, BIND failed to start on Solaris-based systems with
    hundreds of CPUs.
  * When a DNS resource record’s TTL value was equal to the
    resolver’s configured prefetch “eligibility” value, the record
    was erroneously not treated as eligible for prefetching.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1671710400">- Update to release 9.16.36
  Feature Changes:
  * The auto-dnssec option has been deprecated and will be removed
    in a future BIND 9.19.x release. Please migrate to
    dnssec-policy.
  Bug Fixes:
  * When a catalog zone was removed from the configuration, in some
    cases a dangling pointer could cause the named process to
    crash.
  * When a zone was deleted from a server, a key management object
    related to that zone was inadvertently kept in memory and only
    released upon shutdown. This could lead to constantly
    increasing memory use on servers with a high rate of changes
    affecting the set of zones being served.
  * In certain cases, named waited for the resolution of
    outstanding recursive queries to finish before shutting down.
  * The zone &lt;name&gt;/&lt;class&gt;: final reference detached log message
    was moved from the INFO log level to the DEBUG(1) log level to
    prevent the named-checkzone tool from superfluously logging
    this message in non-debug mode.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1674561600">- Update to release 9.16.37
  Security Fixes:
  * An UPDATE message flood could cause named to exhaust all
    available memory. This flaw was addressed by adding a new
    update-quota option that controls the maximum number of
    outstanding DNS UPDATE messages that named can hold in a queue
    at any given time (default: 100). (CVE-2022-3094)
  * named could crash with an assertion failure when an RRSIG query
    was received and stale-answer-client-timeout was set to a
    non-zero value. This has been fixed. (CVE-2022-3736)
  * named running as a resolver with the
    stale-answer-client-timeout option set to any value greater
    than 0 could crash with an assertion failure, when the
    recursive-clients soft quota was reached. This has been fixed.
    (CVE-2022-3924)
  New Features:
  * The new update-quota option can be used to control the number
    of simultaneous DNS UPDATE messages that can be processed to
    update an authoritative zone on a primary server, or forwarded
    to the primary server by a secondary server. The default is
    100. A new statistics counter has also been added to record
    events when this quota is exceeded, and the version numbers for
    the XML and JSON statistics schemas have been updated.
  Feature Changes:
  * The Differentiated Services Code Point (DSCP) feature in BIND
    has been deprecated. Configuring DSCP values in named.conf now
    causes a warning to be logged. Note that this feature has only
    been partly operational since the new Network Manager was
    introduced in BIND 9.16.0.
  * The catalog zone implementation has been optimized to work with
    hundreds of thousands of member zones.
  Bug Fixes:
  * In certain query resolution scenarios (e.g. when following
    CNAME records), named configured to answer from stale cache
    could return a SERVFAIL response despite a usable, non-stale
    answer being present in the cache. This has been fixed.
  [bsc#1207471, bsc#1207473, bsc#1207475, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1676548800">- Update to release 9.16.38
  Bug Fixes:
  * A constant stream of zone additions and deletions via rndc
    reconfig could cause increased memory consumption due to
    delayed cleaning of view memory. This has been fixed.
  * The speed of the message digest algorithms (MD5, SHA-1, SHA-2),
    and of NSEC3 hashing, has been improved.
  * Building BIND 9 failed when the --enable-dnsrps switch for
    ./configure was used. This has been fixed.
  [jsc#SLE-24600]
- Updated keyring and signature</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1678881600">- Update to release 9.16.39
  Feature Changes:
  * libuv support for receiving multiple UDP messages in a single
    recvmmsg() system call has been tweaked several times between
    libuv versions 1.35.0 and 1.40.0; the current recommended libuv
    version is 1.40.0 or higher. New rules are now in effect for
    running with a different version of libuv than the one used at
    compilation time. These rules may trigger a fatal error at
    startup:
  - Building against or running with libuv versions 1.35.0 and
    1.36.0 is now a fatal error.
  - Running with libuv version higher than 1.34.2 is now a
    fatal error when named is built against libuv version
    1.34.2 or lower.
  - Running with libuv version higher than 1.39.0 is now a
    fatal error when named is built against libuv version
    1.37.0, 1.38.0, 1.38.1, or 1.39.0.
  * This prevents the use of libuv versions that may trigger an
    assertion failure when receiving multiple UDP messages in a
    single system call.
  Bug Fixes:
  * named could crash with an assertion failure when adding a new
    zone into the configuration file for a name which was already
    configured as a member zone for a catalog zone. This has been
    fixed.
  * When named starts up, it sends a query for the DNSSEC key for
    each configured trust anchor to determine whether the key has
    changed. In some unusual cases, the query might depend on a
    zone for which the server is itself authoritative, and would
    have failed if it were sent before the zone was fully loaded.
    This has now been fixed by delaying the key queries until all
    zones have finished loading.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1682424000">- Update to release 9.16.40
  Bug Fixes:
  * Logfiles using timestamp-style suffixes were not always
    correctly removed when the number of files exceeded the limit
    set by versions. This has been fixed for configurations which
    do not explicitly specify a directory path as part of the file
    argument in the channel specification.
  * Performance of DNSSEC validation in zones with many DNSKEY
    records has been improved.</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1684324800">- Update to release 9.16.41
  Bug Fixes:
  * When removing delegations from an opt-out range,
    empty-non-terminal NSEC3 records generated by those delegations
    were not cleaned up. This has been fixed.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1687348800">- Update to release 9.16.42
  Security Fixes:
  * The overmem cleaning process has been improved, to prevent the
    cache from significantly exceeding the configured
    max-cache-size limit. (CVE-2023-2828)
  * A query that prioritizes stale data over lookup triggers a
    fetch to refresh the stale data in cache. If the fetch is
    aborted for exceeding the recursion quota, it was possible for
    named to enter an infinite callback loop and crash due to stack
    overflow. This has been fixed. (CVE-2023-2911)
  Bug Fixes:
  * Previously, it was possible for a delegation from cache to be
    returned to the client after the stale-answer-client-timeout
    duration. This has been fixed.
  [bsc#1212544, bsc#1212567, jsc#SLE-24600]</changelog>
  <changelog author="dmueller@suse.com" date="1688644800">- rebuild bind-utils on libuv updates (bsc#1212090)</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1688990400">- Log named-checkconf output [bsc#1213049]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1689076800">- Add dnstap support
  [jsc#PED-4852]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1695124800">- Update to release 9.16.44
  Bug Fixes:
  * Processing already-queued queries received over TCP could cause
    an assertion failure, when the server was reconfigured at the
    same time or the cache was being flushed. This has been fixed.
  Security Fixes:
  * Previously, sending a specially crafted message over the
    control channel could cause the packet-parsing code to run out
    of available stack memory, causing named to terminate
    unexpectedly. This has been fixed. (CVE-2023-3341)
  [bsc#1215472]
- Switch to pkgconfig(libprotobuf-c) since this now contains the
  required protobuf-c binary</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1708084800">- Update to new Major Version 9.18.24.
  This has many enhancements, bug fixes and changes.
  Breaking Changes:
  * Some options have been removed and some have been deprecated
    and will be removed in the future.
    For a complete list, see:
    https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918
  Major Changes:
  * Support for securing DNS traffic using Transport Layer Security
    (TLS). TLS is used by both DNS-over-TLS (DoT) and
    DNS-over-HTTPS (DoH).
  * Support for zone transfers over TLS (XFR-over-TLS, XoT) for
    both incoming and outgoing zone transfers.
  * The dig tool is now able to send DoT queries (+tls option).
  * Support for OpenSSL 3.0 APIs was added.
  * dnssec-checkds, dnssec-coverage, dnssec-keymgr, which have been
    removed in favor of the dnssec-policy feature
  * python3-bind is deprecated and the subpackage has been removed
  * A number of utilities have been moved from /usr/sbin to
    /usr/bin:
    named-checkconf named-checkzone named-compilezone
    dnssec-dsfromkey dnssec-importkey dnssec-keyfromlabel
    dnssec-keygen dnssec-revoke dnssec-settime dnssec-signzone
    dnssec-verify dnssec-cds named-journalprint nsec3hash
  * The lib directory was renamed from 'named' to 'bind'
  For a complete list of changes, see:
  * Bind Release Notes
    https://bind9.readthedocs.io/en/v9.18.24/notes.html
  * The CHANGES file in the source RPM
  Security Fixes:
  * Validating DNS messages containing a lot of DNSSEC signatures
    could cause excessive CPU load, leading to a denial-of-service
    condition. This has been fixed. (CVE-2023-50387)
    [bsc#1219823]
  * Preparing an NSEC3 closest encloser proof could cause excessive
    CPU load, leading to a denial-of-service condition. This has
    been fixed. (CVE-2023-50868)
    [bsc#1219826]
  * Parsing DNS messages with many different names could cause
    excessive CPU load. This has been fixed. (CVE-2023-4408)
    [bsc#1219851]
  * Specific queries could cause named to crash with an assertion
    failure when nxdomain-redirect was enabled. This has been
    fixed. (CVE-2023-5517)
    [bsc#1219852]
  * A bad interaction between DNS64 and serve-stale could cause
    named to crash with an assertion failure, when both of these
    features were enabled. This has been fixed. (CVE-2023-5679)
    [bsc#1219853]
  * Query patterns that continuously triggered cache database
    maintenance could cause an excessive amount of memory to be
    allocated, exceeding max-cache-size and potentially leading to
    all available memory on the host running named being exhausted.
    This has been fixed. (CVE-2023-6516)
    [bsc#1219854]
  Packaging notes:
  * libnghttps2 added as BuildRequires for tls support
  * named-bootconf.diff patch is obsolete and has been removed
  [jsc#PED-7932]
- Update KillMode to 'control-group' in named.service to handle
  forked processes better.
  [bsc#1215755]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1721908800">- Update to release 9.18.28
  Bug Fixes:
  * Command-line options for IPv4-only (named -4) and IPv6-only
    (named -6) modes are now respected for zone primaries,
    also-notify, and parental-agents.
  * An RPZ response’s SOA record TTL was set to 1 instead of the
    SOA TTL, if add-soa was used. This has been fixed.
  * When a query related to zone maintenance (NOTIFY, SOA) timed
    out close to a view shutdown (triggered e.g. by rndc reload),
    named could crash with an assertion failure. This has been
    fixed.
  * The statistics channel counters that indicated the number of
    currently connected TCP IPv4/IPv6 clients were not properly
    adjusted in certain failure scenarios. This has been fixed.
  * Some servers that could not be reached due to EHOSTDOWN or
    ENETDOWN conditions were incorrectly prioritized during server
    selection. These are now properly handled as unreachable.
  * On some systems the libuv call may return an error code when
    sending a TCP reset for a connection, which triggers an
    assertion failure in named. This error condition is now dealt
    with in a more graceful manner, by logging the incident and
    shutting down the connection.
  * Changes to listen-on statements were ignored on reconfiguration
    unless the port or interface address was changed, making it
    impossible to change a related listener transport type. That
    issue has been fixed.
  * A bug in the keymgr code unintentionally slowed down some
    DNSSEC key rollovers. This has been fixed.
  * Some ISO 8601 durations were accepted erroneously, leading to
    shorter durations than expected. This has been fixed
  * A regression in cache-cleaning code enabled memory use to grow
    significantly more quickly than before, until the configured
    max-cache-size limit was reached. This has been fixed.
  * Using rndc flush inadvertently caused cache cleaning to become
    less effective. This could ultimately lead to the configured
    max-cache-size limit being exceeded and has now been fixed.
  * The logic for cleaning up expired cached DNS records was
    tweaked to be more aggressive. This change helps with enforcing
    max-cache-ttl and max-ncache-ttl in a timely manner.
  * It was possible to trigger a use-after-free assertion when the
    overmem cache cleaning was initiated. This has been fixed.
  New Features:
  * A new option signatures-jitter has been added to dnssec-policy
    to allow signature expirations to be spread out over a period
    of time.
  * The statistics channel now includes counters that indicate the
    number of currently connected TCP IPv4/IPv6 clients.
  * Added RESOLVER.ARPA to the built in empty zones.
  Feature Changes:
  * DNSSEC signatures that are not valid because the current time
    falls outside the signature inception and expiration dates are
    skipped instead of causing an immediate validation failure.
  Security Fixes:
  * A malicious DNS client that sent many queries over TCP but
    never read the responses could cause a server to respond slowly
    or not at all for other clients. This has been fixed.
    (CVE-2024-0760)
    [bsc#1228255]
  * It is possible to craft excessively large resource records
    sets, which have the effect of slowing down database
    processing. This has been addressed by adding a configurable
    limit to the number of records that can be stored per name and
    type in a cache or zone database. The default is 100, which can
    be tuned with the new max-records-per-type option.
  * It is possible to craft excessively large numbers of resource
    record types for a given owner name, which has the effect of
    slowing down database processing. This has been addressed by
    adding a configurable limit to the number of records that can
    be stored per name and type in a cache or zone database. The
    default is 100, which can be tuned with the new
    max-types-per-name option. (CVE-2024-1737)
    [bsc#1228256]
  * Validating DNS messages signed using the SIG(0) protocol (RFC
    2931) could cause excessive CPU load, leading to a
    denial-of-service condition. Support for SIG(0) message
    validation was removed from this version of named.
    (CVE-2024-1975)
    [bsc#1228257]
  * Due to a logic error, lookups that triggered serving stale data
    and required lookups in local authoritative zone data could
    have resulted in an assertion failure. This has been fixed.
  * Potential data races were found in our DoH implementation,
    related to HTTP/2 session object management and endpoints set
    object management after reconfiguration. These issues have been
    fixed.
  * When looking up the NS records of parent zones as part of
    looking up DS records, it was possible for named to trigger an
    assertion failure if serve-stale was enabled. This has been
    fixed. (CVE-2024-4076)
    [bsc#1228258]</changelog>
</package>
<package pkgid="c3a529a0bc2dd011a614b64092fa0b5b242ee3eeedf0f24dfab3582e0ba5e494" name="bind-doc" arch="noarch">
  <version epoch="0" ver="9.18.28" rel="150600.3.3.1"/>
  <changelog author="josef.moellers@suse.com" date="1657800000">- Update to release 9.16.31
  This is the first of monthly updates of "bind". It is planned
  to update bind when a new upstream maintennace release becomes
  available, which is usually towards the end of a month, see
  https://www.isc.org/blogs/2021-bind-release-model/
  Compared to the previous SUSE release, in this release,
  53 (minor) bugs were fixed
  13 (minor) functional enhancements were made
  3 security issues are now fixed upstream:
    CVE-2022-0396, CVE-2021-25220, CVE-2021-25219
  plus a few minor changes.
  For a full list of changes, please refer to the
  CHANGES file in the source rpm.
  This update obsoletes the following patches:
  * bind-fix-build-with-older-sphinx.patch
  * bind-CVE-2021-25219.patch
  * bind-9.16.27-0001-CVE-2021-25220.patch
  * bind-9.16.27-0002-CVE-2022-0396.patch
  [bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind-9.16.20.tar.xz, bind-9.16.20.tar.xz.sha512.asc,
  bind-fix-build-with-older-sphinx.patch, bind-CVE-2021-25219.patch,
  bind-9.16.27-0001-CVE-2021-25220.patch,
  bind-9.16.27-0002-CVE-2022-0396.patch,
  jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1661256000">- Update to release 9.16.32
  Feature Changes:
  * The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
  disabled on systems where they are disallowed by the security policy
  (e.g. Red Hat Enterprise Linux 9). Primary zones using those algorithms
  need to be migrated to new algorithms prior to running on these systems,
  as graceful migration to different DNSSEC algorithms is not possible when
  RSASHA1 is disallowed by the operating system.
  * Log messages related to fetch limiting have been improved to provide
  more complete information. Specifically, the final counts of allowed
  and spilled fetches are now logged before the counter object is destroyed.
  Bug Fixes:
  * Non-dynamic zones that inherit dnssec-policy from the view or options
  blocks were not marked as inline-signed and therefore never scheduled
  to be re-signed. This has been fixed.
  * The old max-zone-ttl zone option was meant to be superseded by
  the max-zone-ttl option in dnssec-policy; however, the latter option
  was not fully effective. This has been corrected: zones no longer load
  if they contain TTLs greater than the limit configured in dnssec-policy.
  For zones with both the old max-zone-ttl option and dnssec-policy
  configured, the old option is ignored, and a warning is generated.
  * rndc dumpdb -expired was fixed to include expired RRsets,
  even if stale-cache-enable is set to no and
  the cache-cleaning time window has passed.
  [bind-9.16.32.tar.xz, bind-9.16.32.tar.xz.sha512.asc,
  bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind.spec, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724800">- Include a modified createNamedConfInclude script again, as this
  broke compatability with existing configurations.
  A symlink for named.conf.include to /var/lib/named is created to
  allow for a read-only /etc directory.
  However it is still advised to change the existing configuration.
  See README-bind.chrootenv for a guide how to do this.
  [bsc#1203250, vendor-files/tools/createNamedConfInclude,
  vendor-files/docu/README-bind.chrootenv, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724801">- Add systemd drop-in directory for named service
  [bsc#1201689, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1663761600">- Update to release 9.16.33
  Security Fixes:
  * Previously, there was no limit to the number of database lookups
    performed while processing large delegations, which could be
    abused to severely impact the performance of named running as a
    recursive resolver. This has been fixed. (CVE-2022-2795)
  * named running as a resolver with the stale-answer-client-timeout
    option set to 0 could crash with an assertion failure, when
    there was a stale CNAME in the cache for the incoming query.
    This has been fixed. (CVE-2022-3080)
  * A memory leak was fixed that could be externally triggered in the
    DNSSEC verification code for the ECDSA algorithm. (CVE-2022-38177)
  * Memory leaks were fixed that could be externally triggered in the
    DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178)
  Feature Changes:
  * Response Rate Limiting (RRL) code now treats all QNAMEs that are
    subject to wildcard processing within a given zone as the same
    name, to prevent circumventing the limits enforced by RRL.
  * Zones using dnssec-policy now require dynamic DNS or
    inline-signing to be configured explicitly.
  * A backward-compatible approach was implemented for encoding
    internationalized domain names (IDN) in dig and converting the
    domain to IDNA2008 form; if that fails,
    BIND tries an IDNA2003 conversion.
  Bug Fixes:
  * A serve-stale bug was fixed, where BIND would try to return stale
    data from cache for lookups that received duplicate queries or
    queries that would be dropped. This bug resulted in premature
    SERVFAIL responses, and has now been resolved.
  [bsc#1203614, bsc#1203618, bsc#1203619, bsc#1203620, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1668168000">- Update to release 9.16.34
  New Features:
  * Support for parsing and validating the dohpath service
    parameter in SVCB records was added.
  * named now logs the supported cryptographic algorithms during
    startup and in the output of named -V.
  Bug Fixes:
  * Changing just the TSIG key names for primaries in catalog
    zones’ member zones was not effective. This has been fixed.
  Known Issues:
  * Upgrading from BIND 9.16.32 or any older version may require a
    manual configuration change. The following configurations are
    affected:
  - type primary zones configured with dnssec-policy but without
    either allow-update or update-policy,
  - type secondary zones configured with dnssec-policy.
    In these cases please add inline-signing yes; to the individual
    zone configuration(s). Without applying this change, named will
    fail to start. For more details, see
    https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1669291200">- Update to release 9.16.35
  Bug Fixes:
  * A crash was fixed that happened when a dnssec-policy zone that
    used NSEC3 was reconfigured to enable inline-signing.
  * In certain resolution scenarios, quotas could be erroneously
    reached for servers, including any configured forwarders,
    resulting in SERVFAIL answers being sent to clients.
  * rpz-ip rules in response-policy zones could be ineffective in
    some cases if a query had the CD (Checking Disabled) bit set to
    1.
  * Previously, if Internet connectivity issues were experienced
    during the initial startup of named, a BIND resolver with
    dnssec-validation set to auto could enter into a state where it
    would not recover without stopping named, manually deleting the
    managed-keys.bind and managed-keys.bind.jnl files, and starting
    named again.
  * The statistics counter representing the current number of
    clients awaiting recursive resolution results (RecursClients)
    could overflow in certain resolution scenarios.
  * Previously, BIND failed to start on Solaris-based systems with
    hundreds of CPUs.
  * When a DNS resource record’s TTL value was equal to the
    resolver’s configured prefetch “eligibility” value, the record
    was erroneously not treated as eligible for prefetching.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1671710400">- Update to release 9.16.36
  Feature Changes:
  * The auto-dnssec option has been deprecated and will be removed
    in a future BIND 9.19.x release. Please migrate to
    dnssec-policy.
  Bug Fixes:
  * When a catalog zone was removed from the configuration, in some
    cases a dangling pointer could cause the named process to
    crash.
  * When a zone was deleted from a server, a key management object
    related to that zone was inadvertently kept in memory and only
    released upon shutdown. This could lead to constantly
    increasing memory use on servers with a high rate of changes
    affecting the set of zones being served.
  * In certain cases, named waited for the resolution of
    outstanding recursive queries to finish before shutting down.
  * The zone &lt;name&gt;/&lt;class&gt;: final reference detached log message
    was moved from the INFO log level to the DEBUG(1) log level to
    prevent the named-checkzone tool from superfluously logging
    this message in non-debug mode.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1674561600">- Update to release 9.16.37
  Security Fixes:
  * An UPDATE message flood could cause named to exhaust all
    available memory. This flaw was addressed by adding a new
    update-quota option that controls the maximum number of
    outstanding DNS UPDATE messages that named can hold in a queue
    at any given time (default: 100). (CVE-2022-3094)
  * named could crash with an assertion failure when an RRSIG query
    was received and stale-answer-client-timeout was set to a
    non-zero value. This has been fixed. (CVE-2022-3736)
  * named running as a resolver with the
    stale-answer-client-timeout option set to any value greater
    than 0 could crash with an assertion failure, when the
    recursive-clients soft quota was reached. This has been fixed.
    (CVE-2022-3924)
  New Features:
  * The new update-quota option can be used to control the number
    of simultaneous DNS UPDATE messages that can be processed to
    update an authoritative zone on a primary server, or forwarded
    to the primary server by a secondary server. The default is
    100. A new statistics counter has also been added to record
    events when this quota is exceeded, and the version numbers for
    the XML and JSON statistics schemas have been updated.
  Feature Changes:
  * The Differentiated Services Code Point (DSCP) feature in BIND
    has been deprecated. Configuring DSCP values in named.conf now
    causes a warning to be logged. Note that this feature has only
    been partly operational since the new Network Manager was
    introduced in BIND 9.16.0.
  * The catalog zone implementation has been optimized to work with
    hundreds of thousands of member zones.
  Bug Fixes:
  * In certain query resolution scenarios (e.g. when following
    CNAME records), named configured to answer from stale cache
    could return a SERVFAIL response despite a usable, non-stale
    answer being present in the cache. This has been fixed.
  [bsc#1207471, bsc#1207473, bsc#1207475, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1676548800">- Update to release 9.16.38
  Bug Fixes:
  * A constant stream of zone additions and deletions via rndc
    reconfig could cause increased memory consumption due to
    delayed cleaning of view memory. This has been fixed.
  * The speed of the message digest algorithms (MD5, SHA-1, SHA-2),
    and of NSEC3 hashing, has been improved.
  * Building BIND 9 failed when the --enable-dnsrps switch for
    ./configure was used. This has been fixed.
  [jsc#SLE-24600]
- Updated keyring and signature</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1678881600">- Update to release 9.16.39
  Feature Changes:
  * libuv support for receiving multiple UDP messages in a single
    recvmmsg() system call has been tweaked several times between
    libuv versions 1.35.0 and 1.40.0; the current recommended libuv
    version is 1.40.0 or higher. New rules are now in effect for
    running with a different version of libuv than the one used at
    compilation time. These rules may trigger a fatal error at
    startup:
  - Building against or running with libuv versions 1.35.0 and
    1.36.0 is now a fatal error.
  - Running with libuv version higher than 1.34.2 is now a
    fatal error when named is built against libuv version
    1.34.2 or lower.
  - Running with libuv version higher than 1.39.0 is now a
    fatal error when named is built against libuv version
    1.37.0, 1.38.0, 1.38.1, or 1.39.0.
  * This prevents the use of libuv versions that may trigger an
    assertion failure when receiving multiple UDP messages in a
    single system call.
  Bug Fixes:
  * named could crash with an assertion failure when adding a new
    zone into the configuration file for a name which was already
    configured as a member zone for a catalog zone. This has been
    fixed.
  * When named starts up, it sends a query for the DNSSEC key for
    each configured trust anchor to determine whether the key has
    changed. In some unusual cases, the query might depend on a
    zone for which the server is itself authoritative, and would
    have failed if it were sent before the zone was fully loaded.
    This has now been fixed by delaying the key queries until all
    zones have finished loading.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1682424000">- Update to release 9.16.40
  Bug Fixes:
  * Logfiles using timestamp-style suffixes were not always
    correctly removed when the number of files exceeded the limit
    set by versions. This has been fixed for configurations which
    do not explicitly specify a directory path as part of the file
    argument in the channel specification.
  * Performance of DNSSEC validation in zones with many DNSKEY
    records has been improved.</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1684324800">- Update to release 9.16.41
  Bug Fixes:
  * When removing delegations from an opt-out range,
    empty-non-terminal NSEC3 records generated by those delegations
    were not cleaned up. This has been fixed.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1687348800">- Update to release 9.16.42
  Security Fixes:
  * The overmem cleaning process has been improved, to prevent the
    cache from significantly exceeding the configured
    max-cache-size limit. (CVE-2023-2828)
  * A query that prioritizes stale data over lookup triggers a
    fetch to refresh the stale data in cache. If the fetch is
    aborted for exceeding the recursion quota, it was possible for
    named to enter an infinite callback loop and crash due to stack
    overflow. This has been fixed. (CVE-2023-2911)
  Bug Fixes:
  * Previously, it was possible for a delegation from cache to be
    returned to the client after the stale-answer-client-timeout
    duration. This has been fixed.
  [bsc#1212544, bsc#1212567, jsc#SLE-24600]</changelog>
  <changelog author="dmueller@suse.com" date="1688644800">- rebuild bind-utils on libuv updates (bsc#1212090)</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1688990400">- Log named-checkconf output [bsc#1213049]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1689076800">- Add dnstap support
  [jsc#PED-4852]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1695124800">- Update to release 9.16.44
  Bug Fixes:
  * Processing already-queued queries received over TCP could cause
    an assertion failure, when the server was reconfigured at the
    same time or the cache was being flushed. This has been fixed.
  Security Fixes:
  * Previously, sending a specially crafted message over the
    control channel could cause the packet-parsing code to run out
    of available stack memory, causing named to terminate
    unexpectedly. This has been fixed. (CVE-2023-3341)
  [bsc#1215472]
- Switch to pkgconfig(libprotobuf-c) since this now contains the
  required protobuf-c binary</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1708084800">- Update to new Major Version 9.18.24.
  This has many enhancements, bug fixes and changes.
  Breaking Changes:
  * Some options have been removed and some have been deprecated
    and will be removed in the future.
    For a complete list, see:
    https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918
  Major Changes:
  * Support for securing DNS traffic using Transport Layer Security
    (TLS). TLS is used by both DNS-over-TLS (DoT) and
    DNS-over-HTTPS (DoH).
  * Support for zone transfers over TLS (XFR-over-TLS, XoT) for
    both incoming and outgoing zone transfers.
  * The dig tool is now able to send DoT queries (+tls option).
  * Support for OpenSSL 3.0 APIs was added.
  * dnssec-checkds, dnssec-coverage, dnssec-keymgr, which have been
    removed in favor of the dnssec-policy feature
  * python3-bind is deprecated and the subpackage has been removed
  * A number of utilities have been moved from /usr/sbin to
    /usr/bin:
    named-checkconf named-checkzone named-compilezone
    dnssec-dsfromkey dnssec-importkey dnssec-keyfromlabel
    dnssec-keygen dnssec-revoke dnssec-settime dnssec-signzone
    dnssec-verify dnssec-cds named-journalprint nsec3hash
  * The lib directory was renamed from 'named' to 'bind'
  For a complete list of changes, see:
  * Bind Release Notes
    https://bind9.readthedocs.io/en/v9.18.24/notes.html
  * The CHANGES file in the source RPM
  Security Fixes:
  * Validating DNS messages containing a lot of DNSSEC signatures
    could cause excessive CPU load, leading to a denial-of-service
    condition. This has been fixed. (CVE-2023-50387)
    [bsc#1219823]
  * Preparing an NSEC3 closest encloser proof could cause excessive
    CPU load, leading to a denial-of-service condition. This has
    been fixed. (CVE-2023-50868)
    [bsc#1219826]
  * Parsing DNS messages with many different names could cause
    excessive CPU load. This has been fixed. (CVE-2023-4408)
    [bsc#1219851]
  * Specific queries could cause named to crash with an assertion
    failure when nxdomain-redirect was enabled. This has been
    fixed. (CVE-2023-5517)
    [bsc#1219852]
  * A bad interaction between DNS64 and serve-stale could cause
    named to crash with an assertion failure, when both of these
    features were enabled. This has been fixed. (CVE-2023-5679)
    [bsc#1219853]
  * Query patterns that continuously triggered cache database
    maintenance could cause an excessive amount of memory to be
    allocated, exceeding max-cache-size and potentially leading to
    all available memory on the host running named being exhausted.
    This has been fixed. (CVE-2023-6516)
    [bsc#1219854]
  Packaging notes:
  * libnghttps2 added as BuildRequires for tls support
  * named-bootconf.diff patch is obsolete and has been removed
  [jsc#PED-7932]
- Update KillMode to 'control-group' in named.service to handle
  forked processes better.
  [bsc#1215755]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1721908800">- Update to release 9.18.28
  Bug Fixes:
  * Command-line options for IPv4-only (named -4) and IPv6-only
    (named -6) modes are now respected for zone primaries,
    also-notify, and parental-agents.
  * An RPZ response’s SOA record TTL was set to 1 instead of the
    SOA TTL, if add-soa was used. This has been fixed.
  * When a query related to zone maintenance (NOTIFY, SOA) timed
    out close to a view shutdown (triggered e.g. by rndc reload),
    named could crash with an assertion failure. This has been
    fixed.
  * The statistics channel counters that indicated the number of
    currently connected TCP IPv4/IPv6 clients were not properly
    adjusted in certain failure scenarios. This has been fixed.
  * Some servers that could not be reached due to EHOSTDOWN or
    ENETDOWN conditions were incorrectly prioritized during server
    selection. These are now properly handled as unreachable.
  * On some systems the libuv call may return an error code when
    sending a TCP reset for a connection, which triggers an
    assertion failure in named. This error condition is now dealt
    with in a more graceful manner, by logging the incident and
    shutting down the connection.
  * Changes to listen-on statements were ignored on reconfiguration
    unless the port or interface address was changed, making it
    impossible to change a related listener transport type. That
    issue has been fixed.
  * A bug in the keymgr code unintentionally slowed down some
    DNSSEC key rollovers. This has been fixed.
  * Some ISO 8601 durations were accepted erroneously, leading to
    shorter durations than expected. This has been fixed
  * A regression in cache-cleaning code enabled memory use to grow
    significantly more quickly than before, until the configured
    max-cache-size limit was reached. This has been fixed.
  * Using rndc flush inadvertently caused cache cleaning to become
    less effective. This could ultimately lead to the configured
    max-cache-size limit being exceeded and has now been fixed.
  * The logic for cleaning up expired cached DNS records was
    tweaked to be more aggressive. This change helps with enforcing
    max-cache-ttl and max-ncache-ttl in a timely manner.
  * It was possible to trigger a use-after-free assertion when the
    overmem cache cleaning was initiated. This has been fixed.
  New Features:
  * A new option signatures-jitter has been added to dnssec-policy
    to allow signature expirations to be spread out over a period
    of time.
  * The statistics channel now includes counters that indicate the
    number of currently connected TCP IPv4/IPv6 clients.
  * Added RESOLVER.ARPA to the built in empty zones.
  Feature Changes:
  * DNSSEC signatures that are not valid because the current time
    falls outside the signature inception and expiration dates are
    skipped instead of causing an immediate validation failure.
  Security Fixes:
  * A malicious DNS client that sent many queries over TCP but
    never read the responses could cause a server to respond slowly
    or not at all for other clients. This has been fixed.
    (CVE-2024-0760)
    [bsc#1228255]
  * It is possible to craft excessively large resource records
    sets, which have the effect of slowing down database
    processing. This has been addressed by adding a configurable
    limit to the number of records that can be stored per name and
    type in a cache or zone database. The default is 100, which can
    be tuned with the new max-records-per-type option.
  * It is possible to craft excessively large numbers of resource
    record types for a given owner name, which has the effect of
    slowing down database processing. This has been addressed by
    adding a configurable limit to the number of records that can
    be stored per name and type in a cache or zone database. The
    default is 100, which can be tuned with the new
    max-types-per-name option. (CVE-2024-1737)
    [bsc#1228256]
  * Validating DNS messages signed using the SIG(0) protocol (RFC
    2931) could cause excessive CPU load, leading to a
    denial-of-service condition. Support for SIG(0) message
    validation was removed from this version of named.
    (CVE-2024-1975)
    [bsc#1228257]
  * Due to a logic error, lookups that triggered serving stale data
    and required lookups in local authoritative zone data could
    have resulted in an assertion failure. This has been fixed.
  * Potential data races were found in our DoH implementation,
    related to HTTP/2 session object management and endpoints set
    object management after reconfiguration. These issues have been
    fixed.
  * When looking up the NS records of parent zones as part of
    looking up DS records, it was possible for named to trigger an
    assertion failure if serve-stale was enabled. This has been
    fixed. (CVE-2024-4076)
    [bsc#1228258]</changelog>
</package>
<package pkgid="827a3100d9b924ce63065cecf0b3a5f171956b74a40b2dee323e912d7ed48ed8" name="bind-utils" arch="aarch64">
  <version epoch="0" ver="9.18.28" rel="150600.3.3.1"/>
  <changelog author="josef.moellers@suse.com" date="1657800000">- Update to release 9.16.31
  This is the first of monthly updates of "bind". It is planned
  to update bind when a new upstream maintennace release becomes
  available, which is usually towards the end of a month, see
  https://www.isc.org/blogs/2021-bind-release-model/
  Compared to the previous SUSE release, in this release,
  53 (minor) bugs were fixed
  13 (minor) functional enhancements were made
  3 security issues are now fixed upstream:
    CVE-2022-0396, CVE-2021-25220, CVE-2021-25219
  plus a few minor changes.
  For a full list of changes, please refer to the
  CHANGES file in the source rpm.
  This update obsoletes the following patches:
  * bind-fix-build-with-older-sphinx.patch
  * bind-CVE-2021-25219.patch
  * bind-9.16.27-0001-CVE-2021-25220.patch
  * bind-9.16.27-0002-CVE-2022-0396.patch
  [bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind-9.16.20.tar.xz, bind-9.16.20.tar.xz.sha512.asc,
  bind-fix-build-with-older-sphinx.patch, bind-CVE-2021-25219.patch,
  bind-9.16.27-0001-CVE-2021-25220.patch,
  bind-9.16.27-0002-CVE-2022-0396.patch,
  jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1661256000">- Update to release 9.16.32
  Feature Changes:
  * The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
  disabled on systems where they are disallowed by the security policy
  (e.g. Red Hat Enterprise Linux 9). Primary zones using those algorithms
  need to be migrated to new algorithms prior to running on these systems,
  as graceful migration to different DNSSEC algorithms is not possible when
  RSASHA1 is disallowed by the operating system.
  * Log messages related to fetch limiting have been improved to provide
  more complete information. Specifically, the final counts of allowed
  and spilled fetches are now logged before the counter object is destroyed.
  Bug Fixes:
  * Non-dynamic zones that inherit dnssec-policy from the view or options
  blocks were not marked as inline-signed and therefore never scheduled
  to be re-signed. This has been fixed.
  * The old max-zone-ttl zone option was meant to be superseded by
  the max-zone-ttl option in dnssec-policy; however, the latter option
  was not fully effective. This has been corrected: zones no longer load
  if they contain TTLs greater than the limit configured in dnssec-policy.
  For zones with both the old max-zone-ttl option and dnssec-policy
  configured, the old option is ignored, and a warning is generated.
  * rndc dumpdb -expired was fixed to include expired RRsets,
  even if stale-cache-enable is set to no and
  the cache-cleaning time window has passed.
  [bind-9.16.32.tar.xz, bind-9.16.32.tar.xz.sha512.asc,
  bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind.spec, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724800">- Include a modified createNamedConfInclude script again, as this
  broke compatability with existing configurations.
  A symlink for named.conf.include to /var/lib/named is created to
  allow for a read-only /etc directory.
  However it is still advised to change the existing configuration.
  See README-bind.chrootenv for a guide how to do this.
  [bsc#1203250, vendor-files/tools/createNamedConfInclude,
  vendor-files/docu/README-bind.chrootenv, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724801">- Add systemd drop-in directory for named service
  [bsc#1201689, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1663761600">- Update to release 9.16.33
  Security Fixes:
  * Previously, there was no limit to the number of database lookups
    performed while processing large delegations, which could be
    abused to severely impact the performance of named running as a
    recursive resolver. This has been fixed. (CVE-2022-2795)
  * named running as a resolver with the stale-answer-client-timeout
    option set to 0 could crash with an assertion failure, when
    there was a stale CNAME in the cache for the incoming query.
    This has been fixed. (CVE-2022-3080)
  * A memory leak was fixed that could be externally triggered in the
    DNSSEC verification code for the ECDSA algorithm. (CVE-2022-38177)
  * Memory leaks were fixed that could be externally triggered in the
    DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178)
  Feature Changes:
  * Response Rate Limiting (RRL) code now treats all QNAMEs that are
    subject to wildcard processing within a given zone as the same
    name, to prevent circumventing the limits enforced by RRL.
  * Zones using dnssec-policy now require dynamic DNS or
    inline-signing to be configured explicitly.
  * A backward-compatible approach was implemented for encoding
    internationalized domain names (IDN) in dig and converting the
    domain to IDNA2008 form; if that fails,
    BIND tries an IDNA2003 conversion.
  Bug Fixes:
  * A serve-stale bug was fixed, where BIND would try to return stale
    data from cache for lookups that received duplicate queries or
    queries that would be dropped. This bug resulted in premature
    SERVFAIL responses, and has now been resolved.
  [bsc#1203614, bsc#1203618, bsc#1203619, bsc#1203620, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1668168000">- Update to release 9.16.34
  New Features:
  * Support for parsing and validating the dohpath service
    parameter in SVCB records was added.
  * named now logs the supported cryptographic algorithms during
    startup and in the output of named -V.
  Bug Fixes:
  * Changing just the TSIG key names for primaries in catalog
    zones’ member zones was not effective. This has been fixed.
  Known Issues:
  * Upgrading from BIND 9.16.32 or any older version may require a
    manual configuration change. The following configurations are
    affected:
  - type primary zones configured with dnssec-policy but without
    either allow-update or update-policy,
  - type secondary zones configured with dnssec-policy.
    In these cases please add inline-signing yes; to the individual
    zone configuration(s). Without applying this change, named will
    fail to start. For more details, see
    https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1669291200">- Update to release 9.16.35
  Bug Fixes:
  * A crash was fixed that happened when a dnssec-policy zone that
    used NSEC3 was reconfigured to enable inline-signing.
  * In certain resolution scenarios, quotas could be erroneously
    reached for servers, including any configured forwarders,
    resulting in SERVFAIL answers being sent to clients.
  * rpz-ip rules in response-policy zones could be ineffective in
    some cases if a query had the CD (Checking Disabled) bit set to
    1.
  * Previously, if Internet connectivity issues were experienced
    during the initial startup of named, a BIND resolver with
    dnssec-validation set to auto could enter into a state where it
    would not recover without stopping named, manually deleting the
    managed-keys.bind and managed-keys.bind.jnl files, and starting
    named again.
  * The statistics counter representing the current number of
    clients awaiting recursive resolution results (RecursClients)
    could overflow in certain resolution scenarios.
  * Previously, BIND failed to start on Solaris-based systems with
    hundreds of CPUs.
  * When a DNS resource record’s TTL value was equal to the
    resolver’s configured prefetch “eligibility” value, the record
    was erroneously not treated as eligible for prefetching.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1671710400">- Update to release 9.16.36
  Feature Changes:
  * The auto-dnssec option has been deprecated and will be removed
    in a future BIND 9.19.x release. Please migrate to
    dnssec-policy.
  Bug Fixes:
  * When a catalog zone was removed from the configuration, in some
    cases a dangling pointer could cause the named process to
    crash.
  * When a zone was deleted from a server, a key management object
    related to that zone was inadvertently kept in memory and only
    released upon shutdown. This could lead to constantly
    increasing memory use on servers with a high rate of changes
    affecting the set of zones being served.
  * In certain cases, named waited for the resolution of
    outstanding recursive queries to finish before shutting down.
  * The zone &lt;name&gt;/&lt;class&gt;: final reference detached log message
    was moved from the INFO log level to the DEBUG(1) log level to
    prevent the named-checkzone tool from superfluously logging
    this message in non-debug mode.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1674561600">- Update to release 9.16.37
  Security Fixes:
  * An UPDATE message flood could cause named to exhaust all
    available memory. This flaw was addressed by adding a new
    update-quota option that controls the maximum number of
    outstanding DNS UPDATE messages that named can hold in a queue
    at any given time (default: 100). (CVE-2022-3094)
  * named could crash with an assertion failure when an RRSIG query
    was received and stale-answer-client-timeout was set to a
    non-zero value. This has been fixed. (CVE-2022-3736)
  * named running as a resolver with the
    stale-answer-client-timeout option set to any value greater
    than 0 could crash with an assertion failure, when the
    recursive-clients soft quota was reached. This has been fixed.
    (CVE-2022-3924)
  New Features:
  * The new update-quota option can be used to control the number
    of simultaneous DNS UPDATE messages that can be processed to
    update an authoritative zone on a primary server, or forwarded
    to the primary server by a secondary server. The default is
    100. A new statistics counter has also been added to record
    events when this quota is exceeded, and the version numbers for
    the XML and JSON statistics schemas have been updated.
  Feature Changes:
  * The Differentiated Services Code Point (DSCP) feature in BIND
    has been deprecated. Configuring DSCP values in named.conf now
    causes a warning to be logged. Note that this feature has only
    been partly operational since the new Network Manager was
    introduced in BIND 9.16.0.
  * The catalog zone implementation has been optimized to work with
    hundreds of thousands of member zones.
  Bug Fixes:
  * In certain query resolution scenarios (e.g. when following
    CNAME records), named configured to answer from stale cache
    could return a SERVFAIL response despite a usable, non-stale
    answer being present in the cache. This has been fixed.
  [bsc#1207471, bsc#1207473, bsc#1207475, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1676548800">- Update to release 9.16.38
  Bug Fixes:
  * A constant stream of zone additions and deletions via rndc
    reconfig could cause increased memory consumption due to
    delayed cleaning of view memory. This has been fixed.
  * The speed of the message digest algorithms (MD5, SHA-1, SHA-2),
    and of NSEC3 hashing, has been improved.
  * Building BIND 9 failed when the --enable-dnsrps switch for
    ./configure was used. This has been fixed.
  [jsc#SLE-24600]
- Updated keyring and signature</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1678881600">- Update to release 9.16.39
  Feature Changes:
  * libuv support for receiving multiple UDP messages in a single
    recvmmsg() system call has been tweaked several times between
    libuv versions 1.35.0 and 1.40.0; the current recommended libuv
    version is 1.40.0 or higher. New rules are now in effect for
    running with a different version of libuv than the one used at
    compilation time. These rules may trigger a fatal error at
    startup:
  - Building against or running with libuv versions 1.35.0 and
    1.36.0 is now a fatal error.
  - Running with libuv version higher than 1.34.2 is now a
    fatal error when named is built against libuv version
    1.34.2 or lower.
  - Running with libuv version higher than 1.39.0 is now a
    fatal error when named is built against libuv version
    1.37.0, 1.38.0, 1.38.1, or 1.39.0.
  * This prevents the use of libuv versions that may trigger an
    assertion failure when receiving multiple UDP messages in a
    single system call.
  Bug Fixes:
  * named could crash with an assertion failure when adding a new
    zone into the configuration file for a name which was already
    configured as a member zone for a catalog zone. This has been
    fixed.
  * When named starts up, it sends a query for the DNSSEC key for
    each configured trust anchor to determine whether the key has
    changed. In some unusual cases, the query might depend on a
    zone for which the server is itself authoritative, and would
    have failed if it were sent before the zone was fully loaded.
    This has now been fixed by delaying the key queries until all
    zones have finished loading.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1682424000">- Update to release 9.16.40
  Bug Fixes:
  * Logfiles using timestamp-style suffixes were not always
    correctly removed when the number of files exceeded the limit
    set by versions. This has been fixed for configurations which
    do not explicitly specify a directory path as part of the file
    argument in the channel specification.
  * Performance of DNSSEC validation in zones with many DNSKEY
    records has been improved.</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1684324800">- Update to release 9.16.41
  Bug Fixes:
  * When removing delegations from an opt-out range,
    empty-non-terminal NSEC3 records generated by those delegations
    were not cleaned up. This has been fixed.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1687348800">- Update to release 9.16.42
  Security Fixes:
  * The overmem cleaning process has been improved, to prevent the
    cache from significantly exceeding the configured
    max-cache-size limit. (CVE-2023-2828)
  * A query that prioritizes stale data over lookup triggers a
    fetch to refresh the stale data in cache. If the fetch is
    aborted for exceeding the recursion quota, it was possible for
    named to enter an infinite callback loop and crash due to stack
    overflow. This has been fixed. (CVE-2023-2911)
  Bug Fixes:
  * Previously, it was possible for a delegation from cache to be
    returned to the client after the stale-answer-client-timeout
    duration. This has been fixed.
  [bsc#1212544, bsc#1212567, jsc#SLE-24600]</changelog>
  <changelog author="dmueller@suse.com" date="1688644800">- rebuild bind-utils on libuv updates (bsc#1212090)</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1688990400">- Log named-checkconf output [bsc#1213049]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1689076800">- Add dnstap support
  [jsc#PED-4852]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1695124800">- Update to release 9.16.44
  Bug Fixes:
  * Processing already-queued queries received over TCP could cause
    an assertion failure, when the server was reconfigured at the
    same time or the cache was being flushed. This has been fixed.
  Security Fixes:
  * Previously, sending a specially crafted message over the
    control channel could cause the packet-parsing code to run out
    of available stack memory, causing named to terminate
    unexpectedly. This has been fixed. (CVE-2023-3341)
  [bsc#1215472]
- Switch to pkgconfig(libprotobuf-c) since this now contains the
  required protobuf-c binary</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1708084800">- Update to new Major Version 9.18.24.
  This has many enhancements, bug fixes and changes.
  Breaking Changes:
  * Some options have been removed and some have been deprecated
    and will be removed in the future.
    For a complete list, see:
    https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918
  Major Changes:
  * Support for securing DNS traffic using Transport Layer Security
    (TLS). TLS is used by both DNS-over-TLS (DoT) and
    DNS-over-HTTPS (DoH).
  * Support for zone transfers over TLS (XFR-over-TLS, XoT) for
    both incoming and outgoing zone transfers.
  * The dig tool is now able to send DoT queries (+tls option).
  * Support for OpenSSL 3.0 APIs was added.
  * dnssec-checkds, dnssec-coverage, dnssec-keymgr, which have been
    removed in favor of the dnssec-policy feature
  * python3-bind is deprecated and the subpackage has been removed
  * A number of utilities have been moved from /usr/sbin to
    /usr/bin:
    named-checkconf named-checkzone named-compilezone
    dnssec-dsfromkey dnssec-importkey dnssec-keyfromlabel
    dnssec-keygen dnssec-revoke dnssec-settime dnssec-signzone
    dnssec-verify dnssec-cds named-journalprint nsec3hash
  * The lib directory was renamed from 'named' to 'bind'
  For a complete list of changes, see:
  * Bind Release Notes
    https://bind9.readthedocs.io/en/v9.18.24/notes.html
  * The CHANGES file in the source RPM
  Security Fixes:
  * Validating DNS messages containing a lot of DNSSEC signatures
    could cause excessive CPU load, leading to a denial-of-service
    condition. This has been fixed. (CVE-2023-50387)
    [bsc#1219823]
  * Preparing an NSEC3 closest encloser proof could cause excessive
    CPU load, leading to a denial-of-service condition. This has
    been fixed. (CVE-2023-50868)
    [bsc#1219826]
  * Parsing DNS messages with many different names could cause
    excessive CPU load. This has been fixed. (CVE-2023-4408)
    [bsc#1219851]
  * Specific queries could cause named to crash with an assertion
    failure when nxdomain-redirect was enabled. This has been
    fixed. (CVE-2023-5517)
    [bsc#1219852]
  * A bad interaction between DNS64 and serve-stale could cause
    named to crash with an assertion failure, when both of these
    features were enabled. This has been fixed. (CVE-2023-5679)
    [bsc#1219853]
  * Query patterns that continuously triggered cache database
    maintenance could cause an excessive amount of memory to be
    allocated, exceeding max-cache-size and potentially leading to
    all available memory on the host running named being exhausted.
    This has been fixed. (CVE-2023-6516)
    [bsc#1219854]
  Packaging notes:
  * libnghttps2 added as BuildRequires for tls support
  * named-bootconf.diff patch is obsolete and has been removed
  [jsc#PED-7932]
- Update KillMode to 'control-group' in named.service to handle
  forked processes better.
  [bsc#1215755]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1721908800">- Update to release 9.18.28
  Bug Fixes:
  * Command-line options for IPv4-only (named -4) and IPv6-only
    (named -6) modes are now respected for zone primaries,
    also-notify, and parental-agents.
  * An RPZ response’s SOA record TTL was set to 1 instead of the
    SOA TTL, if add-soa was used. This has been fixed.
  * When a query related to zone maintenance (NOTIFY, SOA) timed
    out close to a view shutdown (triggered e.g. by rndc reload),
    named could crash with an assertion failure. This has been
    fixed.
  * The statistics channel counters that indicated the number of
    currently connected TCP IPv4/IPv6 clients were not properly
    adjusted in certain failure scenarios. This has been fixed.
  * Some servers that could not be reached due to EHOSTDOWN or
    ENETDOWN conditions were incorrectly prioritized during server
    selection. These are now properly handled as unreachable.
  * On some systems the libuv call may return an error code when
    sending a TCP reset for a connection, which triggers an
    assertion failure in named. This error condition is now dealt
    with in a more graceful manner, by logging the incident and
    shutting down the connection.
  * Changes to listen-on statements were ignored on reconfiguration
    unless the port or interface address was changed, making it
    impossible to change a related listener transport type. That
    issue has been fixed.
  * A bug in the keymgr code unintentionally slowed down some
    DNSSEC key rollovers. This has been fixed.
  * Some ISO 8601 durations were accepted erroneously, leading to
    shorter durations than expected. This has been fixed
  * A regression in cache-cleaning code enabled memory use to grow
    significantly more quickly than before, until the configured
    max-cache-size limit was reached. This has been fixed.
  * Using rndc flush inadvertently caused cache cleaning to become
    less effective. This could ultimately lead to the configured
    max-cache-size limit being exceeded and has now been fixed.
  * The logic for cleaning up expired cached DNS records was
    tweaked to be more aggressive. This change helps with enforcing
    max-cache-ttl and max-ncache-ttl in a timely manner.
  * It was possible to trigger a use-after-free assertion when the
    overmem cache cleaning was initiated. This has been fixed.
  New Features:
  * A new option signatures-jitter has been added to dnssec-policy
    to allow signature expirations to be spread out over a period
    of time.
  * The statistics channel now includes counters that indicate the
    number of currently connected TCP IPv4/IPv6 clients.
  * Added RESOLVER.ARPA to the built in empty zones.
  Feature Changes:
  * DNSSEC signatures that are not valid because the current time
    falls outside the signature inception and expiration dates are
    skipped instead of causing an immediate validation failure.
  Security Fixes:
  * A malicious DNS client that sent many queries over TCP but
    never read the responses could cause a server to respond slowly
    or not at all for other clients. This has been fixed.
    (CVE-2024-0760)
    [bsc#1228255]
  * It is possible to craft excessively large resource records
    sets, which have the effect of slowing down database
    processing. This has been addressed by adding a configurable
    limit to the number of records that can be stored per name and
    type in a cache or zone database. The default is 100, which can
    be tuned with the new max-records-per-type option.
  * It is possible to craft excessively large numbers of resource
    record types for a given owner name, which has the effect of
    slowing down database processing. This has been addressed by
    adding a configurable limit to the number of records that can
    be stored per name and type in a cache or zone database. The
    default is 100, which can be tuned with the new
    max-types-per-name option. (CVE-2024-1737)
    [bsc#1228256]
  * Validating DNS messages signed using the SIG(0) protocol (RFC
    2931) could cause excessive CPU load, leading to a
    denial-of-service condition. Support for SIG(0) message
    validation was removed from this version of named.
    (CVE-2024-1975)
    [bsc#1228257]
  * Due to a logic error, lookups that triggered serving stale data
    and required lookups in local authoritative zone data could
    have resulted in an assertion failure. This has been fixed.
  * Potential data races were found in our DoH implementation,
    related to HTTP/2 session object management and endpoints set
    object management after reconfiguration. These issues have been
    fixed.
  * When looking up the NS records of parent zones as part of
    looking up DS records, it was possible for named to trigger an
    assertion failure if serve-stale was enabled. This has been
    fixed. (CVE-2024-4076)
    [bsc#1228258]</changelog>
</package>
<package pkgid="e60874fe527fbefa4c5bb8cd218b131b70ae7c1345f1c202bcd81d9950ce7187" name="bind-utils" arch="ppc64le">
  <version epoch="0" ver="9.18.28" rel="150600.3.3.1"/>
  <changelog author="josef.moellers@suse.com" date="1657800000">- Update to release 9.16.31
  This is the first of monthly updates of "bind". It is planned
  to update bind when a new upstream maintennace release becomes
  available, which is usually towards the end of a month, see
  https://www.isc.org/blogs/2021-bind-release-model/
  Compared to the previous SUSE release, in this release,
  53 (minor) bugs were fixed
  13 (minor) functional enhancements were made
  3 security issues are now fixed upstream:
    CVE-2022-0396, CVE-2021-25220, CVE-2021-25219
  plus a few minor changes.
  For a full list of changes, please refer to the
  CHANGES file in the source rpm.
  This update obsoletes the following patches:
  * bind-fix-build-with-older-sphinx.patch
  * bind-CVE-2021-25219.patch
  * bind-9.16.27-0001-CVE-2021-25220.patch
  * bind-9.16.27-0002-CVE-2022-0396.patch
  [bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind-9.16.20.tar.xz, bind-9.16.20.tar.xz.sha512.asc,
  bind-fix-build-with-older-sphinx.patch, bind-CVE-2021-25219.patch,
  bind-9.16.27-0001-CVE-2021-25220.patch,
  bind-9.16.27-0002-CVE-2022-0396.patch,
  jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1661256000">- Update to release 9.16.32
  Feature Changes:
  * The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
  disabled on systems where they are disallowed by the security policy
  (e.g. Red Hat Enterprise Linux 9). Primary zones using those algorithms
  need to be migrated to new algorithms prior to running on these systems,
  as graceful migration to different DNSSEC algorithms is not possible when
  RSASHA1 is disallowed by the operating system.
  * Log messages related to fetch limiting have been improved to provide
  more complete information. Specifically, the final counts of allowed
  and spilled fetches are now logged before the counter object is destroyed.
  Bug Fixes:
  * Non-dynamic zones that inherit dnssec-policy from the view or options
  blocks were not marked as inline-signed and therefore never scheduled
  to be re-signed. This has been fixed.
  * The old max-zone-ttl zone option was meant to be superseded by
  the max-zone-ttl option in dnssec-policy; however, the latter option
  was not fully effective. This has been corrected: zones no longer load
  if they contain TTLs greater than the limit configured in dnssec-policy.
  For zones with both the old max-zone-ttl option and dnssec-policy
  configured, the old option is ignored, and a warning is generated.
  * rndc dumpdb -expired was fixed to include expired RRsets,
  even if stale-cache-enable is set to no and
  the cache-cleaning time window has passed.
  [bind-9.16.32.tar.xz, bind-9.16.32.tar.xz.sha512.asc,
  bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind.spec, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724800">- Include a modified createNamedConfInclude script again, as this
  broke compatability with existing configurations.
  A symlink for named.conf.include to /var/lib/named is created to
  allow for a read-only /etc directory.
  However it is still advised to change the existing configuration.
  See README-bind.chrootenv for a guide how to do this.
  [bsc#1203250, vendor-files/tools/createNamedConfInclude,
  vendor-files/docu/README-bind.chrootenv, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724801">- Add systemd drop-in directory for named service
  [bsc#1201689, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1663761600">- Update to release 9.16.33
  Security Fixes:
  * Previously, there was no limit to the number of database lookups
    performed while processing large delegations, which could be
    abused to severely impact the performance of named running as a
    recursive resolver. This has been fixed. (CVE-2022-2795)
  * named running as a resolver with the stale-answer-client-timeout
    option set to 0 could crash with an assertion failure, when
    there was a stale CNAME in the cache for the incoming query.
    This has been fixed. (CVE-2022-3080)
  * A memory leak was fixed that could be externally triggered in the
    DNSSEC verification code for the ECDSA algorithm. (CVE-2022-38177)
  * Memory leaks were fixed that could be externally triggered in the
    DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178)
  Feature Changes:
  * Response Rate Limiting (RRL) code now treats all QNAMEs that are
    subject to wildcard processing within a given zone as the same
    name, to prevent circumventing the limits enforced by RRL.
  * Zones using dnssec-policy now require dynamic DNS or
    inline-signing to be configured explicitly.
  * A backward-compatible approach was implemented for encoding
    internationalized domain names (IDN) in dig and converting the
    domain to IDNA2008 form; if that fails,
    BIND tries an IDNA2003 conversion.
  Bug Fixes:
  * A serve-stale bug was fixed, where BIND would try to return stale
    data from cache for lookups that received duplicate queries or
    queries that would be dropped. This bug resulted in premature
    SERVFAIL responses, and has now been resolved.
  [bsc#1203614, bsc#1203618, bsc#1203619, bsc#1203620, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1668168000">- Update to release 9.16.34
  New Features:
  * Support for parsing and validating the dohpath service
    parameter in SVCB records was added.
  * named now logs the supported cryptographic algorithms during
    startup and in the output of named -V.
  Bug Fixes:
  * Changing just the TSIG key names for primaries in catalog
    zones’ member zones was not effective. This has been fixed.
  Known Issues:
  * Upgrading from BIND 9.16.32 or any older version may require a
    manual configuration change. The following configurations are
    affected:
  - type primary zones configured with dnssec-policy but without
    either allow-update or update-policy,
  - type secondary zones configured with dnssec-policy.
    In these cases please add inline-signing yes; to the individual
    zone configuration(s). Without applying this change, named will
    fail to start. For more details, see
    https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1669291200">- Update to release 9.16.35
  Bug Fixes:
  * A crash was fixed that happened when a dnssec-policy zone that
    used NSEC3 was reconfigured to enable inline-signing.
  * In certain resolution scenarios, quotas could be erroneously
    reached for servers, including any configured forwarders,
    resulting in SERVFAIL answers being sent to clients.
  * rpz-ip rules in response-policy zones could be ineffective in
    some cases if a query had the CD (Checking Disabled) bit set to
    1.
  * Previously, if Internet connectivity issues were experienced
    during the initial startup of named, a BIND resolver with
    dnssec-validation set to auto could enter into a state where it
    would not recover without stopping named, manually deleting the
    managed-keys.bind and managed-keys.bind.jnl files, and starting
    named again.
  * The statistics counter representing the current number of
    clients awaiting recursive resolution results (RecursClients)
    could overflow in certain resolution scenarios.
  * Previously, BIND failed to start on Solaris-based systems with
    hundreds of CPUs.
  * When a DNS resource record’s TTL value was equal to the
    resolver’s configured prefetch “eligibility” value, the record
    was erroneously not treated as eligible for prefetching.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1671710400">- Update to release 9.16.36
  Feature Changes:
  * The auto-dnssec option has been deprecated and will be removed
    in a future BIND 9.19.x release. Please migrate to
    dnssec-policy.
  Bug Fixes:
  * When a catalog zone was removed from the configuration, in some
    cases a dangling pointer could cause the named process to
    crash.
  * When a zone was deleted from a server, a key management object
    related to that zone was inadvertently kept in memory and only
    released upon shutdown. This could lead to constantly
    increasing memory use on servers with a high rate of changes
    affecting the set of zones being served.
  * In certain cases, named waited for the resolution of
    outstanding recursive queries to finish before shutting down.
  * The zone &lt;name&gt;/&lt;class&gt;: final reference detached log message
    was moved from the INFO log level to the DEBUG(1) log level to
    prevent the named-checkzone tool from superfluously logging
    this message in non-debug mode.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1674561600">- Update to release 9.16.37
  Security Fixes:
  * An UPDATE message flood could cause named to exhaust all
    available memory. This flaw was addressed by adding a new
    update-quota option that controls the maximum number of
    outstanding DNS UPDATE messages that named can hold in a queue
    at any given time (default: 100). (CVE-2022-3094)
  * named could crash with an assertion failure when an RRSIG query
    was received and stale-answer-client-timeout was set to a
    non-zero value. This has been fixed. (CVE-2022-3736)
  * named running as a resolver with the
    stale-answer-client-timeout option set to any value greater
    than 0 could crash with an assertion failure, when the
    recursive-clients soft quota was reached. This has been fixed.
    (CVE-2022-3924)
  New Features:
  * The new update-quota option can be used to control the number
    of simultaneous DNS UPDATE messages that can be processed to
    update an authoritative zone on a primary server, or forwarded
    to the primary server by a secondary server. The default is
    100. A new statistics counter has also been added to record
    events when this quota is exceeded, and the version numbers for
    the XML and JSON statistics schemas have been updated.
  Feature Changes:
  * The Differentiated Services Code Point (DSCP) feature in BIND
    has been deprecated. Configuring DSCP values in named.conf now
    causes a warning to be logged. Note that this feature has only
    been partly operational since the new Network Manager was
    introduced in BIND 9.16.0.
  * The catalog zone implementation has been optimized to work with
    hundreds of thousands of member zones.
  Bug Fixes:
  * In certain query resolution scenarios (e.g. when following
    CNAME records), named configured to answer from stale cache
    could return a SERVFAIL response despite a usable, non-stale
    answer being present in the cache. This has been fixed.
  [bsc#1207471, bsc#1207473, bsc#1207475, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1676548800">- Update to release 9.16.38
  Bug Fixes:
  * A constant stream of zone additions and deletions via rndc
    reconfig could cause increased memory consumption due to
    delayed cleaning of view memory. This has been fixed.
  * The speed of the message digest algorithms (MD5, SHA-1, SHA-2),
    and of NSEC3 hashing, has been improved.
  * Building BIND 9 failed when the --enable-dnsrps switch for
    ./configure was used. This has been fixed.
  [jsc#SLE-24600]
- Updated keyring and signature</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1678881600">- Update to release 9.16.39
  Feature Changes:
  * libuv support for receiving multiple UDP messages in a single
    recvmmsg() system call has been tweaked several times between
    libuv versions 1.35.0 and 1.40.0; the current recommended libuv
    version is 1.40.0 or higher. New rules are now in effect for
    running with a different version of libuv than the one used at
    compilation time. These rules may trigger a fatal error at
    startup:
  - Building against or running with libuv versions 1.35.0 and
    1.36.0 is now a fatal error.
  - Running with libuv version higher than 1.34.2 is now a
    fatal error when named is built against libuv version
    1.34.2 or lower.
  - Running with libuv version higher than 1.39.0 is now a
    fatal error when named is built against libuv version
    1.37.0, 1.38.0, 1.38.1, or 1.39.0.
  * This prevents the use of libuv versions that may trigger an
    assertion failure when receiving multiple UDP messages in a
    single system call.
  Bug Fixes:
  * named could crash with an assertion failure when adding a new
    zone into the configuration file for a name which was already
    configured as a member zone for a catalog zone. This has been
    fixed.
  * When named starts up, it sends a query for the DNSSEC key for
    each configured trust anchor to determine whether the key has
    changed. In some unusual cases, the query might depend on a
    zone for which the server is itself authoritative, and would
    have failed if it were sent before the zone was fully loaded.
    This has now been fixed by delaying the key queries until all
    zones have finished loading.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1682424000">- Update to release 9.16.40
  Bug Fixes:
  * Logfiles using timestamp-style suffixes were not always
    correctly removed when the number of files exceeded the limit
    set by versions. This has been fixed for configurations which
    do not explicitly specify a directory path as part of the file
    argument in the channel specification.
  * Performance of DNSSEC validation in zones with many DNSKEY
    records has been improved.</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1684324800">- Update to release 9.16.41
  Bug Fixes:
  * When removing delegations from an opt-out range,
    empty-non-terminal NSEC3 records generated by those delegations
    were not cleaned up. This has been fixed.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1687348800">- Update to release 9.16.42
  Security Fixes:
  * The overmem cleaning process has been improved, to prevent the
    cache from significantly exceeding the configured
    max-cache-size limit. (CVE-2023-2828)
  * A query that prioritizes stale data over lookup triggers a
    fetch to refresh the stale data in cache. If the fetch is
    aborted for exceeding the recursion quota, it was possible for
    named to enter an infinite callback loop and crash due to stack
    overflow. This has been fixed. (CVE-2023-2911)
  Bug Fixes:
  * Previously, it was possible for a delegation from cache to be
    returned to the client after the stale-answer-client-timeout
    duration. This has been fixed.
  [bsc#1212544, bsc#1212567, jsc#SLE-24600]</changelog>
  <changelog author="dmueller@suse.com" date="1688644800">- rebuild bind-utils on libuv updates (bsc#1212090)</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1688990400">- Log named-checkconf output [bsc#1213049]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1689076800">- Add dnstap support
  [jsc#PED-4852]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1695124800">- Update to release 9.16.44
  Bug Fixes:
  * Processing already-queued queries received over TCP could cause
    an assertion failure, when the server was reconfigured at the
    same time or the cache was being flushed. This has been fixed.
  Security Fixes:
  * Previously, sending a specially crafted message over the
    control channel could cause the packet-parsing code to run out
    of available stack memory, causing named to terminate
    unexpectedly. This has been fixed. (CVE-2023-3341)
  [bsc#1215472]
- Switch to pkgconfig(libprotobuf-c) since this now contains the
  required protobuf-c binary</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1708084800">- Update to new Major Version 9.18.24.
  This has many enhancements, bug fixes and changes.
  Breaking Changes:
  * Some options have been removed and some have been deprecated
    and will be removed in the future.
    For a complete list, see:
    https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918
  Major Changes:
  * Support for securing DNS traffic using Transport Layer Security
    (TLS). TLS is used by both DNS-over-TLS (DoT) and
    DNS-over-HTTPS (DoH).
  * Support for zone transfers over TLS (XFR-over-TLS, XoT) for
    both incoming and outgoing zone transfers.
  * The dig tool is now able to send DoT queries (+tls option).
  * Support for OpenSSL 3.0 APIs was added.
  * dnssec-checkds, dnssec-coverage, dnssec-keymgr, which have been
    removed in favor of the dnssec-policy feature
  * python3-bind is deprecated and the subpackage has been removed
  * A number of utilities have been moved from /usr/sbin to
    /usr/bin:
    named-checkconf named-checkzone named-compilezone
    dnssec-dsfromkey dnssec-importkey dnssec-keyfromlabel
    dnssec-keygen dnssec-revoke dnssec-settime dnssec-signzone
    dnssec-verify dnssec-cds named-journalprint nsec3hash
  * The lib directory was renamed from 'named' to 'bind'
  For a complete list of changes, see:
  * Bind Release Notes
    https://bind9.readthedocs.io/en/v9.18.24/notes.html
  * The CHANGES file in the source RPM
  Security Fixes:
  * Validating DNS messages containing a lot of DNSSEC signatures
    could cause excessive CPU load, leading to a denial-of-service
    condition. This has been fixed. (CVE-2023-50387)
    [bsc#1219823]
  * Preparing an NSEC3 closest encloser proof could cause excessive
    CPU load, leading to a denial-of-service condition. This has
    been fixed. (CVE-2023-50868)
    [bsc#1219826]
  * Parsing DNS messages with many different names could cause
    excessive CPU load. This has been fixed. (CVE-2023-4408)
    [bsc#1219851]
  * Specific queries could cause named to crash with an assertion
    failure when nxdomain-redirect was enabled. This has been
    fixed. (CVE-2023-5517)
    [bsc#1219852]
  * A bad interaction between DNS64 and serve-stale could cause
    named to crash with an assertion failure, when both of these
    features were enabled. This has been fixed. (CVE-2023-5679)
    [bsc#1219853]
  * Query patterns that continuously triggered cache database
    maintenance could cause an excessive amount of memory to be
    allocated, exceeding max-cache-size and potentially leading to
    all available memory on the host running named being exhausted.
    This has been fixed. (CVE-2023-6516)
    [bsc#1219854]
  Packaging notes:
  * libnghttps2 added as BuildRequires for tls support
  * named-bootconf.diff patch is obsolete and has been removed
  [jsc#PED-7932]
- Update KillMode to 'control-group' in named.service to handle
  forked processes better.
  [bsc#1215755]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1721908800">- Update to release 9.18.28
  Bug Fixes:
  * Command-line options for IPv4-only (named -4) and IPv6-only
    (named -6) modes are now respected for zone primaries,
    also-notify, and parental-agents.
  * An RPZ response’s SOA record TTL was set to 1 instead of the
    SOA TTL, if add-soa was used. This has been fixed.
  * When a query related to zone maintenance (NOTIFY, SOA) timed
    out close to a view shutdown (triggered e.g. by rndc reload),
    named could crash with an assertion failure. This has been
    fixed.
  * The statistics channel counters that indicated the number of
    currently connected TCP IPv4/IPv6 clients were not properly
    adjusted in certain failure scenarios. This has been fixed.
  * Some servers that could not be reached due to EHOSTDOWN or
    ENETDOWN conditions were incorrectly prioritized during server
    selection. These are now properly handled as unreachable.
  * On some systems the libuv call may return an error code when
    sending a TCP reset for a connection, which triggers an
    assertion failure in named. This error condition is now dealt
    with in a more graceful manner, by logging the incident and
    shutting down the connection.
  * Changes to listen-on statements were ignored on reconfiguration
    unless the port or interface address was changed, making it
    impossible to change a related listener transport type. That
    issue has been fixed.
  * A bug in the keymgr code unintentionally slowed down some
    DNSSEC key rollovers. This has been fixed.
  * Some ISO 8601 durations were accepted erroneously, leading to
    shorter durations than expected. This has been fixed
  * A regression in cache-cleaning code enabled memory use to grow
    significantly more quickly than before, until the configured
    max-cache-size limit was reached. This has been fixed.
  * Using rndc flush inadvertently caused cache cleaning to become
    less effective. This could ultimately lead to the configured
    max-cache-size limit being exceeded and has now been fixed.
  * The logic for cleaning up expired cached DNS records was
    tweaked to be more aggressive. This change helps with enforcing
    max-cache-ttl and max-ncache-ttl in a timely manner.
  * It was possible to trigger a use-after-free assertion when the
    overmem cache cleaning was initiated. This has been fixed.
  New Features:
  * A new option signatures-jitter has been added to dnssec-policy
    to allow signature expirations to be spread out over a period
    of time.
  * The statistics channel now includes counters that indicate the
    number of currently connected TCP IPv4/IPv6 clients.
  * Added RESOLVER.ARPA to the built in empty zones.
  Feature Changes:
  * DNSSEC signatures that are not valid because the current time
    falls outside the signature inception and expiration dates are
    skipped instead of causing an immediate validation failure.
  Security Fixes:
  * A malicious DNS client that sent many queries over TCP but
    never read the responses could cause a server to respond slowly
    or not at all for other clients. This has been fixed.
    (CVE-2024-0760)
    [bsc#1228255]
  * It is possible to craft excessively large resource records
    sets, which have the effect of slowing down database
    processing. This has been addressed by adding a configurable
    limit to the number of records that can be stored per name and
    type in a cache or zone database. The default is 100, which can
    be tuned with the new max-records-per-type option.
  * It is possible to craft excessively large numbers of resource
    record types for a given owner name, which has the effect of
    slowing down database processing. This has been addressed by
    adding a configurable limit to the number of records that can
    be stored per name and type in a cache or zone database. The
    default is 100, which can be tuned with the new
    max-types-per-name option. (CVE-2024-1737)
    [bsc#1228256]
  * Validating DNS messages signed using the SIG(0) protocol (RFC
    2931) could cause excessive CPU load, leading to a
    denial-of-service condition. Support for SIG(0) message
    validation was removed from this version of named.
    (CVE-2024-1975)
    [bsc#1228257]
  * Due to a logic error, lookups that triggered serving stale data
    and required lookups in local authoritative zone data could
    have resulted in an assertion failure. This has been fixed.
  * Potential data races were found in our DoH implementation,
    related to HTTP/2 session object management and endpoints set
    object management after reconfiguration. These issues have been
    fixed.
  * When looking up the NS records of parent zones as part of
    looking up DS records, it was possible for named to trigger an
    assertion failure if serve-stale was enabled. This has been
    fixed. (CVE-2024-4076)
    [bsc#1228258]</changelog>
</package>
<package pkgid="f118ab13c6e07720cd434d8526aa277bbc315fad57dbce080b9567494a91a2a4" name="bind-utils" arch="s390x">
  <version epoch="0" ver="9.18.28" rel="150600.3.3.1"/>
  <changelog author="josef.moellers@suse.com" date="1657800000">- Update to release 9.16.31
  This is the first of monthly updates of "bind". It is planned
  to update bind when a new upstream maintennace release becomes
  available, which is usually towards the end of a month, see
  https://www.isc.org/blogs/2021-bind-release-model/
  Compared to the previous SUSE release, in this release,
  53 (minor) bugs were fixed
  13 (minor) functional enhancements were made
  3 security issues are now fixed upstream:
    CVE-2022-0396, CVE-2021-25220, CVE-2021-25219
  plus a few minor changes.
  For a full list of changes, please refer to the
  CHANGES file in the source rpm.
  This update obsoletes the following patches:
  * bind-fix-build-with-older-sphinx.patch
  * bind-CVE-2021-25219.patch
  * bind-9.16.27-0001-CVE-2021-25220.patch
  * bind-9.16.27-0002-CVE-2022-0396.patch
  [bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind-9.16.20.tar.xz, bind-9.16.20.tar.xz.sha512.asc,
  bind-fix-build-with-older-sphinx.patch, bind-CVE-2021-25219.patch,
  bind-9.16.27-0001-CVE-2021-25220.patch,
  bind-9.16.27-0002-CVE-2022-0396.patch,
  jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1661256000">- Update to release 9.16.32
  Feature Changes:
  * The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
  disabled on systems where they are disallowed by the security policy
  (e.g. Red Hat Enterprise Linux 9). Primary zones using those algorithms
  need to be migrated to new algorithms prior to running on these systems,
  as graceful migration to different DNSSEC algorithms is not possible when
  RSASHA1 is disallowed by the operating system.
  * Log messages related to fetch limiting have been improved to provide
  more complete information. Specifically, the final counts of allowed
  and spilled fetches are now logged before the counter object is destroyed.
  Bug Fixes:
  * Non-dynamic zones that inherit dnssec-policy from the view or options
  blocks were not marked as inline-signed and therefore never scheduled
  to be re-signed. This has been fixed.
  * The old max-zone-ttl zone option was meant to be superseded by
  the max-zone-ttl option in dnssec-policy; however, the latter option
  was not fully effective. This has been corrected: zones no longer load
  if they contain TTLs greater than the limit configured in dnssec-policy.
  For zones with both the old max-zone-ttl option and dnssec-policy
  configured, the old option is ignored, and a warning is generated.
  * rndc dumpdb -expired was fixed to include expired RRsets,
  even if stale-cache-enable is set to no and
  the cache-cleaning time window has passed.
  [bind-9.16.32.tar.xz, bind-9.16.32.tar.xz.sha512.asc,
  bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind.spec, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724800">- Include a modified createNamedConfInclude script again, as this
  broke compatability with existing configurations.
  A symlink for named.conf.include to /var/lib/named is created to
  allow for a read-only /etc directory.
  However it is still advised to change the existing configuration.
  See README-bind.chrootenv for a guide how to do this.
  [bsc#1203250, vendor-files/tools/createNamedConfInclude,
  vendor-files/docu/README-bind.chrootenv, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724801">- Add systemd drop-in directory for named service
  [bsc#1201689, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1663761600">- Update to release 9.16.33
  Security Fixes:
  * Previously, there was no limit to the number of database lookups
    performed while processing large delegations, which could be
    abused to severely impact the performance of named running as a
    recursive resolver. This has been fixed. (CVE-2022-2795)
  * named running as a resolver with the stale-answer-client-timeout
    option set to 0 could crash with an assertion failure, when
    there was a stale CNAME in the cache for the incoming query.
    This has been fixed. (CVE-2022-3080)
  * A memory leak was fixed that could be externally triggered in the
    DNSSEC verification code for the ECDSA algorithm. (CVE-2022-38177)
  * Memory leaks were fixed that could be externally triggered in the
    DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178)
  Feature Changes:
  * Response Rate Limiting (RRL) code now treats all QNAMEs that are
    subject to wildcard processing within a given zone as the same
    name, to prevent circumventing the limits enforced by RRL.
  * Zones using dnssec-policy now require dynamic DNS or
    inline-signing to be configured explicitly.
  * A backward-compatible approach was implemented for encoding
    internationalized domain names (IDN) in dig and converting the
    domain to IDNA2008 form; if that fails,
    BIND tries an IDNA2003 conversion.
  Bug Fixes:
  * A serve-stale bug was fixed, where BIND would try to return stale
    data from cache for lookups that received duplicate queries or
    queries that would be dropped. This bug resulted in premature
    SERVFAIL responses, and has now been resolved.
  [bsc#1203614, bsc#1203618, bsc#1203619, bsc#1203620, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1668168000">- Update to release 9.16.34
  New Features:
  * Support for parsing and validating the dohpath service
    parameter in SVCB records was added.
  * named now logs the supported cryptographic algorithms during
    startup and in the output of named -V.
  Bug Fixes:
  * Changing just the TSIG key names for primaries in catalog
    zones’ member zones was not effective. This has been fixed.
  Known Issues:
  * Upgrading from BIND 9.16.32 or any older version may require a
    manual configuration change. The following configurations are
    affected:
  - type primary zones configured with dnssec-policy but without
    either allow-update or update-policy,
  - type secondary zones configured with dnssec-policy.
    In these cases please add inline-signing yes; to the individual
    zone configuration(s). Without applying this change, named will
    fail to start. For more details, see
    https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1669291200">- Update to release 9.16.35
  Bug Fixes:
  * A crash was fixed that happened when a dnssec-policy zone that
    used NSEC3 was reconfigured to enable inline-signing.
  * In certain resolution scenarios, quotas could be erroneously
    reached for servers, including any configured forwarders,
    resulting in SERVFAIL answers being sent to clients.
  * rpz-ip rules in response-policy zones could be ineffective in
    some cases if a query had the CD (Checking Disabled) bit set to
    1.
  * Previously, if Internet connectivity issues were experienced
    during the initial startup of named, a BIND resolver with
    dnssec-validation set to auto could enter into a state where it
    would not recover without stopping named, manually deleting the
    managed-keys.bind and managed-keys.bind.jnl files, and starting
    named again.
  * The statistics counter representing the current number of
    clients awaiting recursive resolution results (RecursClients)
    could overflow in certain resolution scenarios.
  * Previously, BIND failed to start on Solaris-based systems with
    hundreds of CPUs.
  * When a DNS resource record’s TTL value was equal to the
    resolver’s configured prefetch “eligibility” value, the record
    was erroneously not treated as eligible for prefetching.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1671710400">- Update to release 9.16.36
  Feature Changes:
  * The auto-dnssec option has been deprecated and will be removed
    in a future BIND 9.19.x release. Please migrate to
    dnssec-policy.
  Bug Fixes:
  * When a catalog zone was removed from the configuration, in some
    cases a dangling pointer could cause the named process to
    crash.
  * When a zone was deleted from a server, a key management object
    related to that zone was inadvertently kept in memory and only
    released upon shutdown. This could lead to constantly
    increasing memory use on servers with a high rate of changes
    affecting the set of zones being served.
  * In certain cases, named waited for the resolution of
    outstanding recursive queries to finish before shutting down.
  * The zone &lt;name&gt;/&lt;class&gt;: final reference detached log message
    was moved from the INFO log level to the DEBUG(1) log level to
    prevent the named-checkzone tool from superfluously logging
    this message in non-debug mode.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1674561600">- Update to release 9.16.37
  Security Fixes:
  * An UPDATE message flood could cause named to exhaust all
    available memory. This flaw was addressed by adding a new
    update-quota option that controls the maximum number of
    outstanding DNS UPDATE messages that named can hold in a queue
    at any given time (default: 100). (CVE-2022-3094)
  * named could crash with an assertion failure when an RRSIG query
    was received and stale-answer-client-timeout was set to a
    non-zero value. This has been fixed. (CVE-2022-3736)
  * named running as a resolver with the
    stale-answer-client-timeout option set to any value greater
    than 0 could crash with an assertion failure, when the
    recursive-clients soft quota was reached. This has been fixed.
    (CVE-2022-3924)
  New Features:
  * The new update-quota option can be used to control the number
    of simultaneous DNS UPDATE messages that can be processed to
    update an authoritative zone on a primary server, or forwarded
    to the primary server by a secondary server. The default is
    100. A new statistics counter has also been added to record
    events when this quota is exceeded, and the version numbers for
    the XML and JSON statistics schemas have been updated.
  Feature Changes:
  * The Differentiated Services Code Point (DSCP) feature in BIND
    has been deprecated. Configuring DSCP values in named.conf now
    causes a warning to be logged. Note that this feature has only
    been partly operational since the new Network Manager was
    introduced in BIND 9.16.0.
  * The catalog zone implementation has been optimized to work with
    hundreds of thousands of member zones.
  Bug Fixes:
  * In certain query resolution scenarios (e.g. when following
    CNAME records), named configured to answer from stale cache
    could return a SERVFAIL response despite a usable, non-stale
    answer being present in the cache. This has been fixed.
  [bsc#1207471, bsc#1207473, bsc#1207475, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1676548800">- Update to release 9.16.38
  Bug Fixes:
  * A constant stream of zone additions and deletions via rndc
    reconfig could cause increased memory consumption due to
    delayed cleaning of view memory. This has been fixed.
  * The speed of the message digest algorithms (MD5, SHA-1, SHA-2),
    and of NSEC3 hashing, has been improved.
  * Building BIND 9 failed when the --enable-dnsrps switch for
    ./configure was used. This has been fixed.
  [jsc#SLE-24600]
- Updated keyring and signature</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1678881600">- Update to release 9.16.39
  Feature Changes:
  * libuv support for receiving multiple UDP messages in a single
    recvmmsg() system call has been tweaked several times between
    libuv versions 1.35.0 and 1.40.0; the current recommended libuv
    version is 1.40.0 or higher. New rules are now in effect for
    running with a different version of libuv than the one used at
    compilation time. These rules may trigger a fatal error at
    startup:
  - Building against or running with libuv versions 1.35.0 and
    1.36.0 is now a fatal error.
  - Running with libuv version higher than 1.34.2 is now a
    fatal error when named is built against libuv version
    1.34.2 or lower.
  - Running with libuv version higher than 1.39.0 is now a
    fatal error when named is built against libuv version
    1.37.0, 1.38.0, 1.38.1, or 1.39.0.
  * This prevents the use of libuv versions that may trigger an
    assertion failure when receiving multiple UDP messages in a
    single system call.
  Bug Fixes:
  * named could crash with an assertion failure when adding a new
    zone into the configuration file for a name which was already
    configured as a member zone for a catalog zone. This has been
    fixed.
  * When named starts up, it sends a query for the DNSSEC key for
    each configured trust anchor to determine whether the key has
    changed. In some unusual cases, the query might depend on a
    zone for which the server is itself authoritative, and would
    have failed if it were sent before the zone was fully loaded.
    This has now been fixed by delaying the key queries until all
    zones have finished loading.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1682424000">- Update to release 9.16.40
  Bug Fixes:
  * Logfiles using timestamp-style suffixes were not always
    correctly removed when the number of files exceeded the limit
    set by versions. This has been fixed for configurations which
    do not explicitly specify a directory path as part of the file
    argument in the channel specification.
  * Performance of DNSSEC validation in zones with many DNSKEY
    records has been improved.</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1684324800">- Update to release 9.16.41
  Bug Fixes:
  * When removing delegations from an opt-out range,
    empty-non-terminal NSEC3 records generated by those delegations
    were not cleaned up. This has been fixed.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1687348800">- Update to release 9.16.42
  Security Fixes:
  * The overmem cleaning process has been improved, to prevent the
    cache from significantly exceeding the configured
    max-cache-size limit. (CVE-2023-2828)
  * A query that prioritizes stale data over lookup triggers a
    fetch to refresh the stale data in cache. If the fetch is
    aborted for exceeding the recursion quota, it was possible for
    named to enter an infinite callback loop and crash due to stack
    overflow. This has been fixed. (CVE-2023-2911)
  Bug Fixes:
  * Previously, it was possible for a delegation from cache to be
    returned to the client after the stale-answer-client-timeout
    duration. This has been fixed.
  [bsc#1212544, bsc#1212567, jsc#SLE-24600]</changelog>
  <changelog author="dmueller@suse.com" date="1688644800">- rebuild bind-utils on libuv updates (bsc#1212090)</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1688990400">- Log named-checkconf output [bsc#1213049]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1689076800">- Add dnstap support
  [jsc#PED-4852]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1695124800">- Update to release 9.16.44
  Bug Fixes:
  * Processing already-queued queries received over TCP could cause
    an assertion failure, when the server was reconfigured at the
    same time or the cache was being flushed. This has been fixed.
  Security Fixes:
  * Previously, sending a specially crafted message over the
    control channel could cause the packet-parsing code to run out
    of available stack memory, causing named to terminate
    unexpectedly. This has been fixed. (CVE-2023-3341)
  [bsc#1215472]
- Switch to pkgconfig(libprotobuf-c) since this now contains the
  required protobuf-c binary</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1708084800">- Update to new Major Version 9.18.24.
  This has many enhancements, bug fixes and changes.
  Breaking Changes:
  * Some options have been removed and some have been deprecated
    and will be removed in the future.
    For a complete list, see:
    https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918
  Major Changes:
  * Support for securing DNS traffic using Transport Layer Security
    (TLS). TLS is used by both DNS-over-TLS (DoT) and
    DNS-over-HTTPS (DoH).
  * Support for zone transfers over TLS (XFR-over-TLS, XoT) for
    both incoming and outgoing zone transfers.
  * The dig tool is now able to send DoT queries (+tls option).
  * Support for OpenSSL 3.0 APIs was added.
  * dnssec-checkds, dnssec-coverage, dnssec-keymgr, which have been
    removed in favor of the dnssec-policy feature
  * python3-bind is deprecated and the subpackage has been removed
  * A number of utilities have been moved from /usr/sbin to
    /usr/bin:
    named-checkconf named-checkzone named-compilezone
    dnssec-dsfromkey dnssec-importkey dnssec-keyfromlabel
    dnssec-keygen dnssec-revoke dnssec-settime dnssec-signzone
    dnssec-verify dnssec-cds named-journalprint nsec3hash
  * The lib directory was renamed from 'named' to 'bind'
  For a complete list of changes, see:
  * Bind Release Notes
    https://bind9.readthedocs.io/en/v9.18.24/notes.html
  * The CHANGES file in the source RPM
  Security Fixes:
  * Validating DNS messages containing a lot of DNSSEC signatures
    could cause excessive CPU load, leading to a denial-of-service
    condition. This has been fixed. (CVE-2023-50387)
    [bsc#1219823]
  * Preparing an NSEC3 closest encloser proof could cause excessive
    CPU load, leading to a denial-of-service condition. This has
    been fixed. (CVE-2023-50868)
    [bsc#1219826]
  * Parsing DNS messages with many different names could cause
    excessive CPU load. This has been fixed. (CVE-2023-4408)
    [bsc#1219851]
  * Specific queries could cause named to crash with an assertion
    failure when nxdomain-redirect was enabled. This has been
    fixed. (CVE-2023-5517)
    [bsc#1219852]
  * A bad interaction between DNS64 and serve-stale could cause
    named to crash with an assertion failure, when both of these
    features were enabled. This has been fixed. (CVE-2023-5679)
    [bsc#1219853]
  * Query patterns that continuously triggered cache database
    maintenance could cause an excessive amount of memory to be
    allocated, exceeding max-cache-size and potentially leading to
    all available memory on the host running named being exhausted.
    This has been fixed. (CVE-2023-6516)
    [bsc#1219854]
  Packaging notes:
  * libnghttps2 added as BuildRequires for tls support
  * named-bootconf.diff patch is obsolete and has been removed
  [jsc#PED-7932]
- Update KillMode to 'control-group' in named.service to handle
  forked processes better.
  [bsc#1215755]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1721908800">- Update to release 9.18.28
  Bug Fixes:
  * Command-line options for IPv4-only (named -4) and IPv6-only
    (named -6) modes are now respected for zone primaries,
    also-notify, and parental-agents.
  * An RPZ response’s SOA record TTL was set to 1 instead of the
    SOA TTL, if add-soa was used. This has been fixed.
  * When a query related to zone maintenance (NOTIFY, SOA) timed
    out close to a view shutdown (triggered e.g. by rndc reload),
    named could crash with an assertion failure. This has been
    fixed.
  * The statistics channel counters that indicated the number of
    currently connected TCP IPv4/IPv6 clients were not properly
    adjusted in certain failure scenarios. This has been fixed.
  * Some servers that could not be reached due to EHOSTDOWN or
    ENETDOWN conditions were incorrectly prioritized during server
    selection. These are now properly handled as unreachable.
  * On some systems the libuv call may return an error code when
    sending a TCP reset for a connection, which triggers an
    assertion failure in named. This error condition is now dealt
    with in a more graceful manner, by logging the incident and
    shutting down the connection.
  * Changes to listen-on statements were ignored on reconfiguration
    unless the port or interface address was changed, making it
    impossible to change a related listener transport type. That
    issue has been fixed.
  * A bug in the keymgr code unintentionally slowed down some
    DNSSEC key rollovers. This has been fixed.
  * Some ISO 8601 durations were accepted erroneously, leading to
    shorter durations than expected. This has been fixed
  * A regression in cache-cleaning code enabled memory use to grow
    significantly more quickly than before, until the configured
    max-cache-size limit was reached. This has been fixed.
  * Using rndc flush inadvertently caused cache cleaning to become
    less effective. This could ultimately lead to the configured
    max-cache-size limit being exceeded and has now been fixed.
  * The logic for cleaning up expired cached DNS records was
    tweaked to be more aggressive. This change helps with enforcing
    max-cache-ttl and max-ncache-ttl in a timely manner.
  * It was possible to trigger a use-after-free assertion when the
    overmem cache cleaning was initiated. This has been fixed.
  New Features:
  * A new option signatures-jitter has been added to dnssec-policy
    to allow signature expirations to be spread out over a period
    of time.
  * The statistics channel now includes counters that indicate the
    number of currently connected TCP IPv4/IPv6 clients.
  * Added RESOLVER.ARPA to the built in empty zones.
  Feature Changes:
  * DNSSEC signatures that are not valid because the current time
    falls outside the signature inception and expiration dates are
    skipped instead of causing an immediate validation failure.
  Security Fixes:
  * A malicious DNS client that sent many queries over TCP but
    never read the responses could cause a server to respond slowly
    or not at all for other clients. This has been fixed.
    (CVE-2024-0760)
    [bsc#1228255]
  * It is possible to craft excessively large resource records
    sets, which have the effect of slowing down database
    processing. This has been addressed by adding a configurable
    limit to the number of records that can be stored per name and
    type in a cache or zone database. The default is 100, which can
    be tuned with the new max-records-per-type option.
  * It is possible to craft excessively large numbers of resource
    record types for a given owner name, which has the effect of
    slowing down database processing. This has been addressed by
    adding a configurable limit to the number of records that can
    be stored per name and type in a cache or zone database. The
    default is 100, which can be tuned with the new
    max-types-per-name option. (CVE-2024-1737)
    [bsc#1228256]
  * Validating DNS messages signed using the SIG(0) protocol (RFC
    2931) could cause excessive CPU load, leading to a
    denial-of-service condition. Support for SIG(0) message
    validation was removed from this version of named.
    (CVE-2024-1975)
    [bsc#1228257]
  * Due to a logic error, lookups that triggered serving stale data
    and required lookups in local authoritative zone data could
    have resulted in an assertion failure. This has been fixed.
  * Potential data races were found in our DoH implementation,
    related to HTTP/2 session object management and endpoints set
    object management after reconfiguration. These issues have been
    fixed.
  * When looking up the NS records of parent zones as part of
    looking up DS records, it was possible for named to trigger an
    assertion failure if serve-stale was enabled. This has been
    fixed. (CVE-2024-4076)
    [bsc#1228258]</changelog>
</package>
<package pkgid="2607da02f6a201e6b069d4ba1789baee0e4b2dbc92591fd98b7ae60a3babb8de" name="bind-utils" arch="x86_64">
  <version epoch="0" ver="9.18.28" rel="150600.3.3.1"/>
  <changelog author="josef.moellers@suse.com" date="1657800000">- Update to release 9.16.31
  This is the first of monthly updates of "bind". It is planned
  to update bind when a new upstream maintennace release becomes
  available, which is usually towards the end of a month, see
  https://www.isc.org/blogs/2021-bind-release-model/
  Compared to the previous SUSE release, in this release,
  53 (minor) bugs were fixed
  13 (minor) functional enhancements were made
  3 security issues are now fixed upstream:
    CVE-2022-0396, CVE-2021-25220, CVE-2021-25219
  plus a few minor changes.
  For a full list of changes, please refer to the
  CHANGES file in the source rpm.
  This update obsoletes the following patches:
  * bind-fix-build-with-older-sphinx.patch
  * bind-CVE-2021-25219.patch
  * bind-9.16.27-0001-CVE-2021-25220.patch
  * bind-9.16.27-0002-CVE-2022-0396.patch
  [bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind-9.16.20.tar.xz, bind-9.16.20.tar.xz.sha512.asc,
  bind-fix-build-with-older-sphinx.patch, bind-CVE-2021-25219.patch,
  bind-9.16.27-0001-CVE-2021-25220.patch,
  bind-9.16.27-0002-CVE-2022-0396.patch,
  jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1661256000">- Update to release 9.16.32
  Feature Changes:
  * The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
  disabled on systems where they are disallowed by the security policy
  (e.g. Red Hat Enterprise Linux 9). Primary zones using those algorithms
  need to be migrated to new algorithms prior to running on these systems,
  as graceful migration to different DNSSEC algorithms is not possible when
  RSASHA1 is disallowed by the operating system.
  * Log messages related to fetch limiting have been improved to provide
  more complete information. Specifically, the final counts of allowed
  and spilled fetches are now logged before the counter object is destroyed.
  Bug Fixes:
  * Non-dynamic zones that inherit dnssec-policy from the view or options
  blocks were not marked as inline-signed and therefore never scheduled
  to be re-signed. This has been fixed.
  * The old max-zone-ttl zone option was meant to be superseded by
  the max-zone-ttl option in dnssec-policy; however, the latter option
  was not fully effective. This has been corrected: zones no longer load
  if they contain TTLs greater than the limit configured in dnssec-policy.
  For zones with both the old max-zone-ttl option and dnssec-policy
  configured, the old option is ignored, and a warning is generated.
  * rndc dumpdb -expired was fixed to include expired RRsets,
  even if stale-cache-enable is set to no and
  the cache-cleaning time window has passed.
  [bind-9.16.32.tar.xz, bind-9.16.32.tar.xz.sha512.asc,
  bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind.spec, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724800">- Include a modified createNamedConfInclude script again, as this
  broke compatability with existing configurations.
  A symlink for named.conf.include to /var/lib/named is created to
  allow for a read-only /etc directory.
  However it is still advised to change the existing configuration.
  See README-bind.chrootenv for a guide how to do this.
  [bsc#1203250, vendor-files/tools/createNamedConfInclude,
  vendor-files/docu/README-bind.chrootenv, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724801">- Add systemd drop-in directory for named service
  [bsc#1201689, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1663761600">- Update to release 9.16.33
  Security Fixes:
  * Previously, there was no limit to the number of database lookups
    performed while processing large delegations, which could be
    abused to severely impact the performance of named running as a
    recursive resolver. This has been fixed. (CVE-2022-2795)
  * named running as a resolver with the stale-answer-client-timeout
    option set to 0 could crash with an assertion failure, when
    there was a stale CNAME in the cache for the incoming query.
    This has been fixed. (CVE-2022-3080)
  * A memory leak was fixed that could be externally triggered in the
    DNSSEC verification code for the ECDSA algorithm. (CVE-2022-38177)
  * Memory leaks were fixed that could be externally triggered in the
    DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178)
  Feature Changes:
  * Response Rate Limiting (RRL) code now treats all QNAMEs that are
    subject to wildcard processing within a given zone as the same
    name, to prevent circumventing the limits enforced by RRL.
  * Zones using dnssec-policy now require dynamic DNS or
    inline-signing to be configured explicitly.
  * A backward-compatible approach was implemented for encoding
    internationalized domain names (IDN) in dig and converting the
    domain to IDNA2008 form; if that fails,
    BIND tries an IDNA2003 conversion.
  Bug Fixes:
  * A serve-stale bug was fixed, where BIND would try to return stale
    data from cache for lookups that received duplicate queries or
    queries that would be dropped. This bug resulted in premature
    SERVFAIL responses, and has now been resolved.
  [bsc#1203614, bsc#1203618, bsc#1203619, bsc#1203620, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1668168000">- Update to release 9.16.34
  New Features:
  * Support for parsing and validating the dohpath service
    parameter in SVCB records was added.
  * named now logs the supported cryptographic algorithms during
    startup and in the output of named -V.
  Bug Fixes:
  * Changing just the TSIG key names for primaries in catalog
    zones’ member zones was not effective. This has been fixed.
  Known Issues:
  * Upgrading from BIND 9.16.32 or any older version may require a
    manual configuration change. The following configurations are
    affected:
  - type primary zones configured with dnssec-policy but without
    either allow-update or update-policy,
  - type secondary zones configured with dnssec-policy.
    In these cases please add inline-signing yes; to the individual
    zone configuration(s). Without applying this change, named will
    fail to start. For more details, see
    https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1669291200">- Update to release 9.16.35
  Bug Fixes:
  * A crash was fixed that happened when a dnssec-policy zone that
    used NSEC3 was reconfigured to enable inline-signing.
  * In certain resolution scenarios, quotas could be erroneously
    reached for servers, including any configured forwarders,
    resulting in SERVFAIL answers being sent to clients.
  * rpz-ip rules in response-policy zones could be ineffective in
    some cases if a query had the CD (Checking Disabled) bit set to
    1.
  * Previously, if Internet connectivity issues were experienced
    during the initial startup of named, a BIND resolver with
    dnssec-validation set to auto could enter into a state where it
    would not recover without stopping named, manually deleting the
    managed-keys.bind and managed-keys.bind.jnl files, and starting
    named again.
  * The statistics counter representing the current number of
    clients awaiting recursive resolution results (RecursClients)
    could overflow in certain resolution scenarios.
  * Previously, BIND failed to start on Solaris-based systems with
    hundreds of CPUs.
  * When a DNS resource record’s TTL value was equal to the
    resolver’s configured prefetch “eligibility” value, the record
    was erroneously not treated as eligible for prefetching.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1671710400">- Update to release 9.16.36
  Feature Changes:
  * The auto-dnssec option has been deprecated and will be removed
    in a future BIND 9.19.x release. Please migrate to
    dnssec-policy.
  Bug Fixes:
  * When a catalog zone was removed from the configuration, in some
    cases a dangling pointer could cause the named process to
    crash.
  * When a zone was deleted from a server, a key management object
    related to that zone was inadvertently kept in memory and only
    released upon shutdown. This could lead to constantly
    increasing memory use on servers with a high rate of changes
    affecting the set of zones being served.
  * In certain cases, named waited for the resolution of
    outstanding recursive queries to finish before shutting down.
  * The zone &lt;name&gt;/&lt;class&gt;: final reference detached log message
    was moved from the INFO log level to the DEBUG(1) log level to
    prevent the named-checkzone tool from superfluously logging
    this message in non-debug mode.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1674561600">- Update to release 9.16.37
  Security Fixes:
  * An UPDATE message flood could cause named to exhaust all
    available memory. This flaw was addressed by adding a new
    update-quota option that controls the maximum number of
    outstanding DNS UPDATE messages that named can hold in a queue
    at any given time (default: 100). (CVE-2022-3094)
  * named could crash with an assertion failure when an RRSIG query
    was received and stale-answer-client-timeout was set to a
    non-zero value. This has been fixed. (CVE-2022-3736)
  * named running as a resolver with the
    stale-answer-client-timeout option set to any value greater
    than 0 could crash with an assertion failure, when the
    recursive-clients soft quota was reached. This has been fixed.
    (CVE-2022-3924)
  New Features:
  * The new update-quota option can be used to control the number
    of simultaneous DNS UPDATE messages that can be processed to
    update an authoritative zone on a primary server, or forwarded
    to the primary server by a secondary server. The default is
    100. A new statistics counter has also been added to record
    events when this quota is exceeded, and the version numbers for
    the XML and JSON statistics schemas have been updated.
  Feature Changes:
  * The Differentiated Services Code Point (DSCP) feature in BIND
    has been deprecated. Configuring DSCP values in named.conf now
    causes a warning to be logged. Note that this feature has only
    been partly operational since the new Network Manager was
    introduced in BIND 9.16.0.
  * The catalog zone implementation has been optimized to work with
    hundreds of thousands of member zones.
  Bug Fixes:
  * In certain query resolution scenarios (e.g. when following
    CNAME records), named configured to answer from stale cache
    could return a SERVFAIL response despite a usable, non-stale
    answer being present in the cache. This has been fixed.
  [bsc#1207471, bsc#1207473, bsc#1207475, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1676548800">- Update to release 9.16.38
  Bug Fixes:
  * A constant stream of zone additions and deletions via rndc
    reconfig could cause increased memory consumption due to
    delayed cleaning of view memory. This has been fixed.
  * The speed of the message digest algorithms (MD5, SHA-1, SHA-2),
    and of NSEC3 hashing, has been improved.
  * Building BIND 9 failed when the --enable-dnsrps switch for
    ./configure was used. This has been fixed.
  [jsc#SLE-24600]
- Updated keyring and signature</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1678881600">- Update to release 9.16.39
  Feature Changes:
  * libuv support for receiving multiple UDP messages in a single
    recvmmsg() system call has been tweaked several times between
    libuv versions 1.35.0 and 1.40.0; the current recommended libuv
    version is 1.40.0 or higher. New rules are now in effect for
    running with a different version of libuv than the one used at
    compilation time. These rules may trigger a fatal error at
    startup:
  - Building against or running with libuv versions 1.35.0 and
    1.36.0 is now a fatal error.
  - Running with libuv version higher than 1.34.2 is now a
    fatal error when named is built against libuv version
    1.34.2 or lower.
  - Running with libuv version higher than 1.39.0 is now a
    fatal error when named is built against libuv version
    1.37.0, 1.38.0, 1.38.1, or 1.39.0.
  * This prevents the use of libuv versions that may trigger an
    assertion failure when receiving multiple UDP messages in a
    single system call.
  Bug Fixes:
  * named could crash with an assertion failure when adding a new
    zone into the configuration file for a name which was already
    configured as a member zone for a catalog zone. This has been
    fixed.
  * When named starts up, it sends a query for the DNSSEC key for
    each configured trust anchor to determine whether the key has
    changed. In some unusual cases, the query might depend on a
    zone for which the server is itself authoritative, and would
    have failed if it were sent before the zone was fully loaded.
    This has now been fixed by delaying the key queries until all
    zones have finished loading.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1682424000">- Update to release 9.16.40
  Bug Fixes:
  * Logfiles using timestamp-style suffixes were not always
    correctly removed when the number of files exceeded the limit
    set by versions. This has been fixed for configurations which
    do not explicitly specify a directory path as part of the file
    argument in the channel specification.
  * Performance of DNSSEC validation in zones with many DNSKEY
    records has been improved.</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1684324800">- Update to release 9.16.41
  Bug Fixes:
  * When removing delegations from an opt-out range,
    empty-non-terminal NSEC3 records generated by those delegations
    were not cleaned up. This has been fixed.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1687348800">- Update to release 9.16.42
  Security Fixes:
  * The overmem cleaning process has been improved, to prevent the
    cache from significantly exceeding the configured
    max-cache-size limit. (CVE-2023-2828)
  * A query that prioritizes stale data over lookup triggers a
    fetch to refresh the stale data in cache. If the fetch is
    aborted for exceeding the recursion quota, it was possible for
    named to enter an infinite callback loop and crash due to stack
    overflow. This has been fixed. (CVE-2023-2911)
  Bug Fixes:
  * Previously, it was possible for a delegation from cache to be
    returned to the client after the stale-answer-client-timeout
    duration. This has been fixed.
  [bsc#1212544, bsc#1212567, jsc#SLE-24600]</changelog>
  <changelog author="dmueller@suse.com" date="1688644800">- rebuild bind-utils on libuv updates (bsc#1212090)</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1688990400">- Log named-checkconf output [bsc#1213049]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1689076800">- Add dnstap support
  [jsc#PED-4852]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1695124800">- Update to release 9.16.44
  Bug Fixes:
  * Processing already-queued queries received over TCP could cause
    an assertion failure, when the server was reconfigured at the
    same time or the cache was being flushed. This has been fixed.
  Security Fixes:
  * Previously, sending a specially crafted message over the
    control channel could cause the packet-parsing code to run out
    of available stack memory, causing named to terminate
    unexpectedly. This has been fixed. (CVE-2023-3341)
  [bsc#1215472]
- Switch to pkgconfig(libprotobuf-c) since this now contains the
  required protobuf-c binary</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1708084800">- Update to new Major Version 9.18.24.
  This has many enhancements, bug fixes and changes.
  Breaking Changes:
  * Some options have been removed and some have been deprecated
    and will be removed in the future.
    For a complete list, see:
    https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918
  Major Changes:
  * Support for securing DNS traffic using Transport Layer Security
    (TLS). TLS is used by both DNS-over-TLS (DoT) and
    DNS-over-HTTPS (DoH).
  * Support for zone transfers over TLS (XFR-over-TLS, XoT) for
    both incoming and outgoing zone transfers.
  * The dig tool is now able to send DoT queries (+tls option).
  * Support for OpenSSL 3.0 APIs was added.
  * dnssec-checkds, dnssec-coverage, dnssec-keymgr, which have been
    removed in favor of the dnssec-policy feature
  * python3-bind is deprecated and the subpackage has been removed
  * A number of utilities have been moved from /usr/sbin to
    /usr/bin:
    named-checkconf named-checkzone named-compilezone
    dnssec-dsfromkey dnssec-importkey dnssec-keyfromlabel
    dnssec-keygen dnssec-revoke dnssec-settime dnssec-signzone
    dnssec-verify dnssec-cds named-journalprint nsec3hash
  * The lib directory was renamed from 'named' to 'bind'
  For a complete list of changes, see:
  * Bind Release Notes
    https://bind9.readthedocs.io/en/v9.18.24/notes.html
  * The CHANGES file in the source RPM
  Security Fixes:
  * Validating DNS messages containing a lot of DNSSEC signatures
    could cause excessive CPU load, leading to a denial-of-service
    condition. This has been fixed. (CVE-2023-50387)
    [bsc#1219823]
  * Preparing an NSEC3 closest encloser proof could cause excessive
    CPU load, leading to a denial-of-service condition. This has
    been fixed. (CVE-2023-50868)
    [bsc#1219826]
  * Parsing DNS messages with many different names could cause
    excessive CPU load. This has been fixed. (CVE-2023-4408)
    [bsc#1219851]
  * Specific queries could cause named to crash with an assertion
    failure when nxdomain-redirect was enabled. This has been
    fixed. (CVE-2023-5517)
    [bsc#1219852]
  * A bad interaction between DNS64 and serve-stale could cause
    named to crash with an assertion failure, when both of these
    features were enabled. This has been fixed. (CVE-2023-5679)
    [bsc#1219853]
  * Query patterns that continuously triggered cache database
    maintenance could cause an excessive amount of memory to be
    allocated, exceeding max-cache-size and potentially leading to
    all available memory on the host running named being exhausted.
    This has been fixed. (CVE-2023-6516)
    [bsc#1219854]
  Packaging notes:
  * libnghttps2 added as BuildRequires for tls support
  * named-bootconf.diff patch is obsolete and has been removed
  [jsc#PED-7932]
- Update KillMode to 'control-group' in named.service to handle
  forked processes better.
  [bsc#1215755]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1721908800">- Update to release 9.18.28
  Bug Fixes:
  * Command-line options for IPv4-only (named -4) and IPv6-only
    (named -6) modes are now respected for zone primaries,
    also-notify, and parental-agents.
  * An RPZ response’s SOA record TTL was set to 1 instead of the
    SOA TTL, if add-soa was used. This has been fixed.
  * When a query related to zone maintenance (NOTIFY, SOA) timed
    out close to a view shutdown (triggered e.g. by rndc reload),
    named could crash with an assertion failure. This has been
    fixed.
  * The statistics channel counters that indicated the number of
    currently connected TCP IPv4/IPv6 clients were not properly
    adjusted in certain failure scenarios. This has been fixed.
  * Some servers that could not be reached due to EHOSTDOWN or
    ENETDOWN conditions were incorrectly prioritized during server
    selection. These are now properly handled as unreachable.
  * On some systems the libuv call may return an error code when
    sending a TCP reset for a connection, which triggers an
    assertion failure in named. This error condition is now dealt
    with in a more graceful manner, by logging the incident and
    shutting down the connection.
  * Changes to listen-on statements were ignored on reconfiguration
    unless the port or interface address was changed, making it
    impossible to change a related listener transport type. That
    issue has been fixed.
  * A bug in the keymgr code unintentionally slowed down some
    DNSSEC key rollovers. This has been fixed.
  * Some ISO 8601 durations were accepted erroneously, leading to
    shorter durations than expected. This has been fixed
  * A regression in cache-cleaning code enabled memory use to grow
    significantly more quickly than before, until the configured
    max-cache-size limit was reached. This has been fixed.
  * Using rndc flush inadvertently caused cache cleaning to become
    less effective. This could ultimately lead to the configured
    max-cache-size limit being exceeded and has now been fixed.
  * The logic for cleaning up expired cached DNS records was
    tweaked to be more aggressive. This change helps with enforcing
    max-cache-ttl and max-ncache-ttl in a timely manner.
  * It was possible to trigger a use-after-free assertion when the
    overmem cache cleaning was initiated. This has been fixed.
  New Features:
  * A new option signatures-jitter has been added to dnssec-policy
    to allow signature expirations to be spread out over a period
    of time.
  * The statistics channel now includes counters that indicate the
    number of currently connected TCP IPv4/IPv6 clients.
  * Added RESOLVER.ARPA to the built in empty zones.
  Feature Changes:
  * DNSSEC signatures that are not valid because the current time
    falls outside the signature inception and expiration dates are
    skipped instead of causing an immediate validation failure.
  Security Fixes:
  * A malicious DNS client that sent many queries over TCP but
    never read the responses could cause a server to respond slowly
    or not at all for other clients. This has been fixed.
    (CVE-2024-0760)
    [bsc#1228255]
  * It is possible to craft excessively large resource records
    sets, which have the effect of slowing down database
    processing. This has been addressed by adding a configurable
    limit to the number of records that can be stored per name and
    type in a cache or zone database. The default is 100, which can
    be tuned with the new max-records-per-type option.
  * It is possible to craft excessively large numbers of resource
    record types for a given owner name, which has the effect of
    slowing down database processing. This has been addressed by
    adding a configurable limit to the number of records that can
    be stored per name and type in a cache or zone database. The
    default is 100, which can be tuned with the new
    max-types-per-name option. (CVE-2024-1737)
    [bsc#1228256]
  * Validating DNS messages signed using the SIG(0) protocol (RFC
    2931) could cause excessive CPU load, leading to a
    denial-of-service condition. Support for SIG(0) message
    validation was removed from this version of named.
    (CVE-2024-1975)
    [bsc#1228257]
  * Due to a logic error, lookups that triggered serving stale data
    and required lookups in local authoritative zone data could
    have resulted in an assertion failure. This has been fixed.
  * Potential data races were found in our DoH implementation,
    related to HTTP/2 session object management and endpoints set
    object management after reconfiguration. These issues have been
    fixed.
  * When looking up the NS records of parent zones as part of
    looking up DS records, it was possible for named to trigger an
    assertion failure if serve-stale was enabled. This has been
    fixed. (CVE-2024-4076)
    [bsc#1228258]</changelog>
</package>
<package pkgid="a3e9a5f7e1c6512aceb46cc2c2b098b6685e97ae3eb84bb10567ec618c05d4a2" name="binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="2be95041c4b4db2a5df8ab7bb00f356f0d037b6110d71a93a70b38e3fd862e7b" name="binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="5eeaebd6268a6ca926fb5bab5b80556a81834fb3d65be374164a07712fea8232" name="binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="7863d7996e4148318c1040b069c34e1e6d7ddccc0bf98c07dc4e49fa74e84336" name="binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="fbefeed9cade6075b3b46007ce6e8034a4d9e12e74ce46d47e5dc742b1c086b9" name="binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="3e2721d07cfcdb901fad329d640aa9128510379b47de8f2d8151f71e857035f9" name="binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.52.1"/>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
  <changelog author="martin.liska@hey.com" date="1725969600">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1731931200">- Add loongarch64 as new target</changelog>
  <changelog author="jslaby@suse.cz" date="1732104000">- drop ld-relro.diff (relro is the default for some time)
  and it warns on avr spuriously (bsc#1233520)</changelog>
  <changelog author="matz@suse.com" date="1733745600">- Update to current 2.43.1 branch [PED-10254, PED-10306]:
  * s390 - Add arch15 instructions
  * various fixes from upstream: PR32153, PR32171, PR32189,
    PR32196, PR32191, PR32109, PR32372, PR32387
- Adjusted binutils-2.43-branch.diff.gz.
- Disable zstd-by-default again (needs adjustments in at least
  golang,llvm15,llvm17 first)
- Add binutils-fix-branch.diff.
- Check non-changing of flex/bison inputs only after applying
  branch and fix-branch diffs.</changelog>
</package>
<package pkgid="a977244a8df3721e370c49794387fb3ac674a1644096e2edb2fe2c1431787134" name="binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.52.1"/>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
  <changelog author="martin.liska@hey.com" date="1725969600">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1731931200">- Add loongarch64 as new target</changelog>
  <changelog author="jslaby@suse.cz" date="1732104000">- drop ld-relro.diff (relro is the default for some time)
  and it warns on avr spuriously (bsc#1233520)</changelog>
  <changelog author="matz@suse.com" date="1733745600">- Update to current 2.43.1 branch [PED-10254, PED-10306]:
  * s390 - Add arch15 instructions
  * various fixes from upstream: PR32153, PR32171, PR32189,
    PR32196, PR32191, PR32109, PR32372, PR32387
- Adjusted binutils-2.43-branch.diff.gz.
- Disable zstd-by-default again (needs adjustments in at least
  golang,llvm15,llvm17 first)
- Add binutils-fix-branch.diff.
- Check non-changing of flex/bison inputs only after applying
  branch and fix-branch diffs.</changelog>
</package>
<package pkgid="718702749b080bbad892068adfb1b205162dfbd8d90491f50a2499df50be57c2" name="binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.52.1"/>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
  <changelog author="martin.liska@hey.com" date="1725969600">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1731931200">- Add loongarch64 as new target</changelog>
  <changelog author="jslaby@suse.cz" date="1732104000">- drop ld-relro.diff (relro is the default for some time)
  and it warns on avr spuriously (bsc#1233520)</changelog>
  <changelog author="matz@suse.com" date="1733745600">- Update to current 2.43.1 branch [PED-10254, PED-10306]:
  * s390 - Add arch15 instructions
  * various fixes from upstream: PR32153, PR32171, PR32189,
    PR32196, PR32191, PR32109, PR32372, PR32387
- Adjusted binutils-2.43-branch.diff.gz.
- Disable zstd-by-default again (needs adjustments in at least
  golang,llvm15,llvm17 first)
- Add binutils-fix-branch.diff.
- Check non-changing of flex/bison inputs only after applying
  branch and fix-branch diffs.</changelog>
</package>
<package pkgid="f558b0eb0a598614bd7c47b82eea5e0f9f9c055b621d3dc9e63614f6f8e4813f" name="binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.52.1"/>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
  <changelog author="martin.liska@hey.com" date="1725969600">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1731931200">- Add loongarch64 as new target</changelog>
  <changelog author="jslaby@suse.cz" date="1732104000">- drop ld-relro.diff (relro is the default for some time)
  and it warns on avr spuriously (bsc#1233520)</changelog>
  <changelog author="matz@suse.com" date="1733745600">- Update to current 2.43.1 branch [PED-10254, PED-10306]:
  * s390 - Add arch15 instructions
  * various fixes from upstream: PR32153, PR32171, PR32189,
    PR32196, PR32191, PR32109, PR32372, PR32387
- Adjusted binutils-2.43-branch.diff.gz.
- Disable zstd-by-default again (needs adjustments in at least
  golang,llvm15,llvm17 first)
- Add binutils-fix-branch.diff.
- Check non-changing of flex/bison inputs only after applying
  branch and fix-branch diffs.</changelog>
</package>
<package pkgid="7614d58bdb196b8c3a9471f9d327e9c246d51c968b0becac1546d3e8c8ae9535" name="binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.52.1"/>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
  <changelog author="martin.liska@hey.com" date="1725969600">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1731931200">- Add loongarch64 as new target</changelog>
  <changelog author="jslaby@suse.cz" date="1732104000">- drop ld-relro.diff (relro is the default for some time)
  and it warns on avr spuriously (bsc#1233520)</changelog>
  <changelog author="matz@suse.com" date="1733745600">- Update to current 2.43.1 branch [PED-10254, PED-10306]:
  * s390 - Add arch15 instructions
  * various fixes from upstream: PR32153, PR32171, PR32189,
    PR32196, PR32191, PR32109, PR32372, PR32387
- Adjusted binutils-2.43-branch.diff.gz.
- Disable zstd-by-default again (needs adjustments in at least
  golang,llvm15,llvm17 first)
- Add binutils-fix-branch.diff.
- Check non-changing of flex/bison inputs only after applying
  branch and fix-branch diffs.</changelog>
</package>
<package pkgid="ef21f9fe36126f99924e84be9d918f0c27d423dcee4960990a03cc5510f7827f" name="binutils-devel" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="b853ddd409b792aa623def8b6f3de68090b15f18e42b6b47ff6dec7bf40c3a1a" name="binutils-devel" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="f11958931452755c70c42a927ec50957182f8d74f26683f08971e4652b2cb890" name="binutils-devel" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="7491cecfc3e3f95852d0fed6976e06ca375bb3a4de32117d97173e5cbb9f1cde" name="binutils-devel" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="46c32a6f12dc69d73120b0f375305a808fb3a80c6620fd0131ac7f22b44740c9" name="binutils-devel" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.52.1"/>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
  <changelog author="martin.liska@hey.com" date="1725969600">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1731931200">- Add loongarch64 as new target</changelog>
  <changelog author="jslaby@suse.cz" date="1732104000">- drop ld-relro.diff (relro is the default for some time)
  and it warns on avr spuriously (bsc#1233520)</changelog>
  <changelog author="matz@suse.com" date="1733745600">- Update to current 2.43.1 branch [PED-10254, PED-10306]:
  * s390 - Add arch15 instructions
  * various fixes from upstream: PR32153, PR32171, PR32189,
    PR32196, PR32191, PR32109, PR32372, PR32387
- Adjusted binutils-2.43-branch.diff.gz.
- Disable zstd-by-default again (needs adjustments in at least
  golang,llvm15,llvm17 first)
- Add binutils-fix-branch.diff.
- Check non-changing of flex/bison inputs only after applying
  branch and fix-branch diffs.</changelog>
</package>
<package pkgid="c9cfcc5bf4095ed2c90d250c0a1a9b2a808f6672a08fea2c5a15c877bf0a0272" name="binutils-devel" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.52.1"/>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
  <changelog author="martin.liska@hey.com" date="1725969600">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1731931200">- Add loongarch64 as new target</changelog>
  <changelog author="jslaby@suse.cz" date="1732104000">- drop ld-relro.diff (relro is the default for some time)
  and it warns on avr spuriously (bsc#1233520)</changelog>
  <changelog author="matz@suse.com" date="1733745600">- Update to current 2.43.1 branch [PED-10254, PED-10306]:
  * s390 - Add arch15 instructions
  * various fixes from upstream: PR32153, PR32171, PR32189,
    PR32196, PR32191, PR32109, PR32372, PR32387
- Adjusted binutils-2.43-branch.diff.gz.
- Disable zstd-by-default again (needs adjustments in at least
  golang,llvm15,llvm17 first)
- Add binutils-fix-branch.diff.
- Check non-changing of flex/bison inputs only after applying
  branch and fix-branch diffs.</changelog>
</package>
<package pkgid="e3ff5c4e0a3ad8eecc8988ae7665288e82d21e676c521634f376f2cc9c338c74" name="binutils-devel" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.52.1"/>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
  <changelog author="martin.liska@hey.com" date="1725969600">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1731931200">- Add loongarch64 as new target</changelog>
  <changelog author="jslaby@suse.cz" date="1732104000">- drop ld-relro.diff (relro is the default for some time)
  and it warns on avr spuriously (bsc#1233520)</changelog>
  <changelog author="matz@suse.com" date="1733745600">- Update to current 2.43.1 branch [PED-10254, PED-10306]:
  * s390 - Add arch15 instructions
  * various fixes from upstream: PR32153, PR32171, PR32189,
    PR32196, PR32191, PR32109, PR32372, PR32387
- Adjusted binutils-2.43-branch.diff.gz.
- Disable zstd-by-default again (needs adjustments in at least
  golang,llvm15,llvm17 first)
- Add binutils-fix-branch.diff.
- Check non-changing of flex/bison inputs only after applying
  branch and fix-branch diffs.</changelog>
</package>
<package pkgid="f161be0c918f8f0d3f5a408fa684e64d4b373fb5ba879ee4fca7e8a65d47a346" name="binutils-devel" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.52.1"/>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
  <changelog author="martin.liska@hey.com" date="1725969600">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1731931200">- Add loongarch64 as new target</changelog>
  <changelog author="jslaby@suse.cz" date="1732104000">- drop ld-relro.diff (relro is the default for some time)
  and it warns on avr spuriously (bsc#1233520)</changelog>
  <changelog author="matz@suse.com" date="1733745600">- Update to current 2.43.1 branch [PED-10254, PED-10306]:
  * s390 - Add arch15 instructions
  * various fixes from upstream: PR32153, PR32171, PR32189,
    PR32196, PR32191, PR32109, PR32372, PR32387
- Adjusted binutils-2.43-branch.diff.gz.
- Disable zstd-by-default again (needs adjustments in at least
  golang,llvm15,llvm17 first)
- Add binutils-fix-branch.diff.
- Check non-changing of flex/bison inputs only after applying
  branch and fix-branch diffs.</changelog>
</package>
<package pkgid="547cdab8009290324540ba3ed4ec990725ef56dae800b4a9029ee95ec5613511" name="binutils-devel-32bit" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="71bd5df87063600c091b1901c6290ef28e3cfa96281cd42a7392203cb293b451" name="binutils-devel-32bit" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.52.1"/>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
  <changelog author="martin.liska@hey.com" date="1725969600">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1731931200">- Add loongarch64 as new target</changelog>
  <changelog author="jslaby@suse.cz" date="1732104000">- drop ld-relro.diff (relro is the default for some time)
  and it warns on avr spuriously (bsc#1233520)</changelog>
  <changelog author="matz@suse.com" date="1733745600">- Update to current 2.43.1 branch [PED-10254, PED-10306]:
  * s390 - Add arch15 instructions
  * various fixes from upstream: PR32153, PR32171, PR32189,
    PR32196, PR32191, PR32109, PR32372, PR32387
- Adjusted binutils-2.43-branch.diff.gz.
- Disable zstd-by-default again (needs adjustments in at least
  golang,llvm15,llvm17 first)
- Add binutils-fix-branch.diff.
- Check non-changing of flex/bison inputs only after applying
  branch and fix-branch diffs.</changelog>
</package>
<package pkgid="334952286c6def7a1c8a9b1d3374913b6a4e603935f27e2fdb5d0eeacd8a75c4" name="binutils-gold" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="b2824ceab6ddd0833e75be7e346a3036b00af3ded372794b89077cff82c02149" name="binutils-gold" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="9178f31cd676f3d255f1ab15c7cf91a9427add4421d031599ee53352802435a6" name="binutils-gold" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="fea3bfa45b99dc1ea0bb50c1f29dd54805965c10e87b6ff7842375a83fea7eb8" name="binutils-gold" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="9d6eae354b8fa1eca4e4e6f66ab604710d758e108e20dc184650e24c075f72e1" name="binutils-gold" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.52.1"/>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
  <changelog author="martin.liska@hey.com" date="1725969600">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1731931200">- Add loongarch64 as new target</changelog>
  <changelog author="jslaby@suse.cz" date="1732104000">- drop ld-relro.diff (relro is the default for some time)
  and it warns on avr spuriously (bsc#1233520)</changelog>
  <changelog author="matz@suse.com" date="1733745600">- Update to current 2.43.1 branch [PED-10254, PED-10306]:
  * s390 - Add arch15 instructions
  * various fixes from upstream: PR32153, PR32171, PR32189,
    PR32196, PR32191, PR32109, PR32372, PR32387
- Adjusted binutils-2.43-branch.diff.gz.
- Disable zstd-by-default again (needs adjustments in at least
  golang,llvm15,llvm17 first)
- Add binutils-fix-branch.diff.
- Check non-changing of flex/bison inputs only after applying
  branch and fix-branch diffs.</changelog>
</package>
<package pkgid="da6c96e70981a973eccba76ee9970c4683d1facccdca03a6be95c339931f7489" name="binutils-gold" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.52.1"/>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
  <changelog author="martin.liska@hey.com" date="1725969600">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1731931200">- Add loongarch64 as new target</changelog>
  <changelog author="jslaby@suse.cz" date="1732104000">- drop ld-relro.diff (relro is the default for some time)
  and it warns on avr spuriously (bsc#1233520)</changelog>
  <changelog author="matz@suse.com" date="1733745600">- Update to current 2.43.1 branch [PED-10254, PED-10306]:
  * s390 - Add arch15 instructions
  * various fixes from upstream: PR32153, PR32171, PR32189,
    PR32196, PR32191, PR32109, PR32372, PR32387
- Adjusted binutils-2.43-branch.diff.gz.
- Disable zstd-by-default again (needs adjustments in at least
  golang,llvm15,llvm17 first)
- Add binutils-fix-branch.diff.
- Check non-changing of flex/bison inputs only after applying
  branch and fix-branch diffs.</changelog>
</package>
<package pkgid="554a9be5c2b09fa8cc0f846816d60b26159bcc68494ed81c6e322473cd3acd0f" name="binutils-gold" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.52.1"/>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
  <changelog author="martin.liska@hey.com" date="1725969600">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1731931200">- Add loongarch64 as new target</changelog>
  <changelog author="jslaby@suse.cz" date="1732104000">- drop ld-relro.diff (relro is the default for some time)
  and it warns on avr spuriously (bsc#1233520)</changelog>
  <changelog author="matz@suse.com" date="1733745600">- Update to current 2.43.1 branch [PED-10254, PED-10306]:
  * s390 - Add arch15 instructions
  * various fixes from upstream: PR32153, PR32171, PR32189,
    PR32196, PR32191, PR32109, PR32372, PR32387
- Adjusted binutils-2.43-branch.diff.gz.
- Disable zstd-by-default again (needs adjustments in at least
  golang,llvm15,llvm17 first)
- Add binutils-fix-branch.diff.
- Check non-changing of flex/bison inputs only after applying
  branch and fix-branch diffs.</changelog>
</package>
<package pkgid="1c400d8868cbd609f15888ced7eb3057f096430b80f54d2258fc04cbad7edacb" name="binutils-gold" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.52.1"/>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
  <changelog author="martin.liska@hey.com" date="1725969600">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1731931200">- Add loongarch64 as new target</changelog>
  <changelog author="jslaby@suse.cz" date="1732104000">- drop ld-relro.diff (relro is the default for some time)
  and it warns on avr spuriously (bsc#1233520)</changelog>
  <changelog author="matz@suse.com" date="1733745600">- Update to current 2.43.1 branch [PED-10254, PED-10306]:
  * s390 - Add arch15 instructions
  * various fixes from upstream: PR32153, PR32171, PR32189,
    PR32196, PR32191, PR32109, PR32372, PR32387
- Adjusted binutils-2.43-branch.diff.gz.
- Disable zstd-by-default again (needs adjustments in at least
  golang,llvm15,llvm17 first)
- Add binutils-fix-branch.diff.
- Check non-changing of flex/bison inputs only after applying
  branch and fix-branch diffs.</changelog>
</package>
<package pkgid="8385a9f9675224298dcbdcf4fa2ca8721ae48b733ea4925c9ec7e8095d2e4149" name="bmake" arch="aarch64">
  <version epoch="0" ver="20200606" rel="150400.3.3.2"/>
  <changelog author="mpluskal@suse.com" date="1447502400">- Update to 20151022
  * Makefile (MAKE_VERSION): 20151022
  * Add support for BSD/OS which lacks inttypes.h
    and really needs sys/param.h for sys/sysctl.h
    also 'type' is not a shell builtin.
  * var.c: eliminate uint32_t and need for inttypes.h
  * main.c: PrintOnError flush stdout before run .ERROR
  * parse.c: cope with _SC_PAGESIZE not being defined.
- For reso of changes see Changelog
- Tiny spec file polishing</changelog>
  <changelog author="mpluskal@suse.com" date="1451217600">- Update to 20151220
  * suff.c: re-initialize suffNull when clearing suffixes.
  * cond.c: CondCvtArg: avoid access beyond end of empty buffer.
  * meta.c: meta_oodate: use lstat(2) for checking link target in
    case it is a symlink.
  * var.c: avoid calling brk_string and Var_Export1 with empty
    strings.</changelog>
  <changelog author="mpluskal@suse.com" date="1458129600">- 20160307
  * Merge with NetBSD make, pick up
    + var.c: fix :ts\nnn to be octal by default.
    + meta.c: meta_finish() to cleanup memory.
    + meta.c: allow meta file for makeDepend if makefiles want it.
    + var.c: add knob to control handling of '$$' in :=
    + var.c: add .export-literal allows us to fix sys.clean-env.mk
    post the changes to Var_Subst. Var_Subst now takes flags, and
    does not consume '$$' in :=
    + ar.c: preserve '$$' in :=
    + parse.c: add .dinclude for handling included makefile like
    .depend
- Use correct package group</changelog>
  <changelog author="dap.darkness@gmail.com" date="1463313600">- 20160315
  * Merge with NetBSD make, pick up:
    + fix handling of archive members;
    + meta.c: treat missing Read file same as Write,
    in case we Delete it.
  * Rename variable to avoid interference
    with checks for ${MAKE_VERSION}.</changelog>
  <changelog author="dap.darkness@gmail.com" date="1464177600">- 20160512
  * Merge with NetBSD make, pick up
    + meta.c: ignore paths that match .MAKE.META.IGNORE_PATTERNS
    this is useful for gcov builds.
    + propagate errors from filemon(4).
    + remove use of non-standard types u_int etc.
    + meta.c: apply realpath() before matching against metaIgnorePaths
    + allow makefile to set .MAKE.JOBS
  * Makefile (PROG_NAME): use ${_MAKE_VERSION}</changelog>
  <changelog author="dap.darkness@gmail.com" date="1464264000">- Added bmake-MAKE_VERSION.diff to fix MAKE_VERSION variable
  that fixes mk-configure package configure error.</changelog>
  <changelog author="dap.darkness@gmail.com" date="1465905600">- 20160528
  * boot-strap, make-bootstrap.sh.in: Makefile uses _MAKE_VERSION
- Removed bmake-MAKE_VERSION.diff so.</changelog>
  <changelog author="rdodopoulos@suse.com" date="1473940800">- 20160818
  * its a neater number; pick up whitespace fixes to man page.
  * Merge with NetBSD make, pick up
    + meta.c: move handling of .MAKE.META.IGNORE_* to meta_ignore()
    so we can call it before adding entries to missingFiles.
    Thus we do not track files we have been told to ignore.
    + meta_oodate: apply .MAKE.META.IGNORE_FILTER (if defined) to
    pathnames, and skip if the expansion is empty.
    Useful for dirdeps.mk when checking DIRDEPS_CACHE.
    + meta.c: remove all missingFiles entries that match a deleted
    dir.
    + main.c: set .ERROR_CMD if possible.
    + dir.c: extend mtimes cache to others via cached_stat()
    + meta.c: missing filemon data is only relevant if we read a
    meta file.
    Also do not return oodate for a missing metafile if gn-&gt;path
    points to .CURDIR
    + cached_realpath(): avoid hitting filesystem more than necessary.
    + meta.c: refactor need_meta decision, add knobs for
    missing meta file and filemon data wrt out-of-datedness.</changelog>
  <changelog author="arichardson.kde@gmail.com" date="1479902400">- Install the .mk files as well
- Use allow-overriding-compiler-variables.patch instead overwriting the
  installed file with Linux.sys.mk</changelog>
  <changelog author="arichardson.kde@gmail.com" date="1479902401">- Update to 20160926
  * Makefile (_MAKE_VERSION): 20160926
    + Merge with NetBSD make, pick up
    + support for .DELETE_ON_ERROR: (remove targets that fail)
  * Makefile MAN: tweak .Dt to match ${PROG}</changelog>
  <changelog author="mpluskal@suse.com" date="1491393600">- Update to version 20170326
  * For full list of changes see provided Changelog
- Use https url for downloading</changelog>
  <changelog author="dziolkowski@suse.com" date="1495195200">- Update to version 20170510
  * For full list of changes see provided Changelog
- Fix allow-overriding-compiler-variables.patch to work with new version</changelog>
  <changelog author="dap.darkness@gmail.com" date="1497787200">- Let's skip optflags macro using to fix all builds.
  "-D_FORTIFY_SOURCE=0" for some reason doesn't fix x64.</changelog>
  <changelog author="dimstar@opensuse.org" date="1500379200">- Add bmake-strlcpy-explicit.patch: ensure strlcpy is not defined
  implicit.
- Do not de-FORTIFY the sources, use proper optflags. Above patch
  ensures strlcpy is not implicit declared.</changelog>
  <changelog author="dap.darkness@gmail.com" date="1500465600">- bmake-strlcpy-explicit.patch was replaced by upstream's one.
- Update to version 20170711:
  * main.c: refactor to reduce size of main function.
    add -v option to always fully expand values.
  * meta.c: ensure command output in meta file has ending newline
    even when filemon not being used.
    When matching ${.MAKE.META.IGNORE_PATTERNS} do not use
    pathname via ':L' since any ':' in pathname breaks that.
    Instead set a '${.p.}' to pathname in the target context and
    use that.</changelog>
  <changelog author="dap.darkness@gmail.com" date="1531483200">- Removed already upstreamed bmake-strlcpy-explicit.patch.
- Added bmake-env-script-interpreter.diff.
- Update to version 20180512:
  * job.c: skip polling job token pipe
  * parse.c: be more cautious about detecting depenency line
    rather than sysV style include.
  * parse.c: avoid calling sysconf for every call to loadfile
  * var.c: Var_Set handle NULL value anytime.
  * parse.c: do not treat .info as warning with -W
  * var.c: Var_Append use Var_Set if var not previously set
    so that VAR_CMD is handled correctly.
    Add a suitable unit-test.
  * var.c: do not append to variable set on command line
    add unit-test to catch this.
  * main.c: ignore empty MAKEOBJDIR
  * meta.c: if target is in subdir we only need subdir name in
    meta_name.
  * compat.c: pass SIGINT etc onto child and wait for it to exit
    before we self-terminate.
  * aclocal.m4: use AC_LINK_IFELSE for AC_C___ATTRIBUTE__
    since AC_TRY_COMPILE puts input inside main()
    which upsets modern compilers.
  * Makefile.config.in:
    make @prefix@ @machine*@ and @default_sys_path@ defaults.
  * unit-tests/dotwait.mk: redirect stderr through pipe for more
    consistent result on some platforms.
  * machine.sh: entry for AIX
  * VERSION (_MAKE_VERSION): Move the setting of _MAKE_VERSION
    to a file that can be included by configure as well as make.
    This allows configure to set set _MAKE_VERSION in make-bootstrap.sh</changelog>
  <changelog author="mpluskal@suse.com" date="1568203200">- Update to version 20181221:
  * For full list of changes see provided Changelog</changelog>
  <changelog author="dap.darkness@gmail.com" date="1592136000">- Updated allow-overriding-compiler-variables.patch.
- Update to version 20200606:
  * make.1: cleanup
  * Makefile: fix depends for main.o which broke MAKE_VERSION
  * dir.c: cached_stats - don't confuse stat and lstat results.
  * var.c: add :Or for reverse sort.
  * configure.in: add AC_PROG_CC_C99 for mipspro compiler
    also if --with-filemon= specifies path to filemon.h
    set use_filemon=dev
  * dirname.c: remove include of namespace.h
  * modified dollar tests to avoid shell dependencies
  * new tests for .INCLUDEFROM
  * unit-tests/dollar.mk: tweak  '1 dollar literal' test
    to not depend so much on shell behavior
  * unit test for dollar handling
  * str.c: empty string does not match % pattern
    plus unit-test changes
  * var.c: import handling of old sysV style modifier using '%'
  * str.c: refactor brk_string
  * unit-tests: add test case for lazy conditions
  * configure.in: use_makefile=no for cygwin et al.
    case insensitive filesystems just don't work if both
    makefile and Makefile exist.
  * meta.c: meta_oodate, CHECK_VALID_META is too aggressive for CMD
    a blank command is perfectly valid.
  * make.h: extern debug_file
  * meta.c: meta_oodate, check for corrupted meta file
    earlier and more often.
  * boot-strap: unset MAKEFLAGS
  * meta.c: meta_compat_parent check for USE_FILEMON
    patch from Soeren Tempel
  * meta.c: fix compat mode, need to call meta_job_output()
  * job.c: extra fds for meta mode not needed if using filemon_dev
  * meta.c: avoid passing NULL to filemon_*() when meta_needed()
    returns FALSE.
  * filemon/filemon_{dev,ktrace}.c: allow selection of
    filemon implementation.  filemon_dev.c uses the kernel module
    while filemon_ktrace.c leverages the fktrace api available in
    NetBSD.  filemon_ktrace.c can hopefully form the basis for
    adding support for other tracing mechanisms such as strace on
    Linux.
  * meta.c: when target is out-of-date per normal make rules
    record value of .OODATE in meta file.
  * parse.c: don't pass NULL to realpath(3)
    some versions cannot handle it.
  * parse.c: ParseDoDependency: free paths rather than assert
  * configure.in: add --without-makefile to avoid generating
    makefile and make-bootstrap.sh
  * include Makefile.inc if it exists
  * Use Makefile and Makefile.config.in in unit-tests
    so we can use just: make obj &amp;&amp; make &amp;&amp; make test
    when bmake is already available.
    We add --without-makefile to CONFIGURE_ARGS in this case.
  * tweak bsd.after-import.mk (captures Makefile.config etc
    after import to FreeBSD for example) to cope with all the above.
  * parse.c: ParseVErrorInternal use .PARSEDIR
    and apply if relative, and then use .PARSEFILE
    for consistent result.
  * parse.c: ParseVErrorInternal use .CURDIR if .PARSEDIR
    is relative
  * var.c: avoid SEGFAULT in .unexport-env
    when MAKELEVEL is not set
  * fix for unit-tests/varquote.mk on Debian
  * var.c: add :q
  * dir.c: cleanup caching of stats
  * Makefile.config.in: use += where it makes sense.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1623844800">- Update bmake-env-script-interpreter.diff to switch to interpreter
  to python3.</changelog>
  <changelog author="eich@suse.com" date="1732104000">- Fix variable used in rules to build shared libs on Linux
  The form: `-Wl,"-soname lib${LIB}.so.${SHLIB_MAJOR}"`
  caused an error message:
  Error: unable to disambiguate: -soname libelf.so.1 \
  (did you mean --soname libelf.so.1 ?)
  Instead it should be:
  `-Wl,"-soname,lib${LIB}.so.${SHLIB_MAJOR}"`
  as it is in the latest version of bmake. (bsc#1233508)
  Fix-variable-used-in-rules-to-build-shared-libs-on-Linux.patch</changelog>
</package>
<package pkgid="4f62b5c1b633d85374663caab4e94a791a9c62f10a66709a0ea2fc2d1eb53128" name="bmake" arch="ppc64le">
  <version epoch="0" ver="20200606" rel="150400.3.3.2"/>
  <changelog author="mpluskal@suse.com" date="1447502400">- Update to 20151022
  * Makefile (MAKE_VERSION): 20151022
  * Add support for BSD/OS which lacks inttypes.h
    and really needs sys/param.h for sys/sysctl.h
    also 'type' is not a shell builtin.
  * var.c: eliminate uint32_t and need for inttypes.h
  * main.c: PrintOnError flush stdout before run .ERROR
  * parse.c: cope with _SC_PAGESIZE not being defined.
- For reso of changes see Changelog
- Tiny spec file polishing</changelog>
  <changelog author="mpluskal@suse.com" date="1451217600">- Update to 20151220
  * suff.c: re-initialize suffNull when clearing suffixes.
  * cond.c: CondCvtArg: avoid access beyond end of empty buffer.
  * meta.c: meta_oodate: use lstat(2) for checking link target in
    case it is a symlink.
  * var.c: avoid calling brk_string and Var_Export1 with empty
    strings.</changelog>
  <changelog author="mpluskal@suse.com" date="1458129600">- 20160307
  * Merge with NetBSD make, pick up
    + var.c: fix :ts\nnn to be octal by default.
    + meta.c: meta_finish() to cleanup memory.
    + meta.c: allow meta file for makeDepend if makefiles want it.
    + var.c: add knob to control handling of '$$' in :=
    + var.c: add .export-literal allows us to fix sys.clean-env.mk
    post the changes to Var_Subst. Var_Subst now takes flags, and
    does not consume '$$' in :=
    + ar.c: preserve '$$' in :=
    + parse.c: add .dinclude for handling included makefile like
    .depend
- Use correct package group</changelog>
  <changelog author="dap.darkness@gmail.com" date="1463313600">- 20160315
  * Merge with NetBSD make, pick up:
    + fix handling of archive members;
    + meta.c: treat missing Read file same as Write,
    in case we Delete it.
  * Rename variable to avoid interference
    with checks for ${MAKE_VERSION}.</changelog>
  <changelog author="dap.darkness@gmail.com" date="1464177600">- 20160512
  * Merge with NetBSD make, pick up
    + meta.c: ignore paths that match .MAKE.META.IGNORE_PATTERNS
    this is useful for gcov builds.
    + propagate errors from filemon(4).
    + remove use of non-standard types u_int etc.
    + meta.c: apply realpath() before matching against metaIgnorePaths
    + allow makefile to set .MAKE.JOBS
  * Makefile (PROG_NAME): use ${_MAKE_VERSION}</changelog>
  <changelog author="dap.darkness@gmail.com" date="1464264000">- Added bmake-MAKE_VERSION.diff to fix MAKE_VERSION variable
  that fixes mk-configure package configure error.</changelog>
  <changelog author="dap.darkness@gmail.com" date="1465905600">- 20160528
  * boot-strap, make-bootstrap.sh.in: Makefile uses _MAKE_VERSION
- Removed bmake-MAKE_VERSION.diff so.</changelog>
  <changelog author="rdodopoulos@suse.com" date="1473940800">- 20160818
  * its a neater number; pick up whitespace fixes to man page.
  * Merge with NetBSD make, pick up
    + meta.c: move handling of .MAKE.META.IGNORE_* to meta_ignore()
    so we can call it before adding entries to missingFiles.
    Thus we do not track files we have been told to ignore.
    + meta_oodate: apply .MAKE.META.IGNORE_FILTER (if defined) to
    pathnames, and skip if the expansion is empty.
    Useful for dirdeps.mk when checking DIRDEPS_CACHE.
    + meta.c: remove all missingFiles entries that match a deleted
    dir.
    + main.c: set .ERROR_CMD if possible.
    + dir.c: extend mtimes cache to others via cached_stat()
    + meta.c: missing filemon data is only relevant if we read a
    meta file.
    Also do not return oodate for a missing metafile if gn-&gt;path
    points to .CURDIR
    + cached_realpath(): avoid hitting filesystem more than necessary.
    + meta.c: refactor need_meta decision, add knobs for
    missing meta file and filemon data wrt out-of-datedness.</changelog>
  <changelog author="arichardson.kde@gmail.com" date="1479902400">- Install the .mk files as well
- Use allow-overriding-compiler-variables.patch instead overwriting the
  installed file with Linux.sys.mk</changelog>
  <changelog author="arichardson.kde@gmail.com" date="1479902401">- Update to 20160926
  * Makefile (_MAKE_VERSION): 20160926
    + Merge with NetBSD make, pick up
    + support for .DELETE_ON_ERROR: (remove targets that fail)
  * Makefile MAN: tweak .Dt to match ${PROG}</changelog>
  <changelog author="mpluskal@suse.com" date="1491393600">- Update to version 20170326
  * For full list of changes see provided Changelog
- Use https url for downloading</changelog>
  <changelog author="dziolkowski@suse.com" date="1495195200">- Update to version 20170510
  * For full list of changes see provided Changelog
- Fix allow-overriding-compiler-variables.patch to work with new version</changelog>
  <changelog author="dap.darkness@gmail.com" date="1497787200">- Let's skip optflags macro using to fix all builds.
  "-D_FORTIFY_SOURCE=0" for some reason doesn't fix x64.</changelog>
  <changelog author="dimstar@opensuse.org" date="1500379200">- Add bmake-strlcpy-explicit.patch: ensure strlcpy is not defined
  implicit.
- Do not de-FORTIFY the sources, use proper optflags. Above patch
  ensures strlcpy is not implicit declared.</changelog>
  <changelog author="dap.darkness@gmail.com" date="1500465600">- bmake-strlcpy-explicit.patch was replaced by upstream's one.
- Update to version 20170711:
  * main.c: refactor to reduce size of main function.
    add -v option to always fully expand values.
  * meta.c: ensure command output in meta file has ending newline
    even when filemon not being used.
    When matching ${.MAKE.META.IGNORE_PATTERNS} do not use
    pathname via ':L' since any ':' in pathname breaks that.
    Instead set a '${.p.}' to pathname in the target context and
    use that.</changelog>
  <changelog author="dap.darkness@gmail.com" date="1531483200">- Removed already upstreamed bmake-strlcpy-explicit.patch.
- Added bmake-env-script-interpreter.diff.
- Update to version 20180512:
  * job.c: skip polling job token pipe
  * parse.c: be more cautious about detecting depenency line
    rather than sysV style include.
  * parse.c: avoid calling sysconf for every call to loadfile
  * var.c: Var_Set handle NULL value anytime.
  * parse.c: do not treat .info as warning with -W
  * var.c: Var_Append use Var_Set if var not previously set
    so that VAR_CMD is handled correctly.
    Add a suitable unit-test.
  * var.c: do not append to variable set on command line
    add unit-test to catch this.
  * main.c: ignore empty MAKEOBJDIR
  * meta.c: if target is in subdir we only need subdir name in
    meta_name.
  * compat.c: pass SIGINT etc onto child and wait for it to exit
    before we self-terminate.
  * aclocal.m4: use AC_LINK_IFELSE for AC_C___ATTRIBUTE__
    since AC_TRY_COMPILE puts input inside main()
    which upsets modern compilers.
  * Makefile.config.in:
    make @prefix@ @machine*@ and @default_sys_path@ defaults.
  * unit-tests/dotwait.mk: redirect stderr through pipe for more
    consistent result on some platforms.
  * machine.sh: entry for AIX
  * VERSION (_MAKE_VERSION): Move the setting of _MAKE_VERSION
    to a file that can be included by configure as well as make.
    This allows configure to set set _MAKE_VERSION in make-bootstrap.sh</changelog>
  <changelog author="mpluskal@suse.com" date="1568203200">- Update to version 20181221:
  * For full list of changes see provided Changelog</changelog>
  <changelog author="dap.darkness@gmail.com" date="1592136000">- Updated allow-overriding-compiler-variables.patch.
- Update to version 20200606:
  * make.1: cleanup
  * Makefile: fix depends for main.o which broke MAKE_VERSION
  * dir.c: cached_stats - don't confuse stat and lstat results.
  * var.c: add :Or for reverse sort.
  * configure.in: add AC_PROG_CC_C99 for mipspro compiler
    also if --with-filemon= specifies path to filemon.h
    set use_filemon=dev
  * dirname.c: remove include of namespace.h
  * modified dollar tests to avoid shell dependencies
  * new tests for .INCLUDEFROM
  * unit-tests/dollar.mk: tweak  '1 dollar literal' test
    to not depend so much on shell behavior
  * unit test for dollar handling
  * str.c: empty string does not match % pattern
    plus unit-test changes
  * var.c: import handling of old sysV style modifier using '%'
  * str.c: refactor brk_string
  * unit-tests: add test case for lazy conditions
  * configure.in: use_makefile=no for cygwin et al.
    case insensitive filesystems just don't work if both
    makefile and Makefile exist.
  * meta.c: meta_oodate, CHECK_VALID_META is too aggressive for CMD
    a blank command is perfectly valid.
  * make.h: extern debug_file
  * meta.c: meta_oodate, check for corrupted meta file
    earlier and more often.
  * boot-strap: unset MAKEFLAGS
  * meta.c: meta_compat_parent check for USE_FILEMON
    patch from Soeren Tempel
  * meta.c: fix compat mode, need to call meta_job_output()
  * job.c: extra fds for meta mode not needed if using filemon_dev
  * meta.c: avoid passing NULL to filemon_*() when meta_needed()
    returns FALSE.
  * filemon/filemon_{dev,ktrace}.c: allow selection of
    filemon implementation.  filemon_dev.c uses the kernel module
    while filemon_ktrace.c leverages the fktrace api available in
    NetBSD.  filemon_ktrace.c can hopefully form the basis for
    adding support for other tracing mechanisms such as strace on
    Linux.
  * meta.c: when target is out-of-date per normal make rules
    record value of .OODATE in meta file.
  * parse.c: don't pass NULL to realpath(3)
    some versions cannot handle it.
  * parse.c: ParseDoDependency: free paths rather than assert
  * configure.in: add --without-makefile to avoid generating
    makefile and make-bootstrap.sh
  * include Makefile.inc if it exists
  * Use Makefile and Makefile.config.in in unit-tests
    so we can use just: make obj &amp;&amp; make &amp;&amp; make test
    when bmake is already available.
    We add --without-makefile to CONFIGURE_ARGS in this case.
  * tweak bsd.after-import.mk (captures Makefile.config etc
    after import to FreeBSD for example) to cope with all the above.
  * parse.c: ParseVErrorInternal use .PARSEDIR
    and apply if relative, and then use .PARSEFILE
    for consistent result.
  * parse.c: ParseVErrorInternal use .CURDIR if .PARSEDIR
    is relative
  * var.c: avoid SEGFAULT in .unexport-env
    when MAKELEVEL is not set
  * fix for unit-tests/varquote.mk on Debian
  * var.c: add :q
  * dir.c: cleanup caching of stats
  * Makefile.config.in: use += where it makes sense.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1623844800">- Update bmake-env-script-interpreter.diff to switch to interpreter
  to python3.</changelog>
  <changelog author="eich@suse.com" date="1732104000">- Fix variable used in rules to build shared libs on Linux
  The form: `-Wl,"-soname lib${LIB}.so.${SHLIB_MAJOR}"`
  caused an error message:
  Error: unable to disambiguate: -soname libelf.so.1 \
  (did you mean --soname libelf.so.1 ?)
  Instead it should be:
  `-Wl,"-soname,lib${LIB}.so.${SHLIB_MAJOR}"`
  as it is in the latest version of bmake. (bsc#1233508)
  Fix-variable-used-in-rules-to-build-shared-libs-on-Linux.patch</changelog>
</package>
<package pkgid="cf6bd14b0f3571587ccfa6ab4835eb80ed5281851f04a26ac2115775ef0ed0bb" name="bmake" arch="s390x">
  <version epoch="0" ver="20200606" rel="150400.3.3.2"/>
  <changelog author="mpluskal@suse.com" date="1447502400">- Update to 20151022
  * Makefile (MAKE_VERSION): 20151022
  * Add support for BSD/OS which lacks inttypes.h
    and really needs sys/param.h for sys/sysctl.h
    also 'type' is not a shell builtin.
  * var.c: eliminate uint32_t and need for inttypes.h
  * main.c: PrintOnError flush stdout before run .ERROR
  * parse.c: cope with _SC_PAGESIZE not being defined.
- For reso of changes see Changelog
- Tiny spec file polishing</changelog>
  <changelog author="mpluskal@suse.com" date="1451217600">- Update to 20151220
  * suff.c: re-initialize suffNull when clearing suffixes.
  * cond.c: CondCvtArg: avoid access beyond end of empty buffer.
  * meta.c: meta_oodate: use lstat(2) for checking link target in
    case it is a symlink.
  * var.c: avoid calling brk_string and Var_Export1 with empty
    strings.</changelog>
  <changelog author="mpluskal@suse.com" date="1458129600">- 20160307
  * Merge with NetBSD make, pick up
    + var.c: fix :ts\nnn to be octal by default.
    + meta.c: meta_finish() to cleanup memory.
    + meta.c: allow meta file for makeDepend if makefiles want it.
    + var.c: add knob to control handling of '$$' in :=
    + var.c: add .export-literal allows us to fix sys.clean-env.mk
    post the changes to Var_Subst. Var_Subst now takes flags, and
    does not consume '$$' in :=
    + ar.c: preserve '$$' in :=
    + parse.c: add .dinclude for handling included makefile like
    .depend
- Use correct package group</changelog>
  <changelog author="dap.darkness@gmail.com" date="1463313600">- 20160315
  * Merge with NetBSD make, pick up:
    + fix handling of archive members;
    + meta.c: treat missing Read file same as Write,
    in case we Delete it.
  * Rename variable to avoid interference
    with checks for ${MAKE_VERSION}.</changelog>
  <changelog author="dap.darkness@gmail.com" date="1464177600">- 20160512
  * Merge with NetBSD make, pick up
    + meta.c: ignore paths that match .MAKE.META.IGNORE_PATTERNS
    this is useful for gcov builds.
    + propagate errors from filemon(4).
    + remove use of non-standard types u_int etc.
    + meta.c: apply realpath() before matching against metaIgnorePaths
    + allow makefile to set .MAKE.JOBS
  * Makefile (PROG_NAME): use ${_MAKE_VERSION}</changelog>
  <changelog author="dap.darkness@gmail.com" date="1464264000">- Added bmake-MAKE_VERSION.diff to fix MAKE_VERSION variable
  that fixes mk-configure package configure error.</changelog>
  <changelog author="dap.darkness@gmail.com" date="1465905600">- 20160528
  * boot-strap, make-bootstrap.sh.in: Makefile uses _MAKE_VERSION
- Removed bmake-MAKE_VERSION.diff so.</changelog>
  <changelog author="rdodopoulos@suse.com" date="1473940800">- 20160818
  * its a neater number; pick up whitespace fixes to man page.
  * Merge with NetBSD make, pick up
    + meta.c: move handling of .MAKE.META.IGNORE_* to meta_ignore()
    so we can call it before adding entries to missingFiles.
    Thus we do not track files we have been told to ignore.
    + meta_oodate: apply .MAKE.META.IGNORE_FILTER (if defined) to
    pathnames, and skip if the expansion is empty.
    Useful for dirdeps.mk when checking DIRDEPS_CACHE.
    + meta.c: remove all missingFiles entries that match a deleted
    dir.
    + main.c: set .ERROR_CMD if possible.
    + dir.c: extend mtimes cache to others via cached_stat()
    + meta.c: missing filemon data is only relevant if we read a
    meta file.
    Also do not return oodate for a missing metafile if gn-&gt;path
    points to .CURDIR
    + cached_realpath(): avoid hitting filesystem more than necessary.
    + meta.c: refactor need_meta decision, add knobs for
    missing meta file and filemon data wrt out-of-datedness.</changelog>
  <changelog author="arichardson.kde@gmail.com" date="1479902400">- Install the .mk files as well
- Use allow-overriding-compiler-variables.patch instead overwriting the
  installed file with Linux.sys.mk</changelog>
  <changelog author="arichardson.kde@gmail.com" date="1479902401">- Update to 20160926
  * Makefile (_MAKE_VERSION): 20160926
    + Merge with NetBSD make, pick up
    + support for .DELETE_ON_ERROR: (remove targets that fail)
  * Makefile MAN: tweak .Dt to match ${PROG}</changelog>
  <changelog author="mpluskal@suse.com" date="1491393600">- Update to version 20170326
  * For full list of changes see provided Changelog
- Use https url for downloading</changelog>
  <changelog author="dziolkowski@suse.com" date="1495195200">- Update to version 20170510
  * For full list of changes see provided Changelog
- Fix allow-overriding-compiler-variables.patch to work with new version</changelog>
  <changelog author="dap.darkness@gmail.com" date="1497787200">- Let's skip optflags macro using to fix all builds.
  "-D_FORTIFY_SOURCE=0" for some reason doesn't fix x64.</changelog>
  <changelog author="dimstar@opensuse.org" date="1500379200">- Add bmake-strlcpy-explicit.patch: ensure strlcpy is not defined
  implicit.
- Do not de-FORTIFY the sources, use proper optflags. Above patch
  ensures strlcpy is not implicit declared.</changelog>
  <changelog author="dap.darkness@gmail.com" date="1500465600">- bmake-strlcpy-explicit.patch was replaced by upstream's one.
- Update to version 20170711:
  * main.c: refactor to reduce size of main function.
    add -v option to always fully expand values.
  * meta.c: ensure command output in meta file has ending newline
    even when filemon not being used.
    When matching ${.MAKE.META.IGNORE_PATTERNS} do not use
    pathname via ':L' since any ':' in pathname breaks that.
    Instead set a '${.p.}' to pathname in the target context and
    use that.</changelog>
  <changelog author="dap.darkness@gmail.com" date="1531483200">- Removed already upstreamed bmake-strlcpy-explicit.patch.
- Added bmake-env-script-interpreter.diff.
- Update to version 20180512:
  * job.c: skip polling job token pipe
  * parse.c: be more cautious about detecting depenency line
    rather than sysV style include.
  * parse.c: avoid calling sysconf for every call to loadfile
  * var.c: Var_Set handle NULL value anytime.
  * parse.c: do not treat .info as warning with -W
  * var.c: Var_Append use Var_Set if var not previously set
    so that VAR_CMD is handled correctly.
    Add a suitable unit-test.
  * var.c: do not append to variable set on command line
    add unit-test to catch this.
  * main.c: ignore empty MAKEOBJDIR
  * meta.c: if target is in subdir we only need subdir name in
    meta_name.
  * compat.c: pass SIGINT etc onto child and wait for it to exit
    before we self-terminate.
  * aclocal.m4: use AC_LINK_IFELSE for AC_C___ATTRIBUTE__
    since AC_TRY_COMPILE puts input inside main()
    which upsets modern compilers.
  * Makefile.config.in:
    make @prefix@ @machine*@ and @default_sys_path@ defaults.
  * unit-tests/dotwait.mk: redirect stderr through pipe for more
    consistent result on some platforms.
  * machine.sh: entry for AIX
  * VERSION (_MAKE_VERSION): Move the setting of _MAKE_VERSION
    to a file that can be included by configure as well as make.
    This allows configure to set set _MAKE_VERSION in make-bootstrap.sh</changelog>
  <changelog author="mpluskal@suse.com" date="1568203200">- Update to version 20181221:
  * For full list of changes see provided Changelog</changelog>
  <changelog author="dap.darkness@gmail.com" date="1592136000">- Updated allow-overriding-compiler-variables.patch.
- Update to version 20200606:
  * make.1: cleanup
  * Makefile: fix depends for main.o which broke MAKE_VERSION
  * dir.c: cached_stats - don't confuse stat and lstat results.
  * var.c: add :Or for reverse sort.
  * configure.in: add AC_PROG_CC_C99 for mipspro compiler
    also if --with-filemon= specifies path to filemon.h
    set use_filemon=dev
  * dirname.c: remove include of namespace.h
  * modified dollar tests to avoid shell dependencies
  * new tests for .INCLUDEFROM
  * unit-tests/dollar.mk: tweak  '1 dollar literal' test
    to not depend so much on shell behavior
  * unit test for dollar handling
  * str.c: empty string does not match % pattern
    plus unit-test changes
  * var.c: import handling of old sysV style modifier using '%'
  * str.c: refactor brk_string
  * unit-tests: add test case for lazy conditions
  * configure.in: use_makefile=no for cygwin et al.
    case insensitive filesystems just don't work if both
    makefile and Makefile exist.
  * meta.c: meta_oodate, CHECK_VALID_META is too aggressive for CMD
    a blank command is perfectly valid.
  * make.h: extern debug_file
  * meta.c: meta_oodate, check for corrupted meta file
    earlier and more often.
  * boot-strap: unset MAKEFLAGS
  * meta.c: meta_compat_parent check for USE_FILEMON
    patch from Soeren Tempel
  * meta.c: fix compat mode, need to call meta_job_output()
  * job.c: extra fds for meta mode not needed if using filemon_dev
  * meta.c: avoid passing NULL to filemon_*() when meta_needed()
    returns FALSE.
  * filemon/filemon_{dev,ktrace}.c: allow selection of
    filemon implementation.  filemon_dev.c uses the kernel module
    while filemon_ktrace.c leverages the fktrace api available in
    NetBSD.  filemon_ktrace.c can hopefully form the basis for
    adding support for other tracing mechanisms such as strace on
    Linux.
  * meta.c: when target is out-of-date per normal make rules
    record value of .OODATE in meta file.
  * parse.c: don't pass NULL to realpath(3)
    some versions cannot handle it.
  * parse.c: ParseDoDependency: free paths rather than assert
  * configure.in: add --without-makefile to avoid generating
    makefile and make-bootstrap.sh
  * include Makefile.inc if it exists
  * Use Makefile and Makefile.config.in in unit-tests
    so we can use just: make obj &amp;&amp; make &amp;&amp; make test
    when bmake is already available.
    We add --without-makefile to CONFIGURE_ARGS in this case.
  * tweak bsd.after-import.mk (captures Makefile.config etc
    after import to FreeBSD for example) to cope with all the above.
  * parse.c: ParseVErrorInternal use .PARSEDIR
    and apply if relative, and then use .PARSEFILE
    for consistent result.
  * parse.c: ParseVErrorInternal use .CURDIR if .PARSEDIR
    is relative
  * var.c: avoid SEGFAULT in .unexport-env
    when MAKELEVEL is not set
  * fix for unit-tests/varquote.mk on Debian
  * var.c: add :q
  * dir.c: cleanup caching of stats
  * Makefile.config.in: use += where it makes sense.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1623844800">- Update bmake-env-script-interpreter.diff to switch to interpreter
  to python3.</changelog>
  <changelog author="eich@suse.com" date="1732104000">- Fix variable used in rules to build shared libs on Linux
  The form: `-Wl,"-soname lib${LIB}.so.${SHLIB_MAJOR}"`
  caused an error message:
  Error: unable to disambiguate: -soname libelf.so.1 \
  (did you mean --soname libelf.so.1 ?)
  Instead it should be:
  `-Wl,"-soname,lib${LIB}.so.${SHLIB_MAJOR}"`
  as it is in the latest version of bmake. (bsc#1233508)
  Fix-variable-used-in-rules-to-build-shared-libs-on-Linux.patch</changelog>
</package>
<package pkgid="5d82ac62d0dfacde3e272a173da4301ab7f9df2068e844eb84fec13f99f282dc" name="bmake" arch="src">
  <version epoch="0" ver="20200606" rel="150400.3.3.2"/>
  <changelog author="mpluskal@suse.com" date="1447502400">- Update to 20151022
  * Makefile (MAKE_VERSION): 20151022
  * Add support for BSD/OS which lacks inttypes.h
    and really needs sys/param.h for sys/sysctl.h
    also 'type' is not a shell builtin.
  * var.c: eliminate uint32_t and need for inttypes.h
  * main.c: PrintOnError flush stdout before run .ERROR
  * parse.c: cope with _SC_PAGESIZE not being defined.
- For reso of changes see Changelog
- Tiny spec file polishing</changelog>
  <changelog author="mpluskal@suse.com" date="1451217600">- Update to 20151220
  * suff.c: re-initialize suffNull when clearing suffixes.
  * cond.c: CondCvtArg: avoid access beyond end of empty buffer.
  * meta.c: meta_oodate: use lstat(2) for checking link target in
    case it is a symlink.
  * var.c: avoid calling brk_string and Var_Export1 with empty
    strings.</changelog>
  <changelog author="mpluskal@suse.com" date="1458129600">- 20160307
  * Merge with NetBSD make, pick up
    + var.c: fix :ts\nnn to be octal by default.
    + meta.c: meta_finish() to cleanup memory.
    + meta.c: allow meta file for makeDepend if makefiles want it.
    + var.c: add knob to control handling of '$$' in :=
    + var.c: add .export-literal allows us to fix sys.clean-env.mk
    post the changes to Var_Subst. Var_Subst now takes flags, and
    does not consume '$$' in :=
    + ar.c: preserve '$$' in :=
    + parse.c: add .dinclude for handling included makefile like
    .depend
- Use correct package group</changelog>
  <changelog author="dap.darkness@gmail.com" date="1463313600">- 20160315
  * Merge with NetBSD make, pick up:
    + fix handling of archive members;
    + meta.c: treat missing Read file same as Write,
    in case we Delete it.
  * Rename variable to avoid interference
    with checks for ${MAKE_VERSION}.</changelog>
  <changelog author="dap.darkness@gmail.com" date="1464177600">- 20160512
  * Merge with NetBSD make, pick up
    + meta.c: ignore paths that match .MAKE.META.IGNORE_PATTERNS
    this is useful for gcov builds.
    + propagate errors from filemon(4).
    + remove use of non-standard types u_int etc.
    + meta.c: apply realpath() before matching against metaIgnorePaths
    + allow makefile to set .MAKE.JOBS
  * Makefile (PROG_NAME): use ${_MAKE_VERSION}</changelog>
  <changelog author="dap.darkness@gmail.com" date="1464264000">- Added bmake-MAKE_VERSION.diff to fix MAKE_VERSION variable
  that fixes mk-configure package configure error.</changelog>
  <changelog author="dap.darkness@gmail.com" date="1465905600">- 20160528
  * boot-strap, make-bootstrap.sh.in: Makefile uses _MAKE_VERSION
- Removed bmake-MAKE_VERSION.diff so.</changelog>
  <changelog author="rdodopoulos@suse.com" date="1473940800">- 20160818
  * its a neater number; pick up whitespace fixes to man page.
  * Merge with NetBSD make, pick up
    + meta.c: move handling of .MAKE.META.IGNORE_* to meta_ignore()
    so we can call it before adding entries to missingFiles.
    Thus we do not track files we have been told to ignore.
    + meta_oodate: apply .MAKE.META.IGNORE_FILTER (if defined) to
    pathnames, and skip if the expansion is empty.
    Useful for dirdeps.mk when checking DIRDEPS_CACHE.
    + meta.c: remove all missingFiles entries that match a deleted
    dir.
    + main.c: set .ERROR_CMD if possible.
    + dir.c: extend mtimes cache to others via cached_stat()
    + meta.c: missing filemon data is only relevant if we read a
    meta file.
    Also do not return oodate for a missing metafile if gn-&gt;path
    points to .CURDIR
    + cached_realpath(): avoid hitting filesystem more than necessary.
    + meta.c: refactor need_meta decision, add knobs for
    missing meta file and filemon data wrt out-of-datedness.</changelog>
  <changelog author="arichardson.kde@gmail.com" date="1479902400">- Install the .mk files as well
- Use allow-overriding-compiler-variables.patch instead overwriting the
  installed file with Linux.sys.mk</changelog>
  <changelog author="arichardson.kde@gmail.com" date="1479902401">- Update to 20160926
  * Makefile (_MAKE_VERSION): 20160926
    + Merge with NetBSD make, pick up
    + support for .DELETE_ON_ERROR: (remove targets that fail)
  * Makefile MAN: tweak .Dt to match ${PROG}</changelog>
  <changelog author="mpluskal@suse.com" date="1491393600">- Update to version 20170326
  * For full list of changes see provided Changelog
- Use https url for downloading</changelog>
  <changelog author="dziolkowski@suse.com" date="1495195200">- Update to version 20170510
  * For full list of changes see provided Changelog
- Fix allow-overriding-compiler-variables.patch to work with new version</changelog>
  <changelog author="dap.darkness@gmail.com" date="1497787200">- Let's skip optflags macro using to fix all builds.
  "-D_FORTIFY_SOURCE=0" for some reason doesn't fix x64.</changelog>
  <changelog author="dimstar@opensuse.org" date="1500379200">- Add bmake-strlcpy-explicit.patch: ensure strlcpy is not defined
  implicit.
- Do not de-FORTIFY the sources, use proper optflags. Above patch
  ensures strlcpy is not implicit declared.</changelog>
  <changelog author="dap.darkness@gmail.com" date="1500465600">- bmake-strlcpy-explicit.patch was replaced by upstream's one.
- Update to version 20170711:
  * main.c: refactor to reduce size of main function.
    add -v option to always fully expand values.
  * meta.c: ensure command output in meta file has ending newline
    even when filemon not being used.
    When matching ${.MAKE.META.IGNORE_PATTERNS} do not use
    pathname via ':L' since any ':' in pathname breaks that.
    Instead set a '${.p.}' to pathname in the target context and
    use that.</changelog>
  <changelog author="dap.darkness@gmail.com" date="1531483200">- Removed already upstreamed bmake-strlcpy-explicit.patch.
- Added bmake-env-script-interpreter.diff.
- Update to version 20180512:
  * job.c: skip polling job token pipe
  * parse.c: be more cautious about detecting depenency line
    rather than sysV style include.
  * parse.c: avoid calling sysconf for every call to loadfile
  * var.c: Var_Set handle NULL value anytime.
  * parse.c: do not treat .info as warning with -W
  * var.c: Var_Append use Var_Set if var not previously set
    so that VAR_CMD is handled correctly.
    Add a suitable unit-test.
  * var.c: do not append to variable set on command line
    add unit-test to catch this.
  * main.c: ignore empty MAKEOBJDIR
  * meta.c: if target is in subdir we only need subdir name in
    meta_name.
  * compat.c: pass SIGINT etc onto child and wait for it to exit
    before we self-terminate.
  * aclocal.m4: use AC_LINK_IFELSE for AC_C___ATTRIBUTE__
    since AC_TRY_COMPILE puts input inside main()
    which upsets modern compilers.
  * Makefile.config.in:
    make @prefix@ @machine*@ and @default_sys_path@ defaults.
  * unit-tests/dotwait.mk: redirect stderr through pipe for more
    consistent result on some platforms.
  * machine.sh: entry for AIX
  * VERSION (_MAKE_VERSION): Move the setting of _MAKE_VERSION
    to a file that can be included by configure as well as make.
    This allows configure to set set _MAKE_VERSION in make-bootstrap.sh</changelog>
  <changelog author="mpluskal@suse.com" date="1568203200">- Update to version 20181221:
  * For full list of changes see provided Changelog</changelog>
  <changelog author="dap.darkness@gmail.com" date="1592136000">- Updated allow-overriding-compiler-variables.patch.
- Update to version 20200606:
  * make.1: cleanup
  * Makefile: fix depends for main.o which broke MAKE_VERSION
  * dir.c: cached_stats - don't confuse stat and lstat results.
  * var.c: add :Or for reverse sort.
  * configure.in: add AC_PROG_CC_C99 for mipspro compiler
    also if --with-filemon= specifies path to filemon.h
    set use_filemon=dev
  * dirname.c: remove include of namespace.h
  * modified dollar tests to avoid shell dependencies
  * new tests for .INCLUDEFROM
  * unit-tests/dollar.mk: tweak  '1 dollar literal' test
    to not depend so much on shell behavior
  * unit test for dollar handling
  * str.c: empty string does not match % pattern
    plus unit-test changes
  * var.c: import handling of old sysV style modifier using '%'
  * str.c: refactor brk_string
  * unit-tests: add test case for lazy conditions
  * configure.in: use_makefile=no for cygwin et al.
    case insensitive filesystems just don't work if both
    makefile and Makefile exist.
  * meta.c: meta_oodate, CHECK_VALID_META is too aggressive for CMD
    a blank command is perfectly valid.
  * make.h: extern debug_file
  * meta.c: meta_oodate, check for corrupted meta file
    earlier and more often.
  * boot-strap: unset MAKEFLAGS
  * meta.c: meta_compat_parent check for USE_FILEMON
    patch from Soeren Tempel
  * meta.c: fix compat mode, need to call meta_job_output()
  * job.c: extra fds for meta mode not needed if using filemon_dev
  * meta.c: avoid passing NULL to filemon_*() when meta_needed()
    returns FALSE.
  * filemon/filemon_{dev,ktrace}.c: allow selection of
    filemon implementation.  filemon_dev.c uses the kernel module
    while filemon_ktrace.c leverages the fktrace api available in
    NetBSD.  filemon_ktrace.c can hopefully form the basis for
    adding support for other tracing mechanisms such as strace on
    Linux.
  * meta.c: when target is out-of-date per normal make rules
    record value of .OODATE in meta file.
  * parse.c: don't pass NULL to realpath(3)
    some versions cannot handle it.
  * parse.c: ParseDoDependency: free paths rather than assert
  * configure.in: add --without-makefile to avoid generating
    makefile and make-bootstrap.sh
  * include Makefile.inc if it exists
  * Use Makefile and Makefile.config.in in unit-tests
    so we can use just: make obj &amp;&amp; make &amp;&amp; make test
    when bmake is already available.
    We add --without-makefile to CONFIGURE_ARGS in this case.
  * tweak bsd.after-import.mk (captures Makefile.config etc
    after import to FreeBSD for example) to cope with all the above.
  * parse.c: ParseVErrorInternal use .PARSEDIR
    and apply if relative, and then use .PARSEFILE
    for consistent result.
  * parse.c: ParseVErrorInternal use .CURDIR if .PARSEDIR
    is relative
  * var.c: avoid SEGFAULT in .unexport-env
    when MAKELEVEL is not set
  * fix for unit-tests/varquote.mk on Debian
  * var.c: add :q
  * dir.c: cleanup caching of stats
  * Makefile.config.in: use += where it makes sense.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1623844800">- Update bmake-env-script-interpreter.diff to switch to interpreter
  to python3.</changelog>
  <changelog author="eich@suse.com" date="1732104000">- Fix variable used in rules to build shared libs on Linux
  The form: `-Wl,"-soname lib${LIB}.so.${SHLIB_MAJOR}"`
  caused an error message:
  Error: unable to disambiguate: -soname libelf.so.1 \
  (did you mean --soname libelf.so.1 ?)
  Instead it should be:
  `-Wl,"-soname,lib${LIB}.so.${SHLIB_MAJOR}"`
  as it is in the latest version of bmake. (bsc#1233508)
  Fix-variable-used-in-rules-to-build-shared-libs-on-Linux.patch</changelog>
</package>
<package pkgid="009bf0faff11069cff5b61aaad2313f17d31e1df15e1aa53c548b4b43ed65cd4" name="bmake" arch="x86_64">
  <version epoch="0" ver="20200606" rel="150400.3.3.2"/>
  <changelog author="mpluskal@suse.com" date="1447502400">- Update to 20151022
  * Makefile (MAKE_VERSION): 20151022
  * Add support for BSD/OS which lacks inttypes.h
    and really needs sys/param.h for sys/sysctl.h
    also 'type' is not a shell builtin.
  * var.c: eliminate uint32_t and need for inttypes.h
  * main.c: PrintOnError flush stdout before run .ERROR
  * parse.c: cope with _SC_PAGESIZE not being defined.
- For reso of changes see Changelog
- Tiny spec file polishing</changelog>
  <changelog author="mpluskal@suse.com" date="1451217600">- Update to 20151220
  * suff.c: re-initialize suffNull when clearing suffixes.
  * cond.c: CondCvtArg: avoid access beyond end of empty buffer.
  * meta.c: meta_oodate: use lstat(2) for checking link target in
    case it is a symlink.
  * var.c: avoid calling brk_string and Var_Export1 with empty
    strings.</changelog>
  <changelog author="mpluskal@suse.com" date="1458129600">- 20160307
  * Merge with NetBSD make, pick up
    + var.c: fix :ts\nnn to be octal by default.
    + meta.c: meta_finish() to cleanup memory.
    + meta.c: allow meta file for makeDepend if makefiles want it.
    + var.c: add knob to control handling of '$$' in :=
    + var.c: add .export-literal allows us to fix sys.clean-env.mk
    post the changes to Var_Subst. Var_Subst now takes flags, and
    does not consume '$$' in :=
    + ar.c: preserve '$$' in :=
    + parse.c: add .dinclude for handling included makefile like
    .depend
- Use correct package group</changelog>
  <changelog author="dap.darkness@gmail.com" date="1463313600">- 20160315
  * Merge with NetBSD make, pick up:
    + fix handling of archive members;
    + meta.c: treat missing Read file same as Write,
    in case we Delete it.
  * Rename variable to avoid interference
    with checks for ${MAKE_VERSION}.</changelog>
  <changelog author="dap.darkness@gmail.com" date="1464177600">- 20160512
  * Merge with NetBSD make, pick up
    + meta.c: ignore paths that match .MAKE.META.IGNORE_PATTERNS
    this is useful for gcov builds.
    + propagate errors from filemon(4).
    + remove use of non-standard types u_int etc.
    + meta.c: apply realpath() before matching against metaIgnorePaths
    + allow makefile to set .MAKE.JOBS
  * Makefile (PROG_NAME): use ${_MAKE_VERSION}</changelog>
  <changelog author="dap.darkness@gmail.com" date="1464264000">- Added bmake-MAKE_VERSION.diff to fix MAKE_VERSION variable
  that fixes mk-configure package configure error.</changelog>
  <changelog author="dap.darkness@gmail.com" date="1465905600">- 20160528
  * boot-strap, make-bootstrap.sh.in: Makefile uses _MAKE_VERSION
- Removed bmake-MAKE_VERSION.diff so.</changelog>
  <changelog author="rdodopoulos@suse.com" date="1473940800">- 20160818
  * its a neater number; pick up whitespace fixes to man page.
  * Merge with NetBSD make, pick up
    + meta.c: move handling of .MAKE.META.IGNORE_* to meta_ignore()
    so we can call it before adding entries to missingFiles.
    Thus we do not track files we have been told to ignore.
    + meta_oodate: apply .MAKE.META.IGNORE_FILTER (if defined) to
    pathnames, and skip if the expansion is empty.
    Useful for dirdeps.mk when checking DIRDEPS_CACHE.
    + meta.c: remove all missingFiles entries that match a deleted
    dir.
    + main.c: set .ERROR_CMD if possible.
    + dir.c: extend mtimes cache to others via cached_stat()
    + meta.c: missing filemon data is only relevant if we read a
    meta file.
    Also do not return oodate for a missing metafile if gn-&gt;path
    points to .CURDIR
    + cached_realpath(): avoid hitting filesystem more than necessary.
    + meta.c: refactor need_meta decision, add knobs for
    missing meta file and filemon data wrt out-of-datedness.</changelog>
  <changelog author="arichardson.kde@gmail.com" date="1479902400">- Install the .mk files as well
- Use allow-overriding-compiler-variables.patch instead overwriting the
  installed file with Linux.sys.mk</changelog>
  <changelog author="arichardson.kde@gmail.com" date="1479902401">- Update to 20160926
  * Makefile (_MAKE_VERSION): 20160926
    + Merge with NetBSD make, pick up
    + support for .DELETE_ON_ERROR: (remove targets that fail)
  * Makefile MAN: tweak .Dt to match ${PROG}</changelog>
  <changelog author="mpluskal@suse.com" date="1491393600">- Update to version 20170326
  * For full list of changes see provided Changelog
- Use https url for downloading</changelog>
  <changelog author="dziolkowski@suse.com" date="1495195200">- Update to version 20170510
  * For full list of changes see provided Changelog
- Fix allow-overriding-compiler-variables.patch to work with new version</changelog>
  <changelog author="dap.darkness@gmail.com" date="1497787200">- Let's skip optflags macro using to fix all builds.
  "-D_FORTIFY_SOURCE=0" for some reason doesn't fix x64.</changelog>
  <changelog author="dimstar@opensuse.org" date="1500379200">- Add bmake-strlcpy-explicit.patch: ensure strlcpy is not defined
  implicit.
- Do not de-FORTIFY the sources, use proper optflags. Above patch
  ensures strlcpy is not implicit declared.</changelog>
  <changelog author="dap.darkness@gmail.com" date="1500465600">- bmake-strlcpy-explicit.patch was replaced by upstream's one.
- Update to version 20170711:
  * main.c: refactor to reduce size of main function.
    add -v option to always fully expand values.
  * meta.c: ensure command output in meta file has ending newline
    even when filemon not being used.
    When matching ${.MAKE.META.IGNORE_PATTERNS} do not use
    pathname via ':L' since any ':' in pathname breaks that.
    Instead set a '${.p.}' to pathname in the target context and
    use that.</changelog>
  <changelog author="dap.darkness@gmail.com" date="1531483200">- Removed already upstreamed bmake-strlcpy-explicit.patch.
- Added bmake-env-script-interpreter.diff.
- Update to version 20180512:
  * job.c: skip polling job token pipe
  * parse.c: be more cautious about detecting depenency line
    rather than sysV style include.
  * parse.c: avoid calling sysconf for every call to loadfile
  * var.c: Var_Set handle NULL value anytime.
  * parse.c: do not treat .info as warning with -W
  * var.c: Var_Append use Var_Set if var not previously set
    so that VAR_CMD is handled correctly.
    Add a suitable unit-test.
  * var.c: do not append to variable set on command line
    add unit-test to catch this.
  * main.c: ignore empty MAKEOBJDIR
  * meta.c: if target is in subdir we only need subdir name in
    meta_name.
  * compat.c: pass SIGINT etc onto child and wait for it to exit
    before we self-terminate.
  * aclocal.m4: use AC_LINK_IFELSE for AC_C___ATTRIBUTE__
    since AC_TRY_COMPILE puts input inside main()
    which upsets modern compilers.
  * Makefile.config.in:
    make @prefix@ @machine*@ and @default_sys_path@ defaults.
  * unit-tests/dotwait.mk: redirect stderr through pipe for more
    consistent result on some platforms.
  * machine.sh: entry for AIX
  * VERSION (_MAKE_VERSION): Move the setting of _MAKE_VERSION
    to a file that can be included by configure as well as make.
    This allows configure to set set _MAKE_VERSION in make-bootstrap.sh</changelog>
  <changelog author="mpluskal@suse.com" date="1568203200">- Update to version 20181221:
  * For full list of changes see provided Changelog</changelog>
  <changelog author="dap.darkness@gmail.com" date="1592136000">- Updated allow-overriding-compiler-variables.patch.
- Update to version 20200606:
  * make.1: cleanup
  * Makefile: fix depends for main.o which broke MAKE_VERSION
  * dir.c: cached_stats - don't confuse stat and lstat results.
  * var.c: add :Or for reverse sort.
  * configure.in: add AC_PROG_CC_C99 for mipspro compiler
    also if --with-filemon= specifies path to filemon.h
    set use_filemon=dev
  * dirname.c: remove include of namespace.h
  * modified dollar tests to avoid shell dependencies
  * new tests for .INCLUDEFROM
  * unit-tests/dollar.mk: tweak  '1 dollar literal' test
    to not depend so much on shell behavior
  * unit test for dollar handling
  * str.c: empty string does not match % pattern
    plus unit-test changes
  * var.c: import handling of old sysV style modifier using '%'
  * str.c: refactor brk_string
  * unit-tests: add test case for lazy conditions
  * configure.in: use_makefile=no for cygwin et al.
    case insensitive filesystems just don't work if both
    makefile and Makefile exist.
  * meta.c: meta_oodate, CHECK_VALID_META is too aggressive for CMD
    a blank command is perfectly valid.
  * make.h: extern debug_file
  * meta.c: meta_oodate, check for corrupted meta file
    earlier and more often.
  * boot-strap: unset MAKEFLAGS
  * meta.c: meta_compat_parent check for USE_FILEMON
    patch from Soeren Tempel
  * meta.c: fix compat mode, need to call meta_job_output()
  * job.c: extra fds for meta mode not needed if using filemon_dev
  * meta.c: avoid passing NULL to filemon_*() when meta_needed()
    returns FALSE.
  * filemon/filemon_{dev,ktrace}.c: allow selection of
    filemon implementation.  filemon_dev.c uses the kernel module
    while filemon_ktrace.c leverages the fktrace api available in
    NetBSD.  filemon_ktrace.c can hopefully form the basis for
    adding support for other tracing mechanisms such as strace on
    Linux.
  * meta.c: when target is out-of-date per normal make rules
    record value of .OODATE in meta file.
  * parse.c: don't pass NULL to realpath(3)
    some versions cannot handle it.
  * parse.c: ParseDoDependency: free paths rather than assert
  * configure.in: add --without-makefile to avoid generating
    makefile and make-bootstrap.sh
  * include Makefile.inc if it exists
  * Use Makefile and Makefile.config.in in unit-tests
    so we can use just: make obj &amp;&amp; make &amp;&amp; make test
    when bmake is already available.
    We add --without-makefile to CONFIGURE_ARGS in this case.
  * tweak bsd.after-import.mk (captures Makefile.config etc
    after import to FreeBSD for example) to cope with all the above.
  * parse.c: ParseVErrorInternal use .PARSEDIR
    and apply if relative, and then use .PARSEFILE
    for consistent result.
  * parse.c: ParseVErrorInternal use .CURDIR if .PARSEDIR
    is relative
  * var.c: avoid SEGFAULT in .unexport-env
    when MAKELEVEL is not set
  * fix for unit-tests/varquote.mk on Debian
  * var.c: add :q
  * dir.c: cleanup caching of stats
  * Makefile.config.in: use += where it makes sense.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1623844800">- Update bmake-env-script-interpreter.diff to switch to interpreter
  to python3.</changelog>
  <changelog author="eich@suse.com" date="1732104000">- Fix variable used in rules to build shared libs on Linux
  The form: `-Wl,"-soname lib${LIB}.so.${SHLIB_MAJOR}"`
  caused an error message:
  Error: unable to disambiguate: -soname libelf.so.1 \
  (did you mean --soname libelf.so.1 ?)
  Instead it should be:
  `-Wl,"-soname,lib${LIB}.so.${SHLIB_MAJOR}"`
  as it is in the latest version of bmake. (bsc#1233508)
  Fix-variable-used-in-rules-to-build-shared-libs-on-Linux.patch</changelog>
</package>
<package pkgid="cb3ac58c75439eff9c032c24013720d9681fba7c231b47db8818519bb455a7bf" name="booth" arch="aarch64">
  <version epoch="0" ver="1.1+git0.09b0074" rel="150600.3.3.1"/>
  <changelog author="dmuhamedagic@suse.com" date="1460116800">- Update to version v1.0_14_g4d35ac7:
  + main: fix address matching procedure (bsc#994999)</changelog>
  <changelog author="tchvatal@suse.com" date="1467288000">- Reduce conditionals to only keep the default values
- Run systemd macros in proper phases
- Convert to pkgconfig dependencies</changelog>
  <changelog author="ygao@suse.com" date="1468411200">- spec: Set the owner of /etc/booth and booth.conf.example to hacluster:haclient (bsc#968865)</changelog>
  <changelog author="ygao@suse.com" date="1487160000">- spec: fix booth-test containing undesired build sources
- make log contain source address of unknown site
- main: initialize Libcrypt properly before the first use (bsc#1025463)
- extprog: fix race condition on ticket loss (bsc#1025463)
- attr: fix wrong order for hash free functions (bsc#1025463)
- attr: set time string to "" when time is not set
- extprog: fix pid test
- ticket: reset next state on ticket reset
- alternative logger (in service-runnable script)
- allow skipping "coredump nursing" phase
- alternative "nametag" provider: libsystemd
- alternative range2random provider: glib
- alternative logging provider: libqb
- offer alternatives to libraries from (cluster-)glue
- setup_tcp_listener: close socket when no longer needed
- read_client: sizeof(*struct_ptr) instead of sizeof(struct_ptr) (bsc#1025463)
- get_local_id: denoopize dependent condition (signedness issue) (bsc#1025463)
- list_ticket: fix a memleak in case of buffer too small (bsc#1025463)
- do_status: close lock file when no longer needed
- format_peers: fix a memleak in case of buffer too small (bsc#1025463)
- read_config: close config file when no longer needed
- make foreach_* macros use variable refs passed as arguments (bsc#1025463)
- prevent possible truncation w/ invalid geoattrs in CIB (bsc#1025463)
- build: add proper zlib build-time check + link flag + spec's BR
- build: allow requesting no HTML man + use in spec
- fixup: sanitize true-false logic for "daemonize"
- Upstream version cs: b270a78130f40e648844671b3652919d86e1aef4</changelog>
  <changelog author="ckowalczyk@suse.com" date="1496404800">- Build: create and set working directory (bsc#1039727)
  * bug-1039727_booth-build.patch
- Configuration: handle hostnames in booth.conf file (bsc#1037422)
- Upstream version cs: bbddf969550969784b76b743baecdcf72796bdf7</changelog>
  <changelog author="ckowalczyk@suse.com" date="1498132800">- Clinet commands: fixed local IP addresses for booth grant, list, and peers
  commands (bsc#1045067)
  * bug-1045067_booth-fix-booth-grant-cmd.patch
- Patch bug-1039727_booth-build.patch merged to upstream:
  * Build: create and set working directory (bsc#1039727)
- Upstream version cs: 766d61881b2cb576645821322edda0edea04828d</changelog>
  <changelog author="ckowalczyk@suse.com" date="1512129600">- Tickets: added manual tickets, which allow handling 2-site setup
  (fate#322100)
- Debug mode: fixed the interaction with resource agents (bsc#1046790)
- Patch file bug-1045067_booth-fix-booth-grant-cmd.patch has been removed
  after the code being merged to upstream:
  * Clinet commands: fixed local IP addresses for booth grant, list,
    and peers commands (bsc#1045067)
- Upstream version cs: d4cb8cbdaf87e46f636c3d06730b902b79bdcb9c</changelog>
  <changelog author="ckowalczyk@suse.com" date="1519300800">- Build: replace SuSEFirewall2 by firewalld (fate#320794) in booth.spec
- Upstream version cs: 80199f9477fb4fbf8809f31986139efe3f4ef790</changelog>
  <changelog author="ckowalczyk@suse.com" date="1525089600">- Doc: fix the documentation build with asciidoctor (bsc#1075764):
  * fix_asciidoc_build.patch
- Service: restart arbitrator on failure
- Upstream version cs: c2389e3020e8a3780b679cf0c9857bd608e99fa1</changelog>
  <changelog author="aburlakov@suse.com" date="1547726400">- Update to version 1.0+20190112.497c0b9:
  * fix_asciidoc_build.patch is removed, because the tarball already contains the changes.
  * Low: handler: fix spurious warning on alleged "fall-through" in switch (bsc#1123312)
  * Low: main: fix hypothetical file path double traversal discrepancy (bsc#1123310)
  * Med: attr: fix derefence of unspecified value pointer (bsc#1123308)
  * maint: ocf + script: eliminate some false positives with ShellCheck (bsc#1123303)
  * test: unit-test.py: daemon will not stay in foreground with -D anymore (bsc#1123302)
  * test: avoid dangerous mutable/sticky default value (bsc#1123301)
  * test: drop/comment out superfluous imports (bsc#1123300)
  * test: drop underqualified identifier in unittest's 2.6 compat "polyfill" (bsc#1123299)
  * test: remove superfluous shebangs for import-only modules (bsc#1123297)
  * maint: fix typos introduced in 4bb484a (bsc#1123296)
  * maint: fix thinko in .gitignore introduced in 5a457ee (bsc#1123294)
  * Fix malformed man title (bsc#1123290)
  * Handle multi-leader situation for manual tickets. Added manual tickets to Life Tests framework (bsc#1123289)
  * Feature: add manual mode to booth tickets (bsc#1123287)
  * Fix GCC-7 warning on buffer size (bsc#1123285)</changelog>
  <changelog author="aburlakov@suse.com" date="1548676800">- test: fix read -a &lt;&lt;&lt; issue (bsc#1123313)
  * test-fix-read-a-issue.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1597838400">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="aburlakov@suse.com" date="1600257600">- Update to version 1.0+20200702.2f043da:
  * transport: Check fcntl return value
  * transport: setsockopt failures are not critical
  * pacemaker: Change rv handling of pcmk_get_attr
  * pacemaker: Express intention about logical or
  * main: mkdir failure is not critical
  * pacemaker: Handle updated exit code of crm_ticket
  * main: Delete lockfile when signal arrive too early
  * main: Accept longer config and lock file names
  * Fix gcc-10 warnings for multiple definition of pcmk_handler
  * Fix gcc-10 warnings for packed struct members
  * Use pkg-config to configure libxml-2.0</changelog>
  <changelog author="varkoly@suse.com" date="1622116800">- Update to version 1.0+20210519.bfb2f92:
  * config: Remove deprecated net functions
  * configure: drop unnecessary check and define
  * configure: move exec_prefix sanitizer closer to prefix
  * configure: drop dead code
  * configure: drop unnecessary macro
  * configure: use PKG_CONFIG to detect pacemaker user/group
  * configure: use resource-agents pkg-config info to determine ocfdir
  * configure: add BOOTH_PKG_CHECK_VAR macro to wrap PKG_CHECK_VAR
  * configure: detect and init pkg-config with proper macro
  * configure: Simplify libqb detection when libqb is not installed in standard paths
  * [build] ship booth.pc with basic booth build information for downstream packages to use
  * booth.spec: Change naming scheme for upgrades
  * boot.spec.in: Package html files when generated
  * build: Fix building of html docs with asciidoc
  * git-version-gen: Use fallback for git-archive
  * configure: Make sure without-html_man works
  * test: Add compatibility with iproute ss command
  * test: fix the delimiter in the here-string
  * build: Remove bashisms
  * booth.spec: Add fedora compatibility provides
  * build: Add option to enable tests during rpmbuild
  * build: Substitute hauser and haclient in RPM
  * build: Substitute python dependency in RPM
  * build: Substitute glue dependency in RPM
  * build: Substitute asciidoc or asciidoctor for RPM
  * build: Rework build of RPM
  * build: Use git-version-gen
  * configure: Always let automake set python vars
  * build: Delete cov directory on clean
  * build: Make sure tarball contains all needed files
  * build: Remove unneeded OS detection section
  * build: Make generating of HTML man work
- remove applied patch
  test-fix-read-a-issue.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632830400">- Use Python 3 for -test subpackage.</changelog>
  <changelog author="pgajdos@suse.com" date="1659009600">- Update to version 1.0+20220724.dce51f9:
  * ticket: Fix compiler warning
  * rpm: use new package name for pacemaker devel on opensuse
  * Revert "Refactor: main: substitute is_auth_req macro"
  * doc: Describe debug config file option
  * handler: Use only signal-safe functions
  * main: Use only signal-safe functions
  * fix bashisms (use printf instead of echo)
- fixes CVE-2022-2553 [bsc#1201946]</changelog>
  <changelog author="ygao@suse.com" date="1663070400">- Update to version 1.0+20220815.f40c2d5:
  * configure: Modernize configure.ac a bit
- spec: BuildRequires firewall-macros (bsc#1202959)
- spec: optionally BuildRequires cluster-glue-devel instead of libglue-devel</changelog>
  <changelog author="varkoly@suse.com" date="1678968000">- Update to version 1.0+20221117.9d4029a:
  * man: Add generated html files into gitignore
  * man: remove literal paragraph format from boothd.8
  * man: Remove italic bold formatting
  * man: Do not format __defaults__
  * man: Indent peers counters
  * man: Move debug description to better place
  * test: Add test for unknown/unexpected keyword
  * config: Include protocol in error message
  * config: Include keyword in error message
  * unit file: Remove Alias directive</changelog>
  <changelog author="varkoly@suse.com" date="1699963200">- Update to version 1.1+git0.09b0074:
  * build: Prepare version 1.1 release
  * build: Make distcheck work for non-root user
  * build: Include icons in release tarballs
  * build: Add release.mk
  * build: Add gitlog-to-changelog
  * tests: Fix Python 3.12 warning
  * attr: Fix glib hash_table != NULL assert
  * attr: Fix memory leak for list and get operation
  * main: Fix exit code on grant/revoke command error
  * spec: Migrate to SPDX license
- Added hardening to systemd service(s). Added patch(es):
  * harden_booth-arbitrator.service.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-3049 [bsc#1226032], specially crafted hash can lead to invalid HMAC being accepted by Booth server
  + booth-CVE-2024-3049.patch</changelog>
</package>
<package pkgid="83c14aa964baff6155eb47a4282bc37d6ed3f6208572fbc33f1130821e201cbf" name="booth" arch="ppc64le">
  <version epoch="0" ver="1.1+git0.09b0074" rel="150600.3.3.1"/>
  <changelog author="dmuhamedagic@suse.com" date="1460116800">- Update to version v1.0_14_g4d35ac7:
  + main: fix address matching procedure (bsc#994999)</changelog>
  <changelog author="tchvatal@suse.com" date="1467288000">- Reduce conditionals to only keep the default values
- Run systemd macros in proper phases
- Convert to pkgconfig dependencies</changelog>
  <changelog author="ygao@suse.com" date="1468411200">- spec: Set the owner of /etc/booth and booth.conf.example to hacluster:haclient (bsc#968865)</changelog>
  <changelog author="ygao@suse.com" date="1487160000">- spec: fix booth-test containing undesired build sources
- make log contain source address of unknown site
- main: initialize Libcrypt properly before the first use (bsc#1025463)
- extprog: fix race condition on ticket loss (bsc#1025463)
- attr: fix wrong order for hash free functions (bsc#1025463)
- attr: set time string to "" when time is not set
- extprog: fix pid test
- ticket: reset next state on ticket reset
- alternative logger (in service-runnable script)
- allow skipping "coredump nursing" phase
- alternative "nametag" provider: libsystemd
- alternative range2random provider: glib
- alternative logging provider: libqb
- offer alternatives to libraries from (cluster-)glue
- setup_tcp_listener: close socket when no longer needed
- read_client: sizeof(*struct_ptr) instead of sizeof(struct_ptr) (bsc#1025463)
- get_local_id: denoopize dependent condition (signedness issue) (bsc#1025463)
- list_ticket: fix a memleak in case of buffer too small (bsc#1025463)
- do_status: close lock file when no longer needed
- format_peers: fix a memleak in case of buffer too small (bsc#1025463)
- read_config: close config file when no longer needed
- make foreach_* macros use variable refs passed as arguments (bsc#1025463)
- prevent possible truncation w/ invalid geoattrs in CIB (bsc#1025463)
- build: add proper zlib build-time check + link flag + spec's BR
- build: allow requesting no HTML man + use in spec
- fixup: sanitize true-false logic for "daemonize"
- Upstream version cs: b270a78130f40e648844671b3652919d86e1aef4</changelog>
  <changelog author="ckowalczyk@suse.com" date="1496404800">- Build: create and set working directory (bsc#1039727)
  * bug-1039727_booth-build.patch
- Configuration: handle hostnames in booth.conf file (bsc#1037422)
- Upstream version cs: bbddf969550969784b76b743baecdcf72796bdf7</changelog>
  <changelog author="ckowalczyk@suse.com" date="1498132800">- Clinet commands: fixed local IP addresses for booth grant, list, and peers
  commands (bsc#1045067)
  * bug-1045067_booth-fix-booth-grant-cmd.patch
- Patch bug-1039727_booth-build.patch merged to upstream:
  * Build: create and set working directory (bsc#1039727)
- Upstream version cs: 766d61881b2cb576645821322edda0edea04828d</changelog>
  <changelog author="ckowalczyk@suse.com" date="1512129600">- Tickets: added manual tickets, which allow handling 2-site setup
  (fate#322100)
- Debug mode: fixed the interaction with resource agents (bsc#1046790)
- Patch file bug-1045067_booth-fix-booth-grant-cmd.patch has been removed
  after the code being merged to upstream:
  * Clinet commands: fixed local IP addresses for booth grant, list,
    and peers commands (bsc#1045067)
- Upstream version cs: d4cb8cbdaf87e46f636c3d06730b902b79bdcb9c</changelog>
  <changelog author="ckowalczyk@suse.com" date="1519300800">- Build: replace SuSEFirewall2 by firewalld (fate#320794) in booth.spec
- Upstream version cs: 80199f9477fb4fbf8809f31986139efe3f4ef790</changelog>
  <changelog author="ckowalczyk@suse.com" date="1525089600">- Doc: fix the documentation build with asciidoctor (bsc#1075764):
  * fix_asciidoc_build.patch
- Service: restart arbitrator on failure
- Upstream version cs: c2389e3020e8a3780b679cf0c9857bd608e99fa1</changelog>
  <changelog author="aburlakov@suse.com" date="1547726400">- Update to version 1.0+20190112.497c0b9:
  * fix_asciidoc_build.patch is removed, because the tarball already contains the changes.
  * Low: handler: fix spurious warning on alleged "fall-through" in switch (bsc#1123312)
  * Low: main: fix hypothetical file path double traversal discrepancy (bsc#1123310)
  * Med: attr: fix derefence of unspecified value pointer (bsc#1123308)
  * maint: ocf + script: eliminate some false positives with ShellCheck (bsc#1123303)
  * test: unit-test.py: daemon will not stay in foreground with -D anymore (bsc#1123302)
  * test: avoid dangerous mutable/sticky default value (bsc#1123301)
  * test: drop/comment out superfluous imports (bsc#1123300)
  * test: drop underqualified identifier in unittest's 2.6 compat "polyfill" (bsc#1123299)
  * test: remove superfluous shebangs for import-only modules (bsc#1123297)
  * maint: fix typos introduced in 4bb484a (bsc#1123296)
  * maint: fix thinko in .gitignore introduced in 5a457ee (bsc#1123294)
  * Fix malformed man title (bsc#1123290)
  * Handle multi-leader situation for manual tickets. Added manual tickets to Life Tests framework (bsc#1123289)
  * Feature: add manual mode to booth tickets (bsc#1123287)
  * Fix GCC-7 warning on buffer size (bsc#1123285)</changelog>
  <changelog author="aburlakov@suse.com" date="1548676800">- test: fix read -a &lt;&lt;&lt; issue (bsc#1123313)
  * test-fix-read-a-issue.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1597838400">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="aburlakov@suse.com" date="1600257600">- Update to version 1.0+20200702.2f043da:
  * transport: Check fcntl return value
  * transport: setsockopt failures are not critical
  * pacemaker: Change rv handling of pcmk_get_attr
  * pacemaker: Express intention about logical or
  * main: mkdir failure is not critical
  * pacemaker: Handle updated exit code of crm_ticket
  * main: Delete lockfile when signal arrive too early
  * main: Accept longer config and lock file names
  * Fix gcc-10 warnings for multiple definition of pcmk_handler
  * Fix gcc-10 warnings for packed struct members
  * Use pkg-config to configure libxml-2.0</changelog>
  <changelog author="varkoly@suse.com" date="1622116800">- Update to version 1.0+20210519.bfb2f92:
  * config: Remove deprecated net functions
  * configure: drop unnecessary check and define
  * configure: move exec_prefix sanitizer closer to prefix
  * configure: drop dead code
  * configure: drop unnecessary macro
  * configure: use PKG_CONFIG to detect pacemaker user/group
  * configure: use resource-agents pkg-config info to determine ocfdir
  * configure: add BOOTH_PKG_CHECK_VAR macro to wrap PKG_CHECK_VAR
  * configure: detect and init pkg-config with proper macro
  * configure: Simplify libqb detection when libqb is not installed in standard paths
  * [build] ship booth.pc with basic booth build information for downstream packages to use
  * booth.spec: Change naming scheme for upgrades
  * boot.spec.in: Package html files when generated
  * build: Fix building of html docs with asciidoc
  * git-version-gen: Use fallback for git-archive
  * configure: Make sure without-html_man works
  * test: Add compatibility with iproute ss command
  * test: fix the delimiter in the here-string
  * build: Remove bashisms
  * booth.spec: Add fedora compatibility provides
  * build: Add option to enable tests during rpmbuild
  * build: Substitute hauser and haclient in RPM
  * build: Substitute python dependency in RPM
  * build: Substitute glue dependency in RPM
  * build: Substitute asciidoc or asciidoctor for RPM
  * build: Rework build of RPM
  * build: Use git-version-gen
  * configure: Always let automake set python vars
  * build: Delete cov directory on clean
  * build: Make sure tarball contains all needed files
  * build: Remove unneeded OS detection section
  * build: Make generating of HTML man work
- remove applied patch
  test-fix-read-a-issue.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632830400">- Use Python 3 for -test subpackage.</changelog>
  <changelog author="pgajdos@suse.com" date="1659009600">- Update to version 1.0+20220724.dce51f9:
  * ticket: Fix compiler warning
  * rpm: use new package name for pacemaker devel on opensuse
  * Revert "Refactor: main: substitute is_auth_req macro"
  * doc: Describe debug config file option
  * handler: Use only signal-safe functions
  * main: Use only signal-safe functions
  * fix bashisms (use printf instead of echo)
- fixes CVE-2022-2553 [bsc#1201946]</changelog>
  <changelog author="ygao@suse.com" date="1663070400">- Update to version 1.0+20220815.f40c2d5:
  * configure: Modernize configure.ac a bit
- spec: BuildRequires firewall-macros (bsc#1202959)
- spec: optionally BuildRequires cluster-glue-devel instead of libglue-devel</changelog>
  <changelog author="varkoly@suse.com" date="1678968000">- Update to version 1.0+20221117.9d4029a:
  * man: Add generated html files into gitignore
  * man: remove literal paragraph format from boothd.8
  * man: Remove italic bold formatting
  * man: Do not format __defaults__
  * man: Indent peers counters
  * man: Move debug description to better place
  * test: Add test for unknown/unexpected keyword
  * config: Include protocol in error message
  * config: Include keyword in error message
  * unit file: Remove Alias directive</changelog>
  <changelog author="varkoly@suse.com" date="1699963200">- Update to version 1.1+git0.09b0074:
  * build: Prepare version 1.1 release
  * build: Make distcheck work for non-root user
  * build: Include icons in release tarballs
  * build: Add release.mk
  * build: Add gitlog-to-changelog
  * tests: Fix Python 3.12 warning
  * attr: Fix glib hash_table != NULL assert
  * attr: Fix memory leak for list and get operation
  * main: Fix exit code on grant/revoke command error
  * spec: Migrate to SPDX license
- Added hardening to systemd service(s). Added patch(es):
  * harden_booth-arbitrator.service.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-3049 [bsc#1226032], specially crafted hash can lead to invalid HMAC being accepted by Booth server
  + booth-CVE-2024-3049.patch</changelog>
</package>
<package pkgid="60a39fc6cf8ce9ec5ae11a70563c4922af4c084cd0775857c8dbec84f297ccd3" name="booth" arch="s390x">
  <version epoch="0" ver="1.1+git0.09b0074" rel="150600.3.3.1"/>
  <changelog author="dmuhamedagic@suse.com" date="1460116800">- Update to version v1.0_14_g4d35ac7:
  + main: fix address matching procedure (bsc#994999)</changelog>
  <changelog author="tchvatal@suse.com" date="1467288000">- Reduce conditionals to only keep the default values
- Run systemd macros in proper phases
- Convert to pkgconfig dependencies</changelog>
  <changelog author="ygao@suse.com" date="1468411200">- spec: Set the owner of /etc/booth and booth.conf.example to hacluster:haclient (bsc#968865)</changelog>
  <changelog author="ygao@suse.com" date="1487160000">- spec: fix booth-test containing undesired build sources
- make log contain source address of unknown site
- main: initialize Libcrypt properly before the first use (bsc#1025463)
- extprog: fix race condition on ticket loss (bsc#1025463)
- attr: fix wrong order for hash free functions (bsc#1025463)
- attr: set time string to "" when time is not set
- extprog: fix pid test
- ticket: reset next state on ticket reset
- alternative logger (in service-runnable script)
- allow skipping "coredump nursing" phase
- alternative "nametag" provider: libsystemd
- alternative range2random provider: glib
- alternative logging provider: libqb
- offer alternatives to libraries from (cluster-)glue
- setup_tcp_listener: close socket when no longer needed
- read_client: sizeof(*struct_ptr) instead of sizeof(struct_ptr) (bsc#1025463)
- get_local_id: denoopize dependent condition (signedness issue) (bsc#1025463)
- list_ticket: fix a memleak in case of buffer too small (bsc#1025463)
- do_status: close lock file when no longer needed
- format_peers: fix a memleak in case of buffer too small (bsc#1025463)
- read_config: close config file when no longer needed
- make foreach_* macros use variable refs passed as arguments (bsc#1025463)
- prevent possible truncation w/ invalid geoattrs in CIB (bsc#1025463)
- build: add proper zlib build-time check + link flag + spec's BR
- build: allow requesting no HTML man + use in spec
- fixup: sanitize true-false logic for "daemonize"
- Upstream version cs: b270a78130f40e648844671b3652919d86e1aef4</changelog>
  <changelog author="ckowalczyk@suse.com" date="1496404800">- Build: create and set working directory (bsc#1039727)
  * bug-1039727_booth-build.patch
- Configuration: handle hostnames in booth.conf file (bsc#1037422)
- Upstream version cs: bbddf969550969784b76b743baecdcf72796bdf7</changelog>
  <changelog author="ckowalczyk@suse.com" date="1498132800">- Clinet commands: fixed local IP addresses for booth grant, list, and peers
  commands (bsc#1045067)
  * bug-1045067_booth-fix-booth-grant-cmd.patch
- Patch bug-1039727_booth-build.patch merged to upstream:
  * Build: create and set working directory (bsc#1039727)
- Upstream version cs: 766d61881b2cb576645821322edda0edea04828d</changelog>
  <changelog author="ckowalczyk@suse.com" date="1512129600">- Tickets: added manual tickets, which allow handling 2-site setup
  (fate#322100)
- Debug mode: fixed the interaction with resource agents (bsc#1046790)
- Patch file bug-1045067_booth-fix-booth-grant-cmd.patch has been removed
  after the code being merged to upstream:
  * Clinet commands: fixed local IP addresses for booth grant, list,
    and peers commands (bsc#1045067)
- Upstream version cs: d4cb8cbdaf87e46f636c3d06730b902b79bdcb9c</changelog>
  <changelog author="ckowalczyk@suse.com" date="1519300800">- Build: replace SuSEFirewall2 by firewalld (fate#320794) in booth.spec
- Upstream version cs: 80199f9477fb4fbf8809f31986139efe3f4ef790</changelog>
  <changelog author="ckowalczyk@suse.com" date="1525089600">- Doc: fix the documentation build with asciidoctor (bsc#1075764):
  * fix_asciidoc_build.patch
- Service: restart arbitrator on failure
- Upstream version cs: c2389e3020e8a3780b679cf0c9857bd608e99fa1</changelog>
  <changelog author="aburlakov@suse.com" date="1547726400">- Update to version 1.0+20190112.497c0b9:
  * fix_asciidoc_build.patch is removed, because the tarball already contains the changes.
  * Low: handler: fix spurious warning on alleged "fall-through" in switch (bsc#1123312)
  * Low: main: fix hypothetical file path double traversal discrepancy (bsc#1123310)
  * Med: attr: fix derefence of unspecified value pointer (bsc#1123308)
  * maint: ocf + script: eliminate some false positives with ShellCheck (bsc#1123303)
  * test: unit-test.py: daemon will not stay in foreground with -D anymore (bsc#1123302)
  * test: avoid dangerous mutable/sticky default value (bsc#1123301)
  * test: drop/comment out superfluous imports (bsc#1123300)
  * test: drop underqualified identifier in unittest's 2.6 compat "polyfill" (bsc#1123299)
  * test: remove superfluous shebangs for import-only modules (bsc#1123297)
  * maint: fix typos introduced in 4bb484a (bsc#1123296)
  * maint: fix thinko in .gitignore introduced in 5a457ee (bsc#1123294)
  * Fix malformed man title (bsc#1123290)
  * Handle multi-leader situation for manual tickets. Added manual tickets to Life Tests framework (bsc#1123289)
  * Feature: add manual mode to booth tickets (bsc#1123287)
  * Fix GCC-7 warning on buffer size (bsc#1123285)</changelog>
  <changelog author="aburlakov@suse.com" date="1548676800">- test: fix read -a &lt;&lt;&lt; issue (bsc#1123313)
  * test-fix-read-a-issue.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1597838400">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="aburlakov@suse.com" date="1600257600">- Update to version 1.0+20200702.2f043da:
  * transport: Check fcntl return value
  * transport: setsockopt failures are not critical
  * pacemaker: Change rv handling of pcmk_get_attr
  * pacemaker: Express intention about logical or
  * main: mkdir failure is not critical
  * pacemaker: Handle updated exit code of crm_ticket
  * main: Delete lockfile when signal arrive too early
  * main: Accept longer config and lock file names
  * Fix gcc-10 warnings for multiple definition of pcmk_handler
  * Fix gcc-10 warnings for packed struct members
  * Use pkg-config to configure libxml-2.0</changelog>
  <changelog author="varkoly@suse.com" date="1622116800">- Update to version 1.0+20210519.bfb2f92:
  * config: Remove deprecated net functions
  * configure: drop unnecessary check and define
  * configure: move exec_prefix sanitizer closer to prefix
  * configure: drop dead code
  * configure: drop unnecessary macro
  * configure: use PKG_CONFIG to detect pacemaker user/group
  * configure: use resource-agents pkg-config info to determine ocfdir
  * configure: add BOOTH_PKG_CHECK_VAR macro to wrap PKG_CHECK_VAR
  * configure: detect and init pkg-config with proper macro
  * configure: Simplify libqb detection when libqb is not installed in standard paths
  * [build] ship booth.pc with basic booth build information for downstream packages to use
  * booth.spec: Change naming scheme for upgrades
  * boot.spec.in: Package html files when generated
  * build: Fix building of html docs with asciidoc
  * git-version-gen: Use fallback for git-archive
  * configure: Make sure without-html_man works
  * test: Add compatibility with iproute ss command
  * test: fix the delimiter in the here-string
  * build: Remove bashisms
  * booth.spec: Add fedora compatibility provides
  * build: Add option to enable tests during rpmbuild
  * build: Substitute hauser and haclient in RPM
  * build: Substitute python dependency in RPM
  * build: Substitute glue dependency in RPM
  * build: Substitute asciidoc or asciidoctor for RPM
  * build: Rework build of RPM
  * build: Use git-version-gen
  * configure: Always let automake set python vars
  * build: Delete cov directory on clean
  * build: Make sure tarball contains all needed files
  * build: Remove unneeded OS detection section
  * build: Make generating of HTML man work
- remove applied patch
  test-fix-read-a-issue.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632830400">- Use Python 3 for -test subpackage.</changelog>
  <changelog author="pgajdos@suse.com" date="1659009600">- Update to version 1.0+20220724.dce51f9:
  * ticket: Fix compiler warning
  * rpm: use new package name for pacemaker devel on opensuse
  * Revert "Refactor: main: substitute is_auth_req macro"
  * doc: Describe debug config file option
  * handler: Use only signal-safe functions
  * main: Use only signal-safe functions
  * fix bashisms (use printf instead of echo)
- fixes CVE-2022-2553 [bsc#1201946]</changelog>
  <changelog author="ygao@suse.com" date="1663070400">- Update to version 1.0+20220815.f40c2d5:
  * configure: Modernize configure.ac a bit
- spec: BuildRequires firewall-macros (bsc#1202959)
- spec: optionally BuildRequires cluster-glue-devel instead of libglue-devel</changelog>
  <changelog author="varkoly@suse.com" date="1678968000">- Update to version 1.0+20221117.9d4029a:
  * man: Add generated html files into gitignore
  * man: remove literal paragraph format from boothd.8
  * man: Remove italic bold formatting
  * man: Do not format __defaults__
  * man: Indent peers counters
  * man: Move debug description to better place
  * test: Add test for unknown/unexpected keyword
  * config: Include protocol in error message
  * config: Include keyword in error message
  * unit file: Remove Alias directive</changelog>
  <changelog author="varkoly@suse.com" date="1699963200">- Update to version 1.1+git0.09b0074:
  * build: Prepare version 1.1 release
  * build: Make distcheck work for non-root user
  * build: Include icons in release tarballs
  * build: Add release.mk
  * build: Add gitlog-to-changelog
  * tests: Fix Python 3.12 warning
  * attr: Fix glib hash_table != NULL assert
  * attr: Fix memory leak for list and get operation
  * main: Fix exit code on grant/revoke command error
  * spec: Migrate to SPDX license
- Added hardening to systemd service(s). Added patch(es):
  * harden_booth-arbitrator.service.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-3049 [bsc#1226032], specially crafted hash can lead to invalid HMAC being accepted by Booth server
  + booth-CVE-2024-3049.patch</changelog>
</package>
<package pkgid="00f84af362c159c9ff62cb43de23608f414a2a0e49b68e8849cbbab965e33837" name="booth" arch="src">
  <version epoch="0" ver="1.1+git0.09b0074" rel="150600.3.3.1"/>
  <changelog author="dmuhamedagic@suse.com" date="1460116800">- Update to version v1.0_14_g4d35ac7:
  + main: fix address matching procedure (bsc#994999)</changelog>
  <changelog author="tchvatal@suse.com" date="1467288000">- Reduce conditionals to only keep the default values
- Run systemd macros in proper phases
- Convert to pkgconfig dependencies</changelog>
  <changelog author="ygao@suse.com" date="1468411200">- spec: Set the owner of /etc/booth and booth.conf.example to hacluster:haclient (bsc#968865)</changelog>
  <changelog author="ygao@suse.com" date="1487160000">- spec: fix booth-test containing undesired build sources
- make log contain source address of unknown site
- main: initialize Libcrypt properly before the first use (bsc#1025463)
- extprog: fix race condition on ticket loss (bsc#1025463)
- attr: fix wrong order for hash free functions (bsc#1025463)
- attr: set time string to "" when time is not set
- extprog: fix pid test
- ticket: reset next state on ticket reset
- alternative logger (in service-runnable script)
- allow skipping "coredump nursing" phase
- alternative "nametag" provider: libsystemd
- alternative range2random provider: glib
- alternative logging provider: libqb
- offer alternatives to libraries from (cluster-)glue
- setup_tcp_listener: close socket when no longer needed
- read_client: sizeof(*struct_ptr) instead of sizeof(struct_ptr) (bsc#1025463)
- get_local_id: denoopize dependent condition (signedness issue) (bsc#1025463)
- list_ticket: fix a memleak in case of buffer too small (bsc#1025463)
- do_status: close lock file when no longer needed
- format_peers: fix a memleak in case of buffer too small (bsc#1025463)
- read_config: close config file when no longer needed
- make foreach_* macros use variable refs passed as arguments (bsc#1025463)
- prevent possible truncation w/ invalid geoattrs in CIB (bsc#1025463)
- build: add proper zlib build-time check + link flag + spec's BR
- build: allow requesting no HTML man + use in spec
- fixup: sanitize true-false logic for "daemonize"
- Upstream version cs: b270a78130f40e648844671b3652919d86e1aef4</changelog>
  <changelog author="ckowalczyk@suse.com" date="1496404800">- Build: create and set working directory (bsc#1039727)
  * bug-1039727_booth-build.patch
- Configuration: handle hostnames in booth.conf file (bsc#1037422)
- Upstream version cs: bbddf969550969784b76b743baecdcf72796bdf7</changelog>
  <changelog author="ckowalczyk@suse.com" date="1498132800">- Clinet commands: fixed local IP addresses for booth grant, list, and peers
  commands (bsc#1045067)
  * bug-1045067_booth-fix-booth-grant-cmd.patch
- Patch bug-1039727_booth-build.patch merged to upstream:
  * Build: create and set working directory (bsc#1039727)
- Upstream version cs: 766d61881b2cb576645821322edda0edea04828d</changelog>
  <changelog author="ckowalczyk@suse.com" date="1512129600">- Tickets: added manual tickets, which allow handling 2-site setup
  (fate#322100)
- Debug mode: fixed the interaction with resource agents (bsc#1046790)
- Patch file bug-1045067_booth-fix-booth-grant-cmd.patch has been removed
  after the code being merged to upstream:
  * Clinet commands: fixed local IP addresses for booth grant, list,
    and peers commands (bsc#1045067)
- Upstream version cs: d4cb8cbdaf87e46f636c3d06730b902b79bdcb9c</changelog>
  <changelog author="ckowalczyk@suse.com" date="1519300800">- Build: replace SuSEFirewall2 by firewalld (fate#320794) in booth.spec
- Upstream version cs: 80199f9477fb4fbf8809f31986139efe3f4ef790</changelog>
  <changelog author="ckowalczyk@suse.com" date="1525089600">- Doc: fix the documentation build with asciidoctor (bsc#1075764):
  * fix_asciidoc_build.patch
- Service: restart arbitrator on failure
- Upstream version cs: c2389e3020e8a3780b679cf0c9857bd608e99fa1</changelog>
  <changelog author="aburlakov@suse.com" date="1547726400">- Update to version 1.0+20190112.497c0b9:
  * fix_asciidoc_build.patch is removed, because the tarball already contains the changes.
  * Low: handler: fix spurious warning on alleged "fall-through" in switch (bsc#1123312)
  * Low: main: fix hypothetical file path double traversal discrepancy (bsc#1123310)
  * Med: attr: fix derefence of unspecified value pointer (bsc#1123308)
  * maint: ocf + script: eliminate some false positives with ShellCheck (bsc#1123303)
  * test: unit-test.py: daemon will not stay in foreground with -D anymore (bsc#1123302)
  * test: avoid dangerous mutable/sticky default value (bsc#1123301)
  * test: drop/comment out superfluous imports (bsc#1123300)
  * test: drop underqualified identifier in unittest's 2.6 compat "polyfill" (bsc#1123299)
  * test: remove superfluous shebangs for import-only modules (bsc#1123297)
  * maint: fix typos introduced in 4bb484a (bsc#1123296)
  * maint: fix thinko in .gitignore introduced in 5a457ee (bsc#1123294)
  * Fix malformed man title (bsc#1123290)
  * Handle multi-leader situation for manual tickets. Added manual tickets to Life Tests framework (bsc#1123289)
  * Feature: add manual mode to booth tickets (bsc#1123287)
  * Fix GCC-7 warning on buffer size (bsc#1123285)</changelog>
  <changelog author="aburlakov@suse.com" date="1548676800">- test: fix read -a &lt;&lt;&lt; issue (bsc#1123313)
  * test-fix-read-a-issue.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1597838400">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="aburlakov@suse.com" date="1600257600">- Update to version 1.0+20200702.2f043da:
  * transport: Check fcntl return value
  * transport: setsockopt failures are not critical
  * pacemaker: Change rv handling of pcmk_get_attr
  * pacemaker: Express intention about logical or
  * main: mkdir failure is not critical
  * pacemaker: Handle updated exit code of crm_ticket
  * main: Delete lockfile when signal arrive too early
  * main: Accept longer config and lock file names
  * Fix gcc-10 warnings for multiple definition of pcmk_handler
  * Fix gcc-10 warnings for packed struct members
  * Use pkg-config to configure libxml-2.0</changelog>
  <changelog author="varkoly@suse.com" date="1622116800">- Update to version 1.0+20210519.bfb2f92:
  * config: Remove deprecated net functions
  * configure: drop unnecessary check and define
  * configure: move exec_prefix sanitizer closer to prefix
  * configure: drop dead code
  * configure: drop unnecessary macro
  * configure: use PKG_CONFIG to detect pacemaker user/group
  * configure: use resource-agents pkg-config info to determine ocfdir
  * configure: add BOOTH_PKG_CHECK_VAR macro to wrap PKG_CHECK_VAR
  * configure: detect and init pkg-config with proper macro
  * configure: Simplify libqb detection when libqb is not installed in standard paths
  * [build] ship booth.pc with basic booth build information for downstream packages to use
  * booth.spec: Change naming scheme for upgrades
  * boot.spec.in: Package html files when generated
  * build: Fix building of html docs with asciidoc
  * git-version-gen: Use fallback for git-archive
  * configure: Make sure without-html_man works
  * test: Add compatibility with iproute ss command
  * test: fix the delimiter in the here-string
  * build: Remove bashisms
  * booth.spec: Add fedora compatibility provides
  * build: Add option to enable tests during rpmbuild
  * build: Substitute hauser and haclient in RPM
  * build: Substitute python dependency in RPM
  * build: Substitute glue dependency in RPM
  * build: Substitute asciidoc or asciidoctor for RPM
  * build: Rework build of RPM
  * build: Use git-version-gen
  * configure: Always let automake set python vars
  * build: Delete cov directory on clean
  * build: Make sure tarball contains all needed files
  * build: Remove unneeded OS detection section
  * build: Make generating of HTML man work
- remove applied patch
  test-fix-read-a-issue.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632830400">- Use Python 3 for -test subpackage.</changelog>
  <changelog author="pgajdos@suse.com" date="1659009600">- Update to version 1.0+20220724.dce51f9:
  * ticket: Fix compiler warning
  * rpm: use new package name for pacemaker devel on opensuse
  * Revert "Refactor: main: substitute is_auth_req macro"
  * doc: Describe debug config file option
  * handler: Use only signal-safe functions
  * main: Use only signal-safe functions
  * fix bashisms (use printf instead of echo)
- fixes CVE-2022-2553 [bsc#1201946]</changelog>
  <changelog author="ygao@suse.com" date="1663070400">- Update to version 1.0+20220815.f40c2d5:
  * configure: Modernize configure.ac a bit
- spec: BuildRequires firewall-macros (bsc#1202959)
- spec: optionally BuildRequires cluster-glue-devel instead of libglue-devel</changelog>
  <changelog author="varkoly@suse.com" date="1678968000">- Update to version 1.0+20221117.9d4029a:
  * man: Add generated html files into gitignore
  * man: remove literal paragraph format from boothd.8
  * man: Remove italic bold formatting
  * man: Do not format __defaults__
  * man: Indent peers counters
  * man: Move debug description to better place
  * test: Add test for unknown/unexpected keyword
  * config: Include protocol in error message
  * config: Include keyword in error message
  * unit file: Remove Alias directive</changelog>
  <changelog author="varkoly@suse.com" date="1699963200">- Update to version 1.1+git0.09b0074:
  * build: Prepare version 1.1 release
  * build: Make distcheck work for non-root user
  * build: Include icons in release tarballs
  * build: Add release.mk
  * build: Add gitlog-to-changelog
  * tests: Fix Python 3.12 warning
  * attr: Fix glib hash_table != NULL assert
  * attr: Fix memory leak for list and get operation
  * main: Fix exit code on grant/revoke command error
  * spec: Migrate to SPDX license
- Added hardening to systemd service(s). Added patch(es):
  * harden_booth-arbitrator.service.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-3049 [bsc#1226032], specially crafted hash can lead to invalid HMAC being accepted by Booth server
  + booth-CVE-2024-3049.patch</changelog>
</package>
<package pkgid="067fd53c6c051d57e0ae17fa72d1ddd27ff2f6456ca4036007219928460ed6e1" name="booth" arch="x86_64">
  <version epoch="0" ver="1.1+git0.09b0074" rel="150600.3.3.1"/>
  <changelog author="dmuhamedagic@suse.com" date="1460116800">- Update to version v1.0_14_g4d35ac7:
  + main: fix address matching procedure (bsc#994999)</changelog>
  <changelog author="tchvatal@suse.com" date="1467288000">- Reduce conditionals to only keep the default values
- Run systemd macros in proper phases
- Convert to pkgconfig dependencies</changelog>
  <changelog author="ygao@suse.com" date="1468411200">- spec: Set the owner of /etc/booth and booth.conf.example to hacluster:haclient (bsc#968865)</changelog>
  <changelog author="ygao@suse.com" date="1487160000">- spec: fix booth-test containing undesired build sources
- make log contain source address of unknown site
- main: initialize Libcrypt properly before the first use (bsc#1025463)
- extprog: fix race condition on ticket loss (bsc#1025463)
- attr: fix wrong order for hash free functions (bsc#1025463)
- attr: set time string to "" when time is not set
- extprog: fix pid test
- ticket: reset next state on ticket reset
- alternative logger (in service-runnable script)
- allow skipping "coredump nursing" phase
- alternative "nametag" provider: libsystemd
- alternative range2random provider: glib
- alternative logging provider: libqb
- offer alternatives to libraries from (cluster-)glue
- setup_tcp_listener: close socket when no longer needed
- read_client: sizeof(*struct_ptr) instead of sizeof(struct_ptr) (bsc#1025463)
- get_local_id: denoopize dependent condition (signedness issue) (bsc#1025463)
- list_ticket: fix a memleak in case of buffer too small (bsc#1025463)
- do_status: close lock file when no longer needed
- format_peers: fix a memleak in case of buffer too small (bsc#1025463)
- read_config: close config file when no longer needed
- make foreach_* macros use variable refs passed as arguments (bsc#1025463)
- prevent possible truncation w/ invalid geoattrs in CIB (bsc#1025463)
- build: add proper zlib build-time check + link flag + spec's BR
- build: allow requesting no HTML man + use in spec
- fixup: sanitize true-false logic for "daemonize"
- Upstream version cs: b270a78130f40e648844671b3652919d86e1aef4</changelog>
  <changelog author="ckowalczyk@suse.com" date="1496404800">- Build: create and set working directory (bsc#1039727)
  * bug-1039727_booth-build.patch
- Configuration: handle hostnames in booth.conf file (bsc#1037422)
- Upstream version cs: bbddf969550969784b76b743baecdcf72796bdf7</changelog>
  <changelog author="ckowalczyk@suse.com" date="1498132800">- Clinet commands: fixed local IP addresses for booth grant, list, and peers
  commands (bsc#1045067)
  * bug-1045067_booth-fix-booth-grant-cmd.patch
- Patch bug-1039727_booth-build.patch merged to upstream:
  * Build: create and set working directory (bsc#1039727)
- Upstream version cs: 766d61881b2cb576645821322edda0edea04828d</changelog>
  <changelog author="ckowalczyk@suse.com" date="1512129600">- Tickets: added manual tickets, which allow handling 2-site setup
  (fate#322100)
- Debug mode: fixed the interaction with resource agents (bsc#1046790)
- Patch file bug-1045067_booth-fix-booth-grant-cmd.patch has been removed
  after the code being merged to upstream:
  * Clinet commands: fixed local IP addresses for booth grant, list,
    and peers commands (bsc#1045067)
- Upstream version cs: d4cb8cbdaf87e46f636c3d06730b902b79bdcb9c</changelog>
  <changelog author="ckowalczyk@suse.com" date="1519300800">- Build: replace SuSEFirewall2 by firewalld (fate#320794) in booth.spec
- Upstream version cs: 80199f9477fb4fbf8809f31986139efe3f4ef790</changelog>
  <changelog author="ckowalczyk@suse.com" date="1525089600">- Doc: fix the documentation build with asciidoctor (bsc#1075764):
  * fix_asciidoc_build.patch
- Service: restart arbitrator on failure
- Upstream version cs: c2389e3020e8a3780b679cf0c9857bd608e99fa1</changelog>
  <changelog author="aburlakov@suse.com" date="1547726400">- Update to version 1.0+20190112.497c0b9:
  * fix_asciidoc_build.patch is removed, because the tarball already contains the changes.
  * Low: handler: fix spurious warning on alleged "fall-through" in switch (bsc#1123312)
  * Low: main: fix hypothetical file path double traversal discrepancy (bsc#1123310)
  * Med: attr: fix derefence of unspecified value pointer (bsc#1123308)
  * maint: ocf + script: eliminate some false positives with ShellCheck (bsc#1123303)
  * test: unit-test.py: daemon will not stay in foreground with -D anymore (bsc#1123302)
  * test: avoid dangerous mutable/sticky default value (bsc#1123301)
  * test: drop/comment out superfluous imports (bsc#1123300)
  * test: drop underqualified identifier in unittest's 2.6 compat "polyfill" (bsc#1123299)
  * test: remove superfluous shebangs for import-only modules (bsc#1123297)
  * maint: fix typos introduced in 4bb484a (bsc#1123296)
  * maint: fix thinko in .gitignore introduced in 5a457ee (bsc#1123294)
  * Fix malformed man title (bsc#1123290)
  * Handle multi-leader situation for manual tickets. Added manual tickets to Life Tests framework (bsc#1123289)
  * Feature: add manual mode to booth tickets (bsc#1123287)
  * Fix GCC-7 warning on buffer size (bsc#1123285)</changelog>
  <changelog author="aburlakov@suse.com" date="1548676800">- test: fix read -a &lt;&lt;&lt; issue (bsc#1123313)
  * test-fix-read-a-issue.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1597838400">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="aburlakov@suse.com" date="1600257600">- Update to version 1.0+20200702.2f043da:
  * transport: Check fcntl return value
  * transport: setsockopt failures are not critical
  * pacemaker: Change rv handling of pcmk_get_attr
  * pacemaker: Express intention about logical or
  * main: mkdir failure is not critical
  * pacemaker: Handle updated exit code of crm_ticket
  * main: Delete lockfile when signal arrive too early
  * main: Accept longer config and lock file names
  * Fix gcc-10 warnings for multiple definition of pcmk_handler
  * Fix gcc-10 warnings for packed struct members
  * Use pkg-config to configure libxml-2.0</changelog>
  <changelog author="varkoly@suse.com" date="1622116800">- Update to version 1.0+20210519.bfb2f92:
  * config: Remove deprecated net functions
  * configure: drop unnecessary check and define
  * configure: move exec_prefix sanitizer closer to prefix
  * configure: drop dead code
  * configure: drop unnecessary macro
  * configure: use PKG_CONFIG to detect pacemaker user/group
  * configure: use resource-agents pkg-config info to determine ocfdir
  * configure: add BOOTH_PKG_CHECK_VAR macro to wrap PKG_CHECK_VAR
  * configure: detect and init pkg-config with proper macro
  * configure: Simplify libqb detection when libqb is not installed in standard paths
  * [build] ship booth.pc with basic booth build information for downstream packages to use
  * booth.spec: Change naming scheme for upgrades
  * boot.spec.in: Package html files when generated
  * build: Fix building of html docs with asciidoc
  * git-version-gen: Use fallback for git-archive
  * configure: Make sure without-html_man works
  * test: Add compatibility with iproute ss command
  * test: fix the delimiter in the here-string
  * build: Remove bashisms
  * booth.spec: Add fedora compatibility provides
  * build: Add option to enable tests during rpmbuild
  * build: Substitute hauser and haclient in RPM
  * build: Substitute python dependency in RPM
  * build: Substitute glue dependency in RPM
  * build: Substitute asciidoc or asciidoctor for RPM
  * build: Rework build of RPM
  * build: Use git-version-gen
  * configure: Always let automake set python vars
  * build: Delete cov directory on clean
  * build: Make sure tarball contains all needed files
  * build: Remove unneeded OS detection section
  * build: Make generating of HTML man work
- remove applied patch
  test-fix-read-a-issue.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632830400">- Use Python 3 for -test subpackage.</changelog>
  <changelog author="pgajdos@suse.com" date="1659009600">- Update to version 1.0+20220724.dce51f9:
  * ticket: Fix compiler warning
  * rpm: use new package name for pacemaker devel on opensuse
  * Revert "Refactor: main: substitute is_auth_req macro"
  * doc: Describe debug config file option
  * handler: Use only signal-safe functions
  * main: Use only signal-safe functions
  * fix bashisms (use printf instead of echo)
- fixes CVE-2022-2553 [bsc#1201946]</changelog>
  <changelog author="ygao@suse.com" date="1663070400">- Update to version 1.0+20220815.f40c2d5:
  * configure: Modernize configure.ac a bit
- spec: BuildRequires firewall-macros (bsc#1202959)
- spec: optionally BuildRequires cluster-glue-devel instead of libglue-devel</changelog>
  <changelog author="varkoly@suse.com" date="1678968000">- Update to version 1.0+20221117.9d4029a:
  * man: Add generated html files into gitignore
  * man: remove literal paragraph format from boothd.8
  * man: Remove italic bold formatting
  * man: Do not format __defaults__
  * man: Indent peers counters
  * man: Move debug description to better place
  * test: Add test for unknown/unexpected keyword
  * config: Include protocol in error message
  * config: Include keyword in error message
  * unit file: Remove Alias directive</changelog>
  <changelog author="varkoly@suse.com" date="1699963200">- Update to version 1.1+git0.09b0074:
  * build: Prepare version 1.1 release
  * build: Make distcheck work for non-root user
  * build: Include icons in release tarballs
  * build: Add release.mk
  * build: Add gitlog-to-changelog
  * tests: Fix Python 3.12 warning
  * attr: Fix glib hash_table != NULL assert
  * attr: Fix memory leak for list and get operation
  * main: Fix exit code on grant/revoke command error
  * spec: Migrate to SPDX license
- Added hardening to systemd service(s). Added patch(es):
  * harden_booth-arbitrator.service.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-3049 [bsc#1226032], specially crafted hash can lead to invalid HMAC being accepted by Booth server
  + booth-CVE-2024-3049.patch</changelog>
</package>
<package pkgid="6531ce9fae07a394dc30fb64529b1c0bd5de6c49a5b497735e4eba40c3a1a523" name="booth-test" arch="aarch64">
  <version epoch="0" ver="1.1+git0.09b0074" rel="150600.3.3.1"/>
  <changelog author="dmuhamedagic@suse.com" date="1460116800">- Update to version v1.0_14_g4d35ac7:
  + main: fix address matching procedure (bsc#994999)</changelog>
  <changelog author="tchvatal@suse.com" date="1467288000">- Reduce conditionals to only keep the default values
- Run systemd macros in proper phases
- Convert to pkgconfig dependencies</changelog>
  <changelog author="ygao@suse.com" date="1468411200">- spec: Set the owner of /etc/booth and booth.conf.example to hacluster:haclient (bsc#968865)</changelog>
  <changelog author="ygao@suse.com" date="1487160000">- spec: fix booth-test containing undesired build sources
- make log contain source address of unknown site
- main: initialize Libcrypt properly before the first use (bsc#1025463)
- extprog: fix race condition on ticket loss (bsc#1025463)
- attr: fix wrong order for hash free functions (bsc#1025463)
- attr: set time string to "" when time is not set
- extprog: fix pid test
- ticket: reset next state on ticket reset
- alternative logger (in service-runnable script)
- allow skipping "coredump nursing" phase
- alternative "nametag" provider: libsystemd
- alternative range2random provider: glib
- alternative logging provider: libqb
- offer alternatives to libraries from (cluster-)glue
- setup_tcp_listener: close socket when no longer needed
- read_client: sizeof(*struct_ptr) instead of sizeof(struct_ptr) (bsc#1025463)
- get_local_id: denoopize dependent condition (signedness issue) (bsc#1025463)
- list_ticket: fix a memleak in case of buffer too small (bsc#1025463)
- do_status: close lock file when no longer needed
- format_peers: fix a memleak in case of buffer too small (bsc#1025463)
- read_config: close config file when no longer needed
- make foreach_* macros use variable refs passed as arguments (bsc#1025463)
- prevent possible truncation w/ invalid geoattrs in CIB (bsc#1025463)
- build: add proper zlib build-time check + link flag + spec's BR
- build: allow requesting no HTML man + use in spec
- fixup: sanitize true-false logic for "daemonize"
- Upstream version cs: b270a78130f40e648844671b3652919d86e1aef4</changelog>
  <changelog author="ckowalczyk@suse.com" date="1496404800">- Build: create and set working directory (bsc#1039727)
  * bug-1039727_booth-build.patch
- Configuration: handle hostnames in booth.conf file (bsc#1037422)
- Upstream version cs: bbddf969550969784b76b743baecdcf72796bdf7</changelog>
  <changelog author="ckowalczyk@suse.com" date="1498132800">- Clinet commands: fixed local IP addresses for booth grant, list, and peers
  commands (bsc#1045067)
  * bug-1045067_booth-fix-booth-grant-cmd.patch
- Patch bug-1039727_booth-build.patch merged to upstream:
  * Build: create and set working directory (bsc#1039727)
- Upstream version cs: 766d61881b2cb576645821322edda0edea04828d</changelog>
  <changelog author="ckowalczyk@suse.com" date="1512129600">- Tickets: added manual tickets, which allow handling 2-site setup
  (fate#322100)
- Debug mode: fixed the interaction with resource agents (bsc#1046790)
- Patch file bug-1045067_booth-fix-booth-grant-cmd.patch has been removed
  after the code being merged to upstream:
  * Clinet commands: fixed local IP addresses for booth grant, list,
    and peers commands (bsc#1045067)
- Upstream version cs: d4cb8cbdaf87e46f636c3d06730b902b79bdcb9c</changelog>
  <changelog author="ckowalczyk@suse.com" date="1519300800">- Build: replace SuSEFirewall2 by firewalld (fate#320794) in booth.spec
- Upstream version cs: 80199f9477fb4fbf8809f31986139efe3f4ef790</changelog>
  <changelog author="ckowalczyk@suse.com" date="1525089600">- Doc: fix the documentation build with asciidoctor (bsc#1075764):
  * fix_asciidoc_build.patch
- Service: restart arbitrator on failure
- Upstream version cs: c2389e3020e8a3780b679cf0c9857bd608e99fa1</changelog>
  <changelog author="aburlakov@suse.com" date="1547726400">- Update to version 1.0+20190112.497c0b9:
  * fix_asciidoc_build.patch is removed, because the tarball already contains the changes.
  * Low: handler: fix spurious warning on alleged "fall-through" in switch (bsc#1123312)
  * Low: main: fix hypothetical file path double traversal discrepancy (bsc#1123310)
  * Med: attr: fix derefence of unspecified value pointer (bsc#1123308)
  * maint: ocf + script: eliminate some false positives with ShellCheck (bsc#1123303)
  * test: unit-test.py: daemon will not stay in foreground with -D anymore (bsc#1123302)
  * test: avoid dangerous mutable/sticky default value (bsc#1123301)
  * test: drop/comment out superfluous imports (bsc#1123300)
  * test: drop underqualified identifier in unittest's 2.6 compat "polyfill" (bsc#1123299)
  * test: remove superfluous shebangs for import-only modules (bsc#1123297)
  * maint: fix typos introduced in 4bb484a (bsc#1123296)
  * maint: fix thinko in .gitignore introduced in 5a457ee (bsc#1123294)
  * Fix malformed man title (bsc#1123290)
  * Handle multi-leader situation for manual tickets. Added manual tickets to Life Tests framework (bsc#1123289)
  * Feature: add manual mode to booth tickets (bsc#1123287)
  * Fix GCC-7 warning on buffer size (bsc#1123285)</changelog>
  <changelog author="aburlakov@suse.com" date="1548676800">- test: fix read -a &lt;&lt;&lt; issue (bsc#1123313)
  * test-fix-read-a-issue.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1597838400">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="aburlakov@suse.com" date="1600257600">- Update to version 1.0+20200702.2f043da:
  * transport: Check fcntl return value
  * transport: setsockopt failures are not critical
  * pacemaker: Change rv handling of pcmk_get_attr
  * pacemaker: Express intention about logical or
  * main: mkdir failure is not critical
  * pacemaker: Handle updated exit code of crm_ticket
  * main: Delete lockfile when signal arrive too early
  * main: Accept longer config and lock file names
  * Fix gcc-10 warnings for multiple definition of pcmk_handler
  * Fix gcc-10 warnings for packed struct members
  * Use pkg-config to configure libxml-2.0</changelog>
  <changelog author="varkoly@suse.com" date="1622116800">- Update to version 1.0+20210519.bfb2f92:
  * config: Remove deprecated net functions
  * configure: drop unnecessary check and define
  * configure: move exec_prefix sanitizer closer to prefix
  * configure: drop dead code
  * configure: drop unnecessary macro
  * configure: use PKG_CONFIG to detect pacemaker user/group
  * configure: use resource-agents pkg-config info to determine ocfdir
  * configure: add BOOTH_PKG_CHECK_VAR macro to wrap PKG_CHECK_VAR
  * configure: detect and init pkg-config with proper macro
  * configure: Simplify libqb detection when libqb is not installed in standard paths
  * [build] ship booth.pc with basic booth build information for downstream packages to use
  * booth.spec: Change naming scheme for upgrades
  * boot.spec.in: Package html files when generated
  * build: Fix building of html docs with asciidoc
  * git-version-gen: Use fallback for git-archive
  * configure: Make sure without-html_man works
  * test: Add compatibility with iproute ss command
  * test: fix the delimiter in the here-string
  * build: Remove bashisms
  * booth.spec: Add fedora compatibility provides
  * build: Add option to enable tests during rpmbuild
  * build: Substitute hauser and haclient in RPM
  * build: Substitute python dependency in RPM
  * build: Substitute glue dependency in RPM
  * build: Substitute asciidoc or asciidoctor for RPM
  * build: Rework build of RPM
  * build: Use git-version-gen
  * configure: Always let automake set python vars
  * build: Delete cov directory on clean
  * build: Make sure tarball contains all needed files
  * build: Remove unneeded OS detection section
  * build: Make generating of HTML man work
- remove applied patch
  test-fix-read-a-issue.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632830400">- Use Python 3 for -test subpackage.</changelog>
  <changelog author="pgajdos@suse.com" date="1659009600">- Update to version 1.0+20220724.dce51f9:
  * ticket: Fix compiler warning
  * rpm: use new package name for pacemaker devel on opensuse
  * Revert "Refactor: main: substitute is_auth_req macro"
  * doc: Describe debug config file option
  * handler: Use only signal-safe functions
  * main: Use only signal-safe functions
  * fix bashisms (use printf instead of echo)
- fixes CVE-2022-2553 [bsc#1201946]</changelog>
  <changelog author="ygao@suse.com" date="1663070400">- Update to version 1.0+20220815.f40c2d5:
  * configure: Modernize configure.ac a bit
- spec: BuildRequires firewall-macros (bsc#1202959)
- spec: optionally BuildRequires cluster-glue-devel instead of libglue-devel</changelog>
  <changelog author="varkoly@suse.com" date="1678968000">- Update to version 1.0+20221117.9d4029a:
  * man: Add generated html files into gitignore
  * man: remove literal paragraph format from boothd.8
  * man: Remove italic bold formatting
  * man: Do not format __defaults__
  * man: Indent peers counters
  * man: Move debug description to better place
  * test: Add test for unknown/unexpected keyword
  * config: Include protocol in error message
  * config: Include keyword in error message
  * unit file: Remove Alias directive</changelog>
  <changelog author="varkoly@suse.com" date="1699963200">- Update to version 1.1+git0.09b0074:
  * build: Prepare version 1.1 release
  * build: Make distcheck work for non-root user
  * build: Include icons in release tarballs
  * build: Add release.mk
  * build: Add gitlog-to-changelog
  * tests: Fix Python 3.12 warning
  * attr: Fix glib hash_table != NULL assert
  * attr: Fix memory leak for list and get operation
  * main: Fix exit code on grant/revoke command error
  * spec: Migrate to SPDX license
- Added hardening to systemd service(s). Added patch(es):
  * harden_booth-arbitrator.service.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-3049 [bsc#1226032], specially crafted hash can lead to invalid HMAC being accepted by Booth server
  + booth-CVE-2024-3049.patch</changelog>
</package>
<package pkgid="5f0f2de9e454d6b462e5bc9d55b5f78bf084f4712ac7bae1d92a73764c188ad8" name="booth-test" arch="ppc64le">
  <version epoch="0" ver="1.1+git0.09b0074" rel="150600.3.3.1"/>
  <changelog author="dmuhamedagic@suse.com" date="1460116800">- Update to version v1.0_14_g4d35ac7:
  + main: fix address matching procedure (bsc#994999)</changelog>
  <changelog author="tchvatal@suse.com" date="1467288000">- Reduce conditionals to only keep the default values
- Run systemd macros in proper phases
- Convert to pkgconfig dependencies</changelog>
  <changelog author="ygao@suse.com" date="1468411200">- spec: Set the owner of /etc/booth and booth.conf.example to hacluster:haclient (bsc#968865)</changelog>
  <changelog author="ygao@suse.com" date="1487160000">- spec: fix booth-test containing undesired build sources
- make log contain source address of unknown site
- main: initialize Libcrypt properly before the first use (bsc#1025463)
- extprog: fix race condition on ticket loss (bsc#1025463)
- attr: fix wrong order for hash free functions (bsc#1025463)
- attr: set time string to "" when time is not set
- extprog: fix pid test
- ticket: reset next state on ticket reset
- alternative logger (in service-runnable script)
- allow skipping "coredump nursing" phase
- alternative "nametag" provider: libsystemd
- alternative range2random provider: glib
- alternative logging provider: libqb
- offer alternatives to libraries from (cluster-)glue
- setup_tcp_listener: close socket when no longer needed
- read_client: sizeof(*struct_ptr) instead of sizeof(struct_ptr) (bsc#1025463)
- get_local_id: denoopize dependent condition (signedness issue) (bsc#1025463)
- list_ticket: fix a memleak in case of buffer too small (bsc#1025463)
- do_status: close lock file when no longer needed
- format_peers: fix a memleak in case of buffer too small (bsc#1025463)
- read_config: close config file when no longer needed
- make foreach_* macros use variable refs passed as arguments (bsc#1025463)
- prevent possible truncation w/ invalid geoattrs in CIB (bsc#1025463)
- build: add proper zlib build-time check + link flag + spec's BR
- build: allow requesting no HTML man + use in spec
- fixup: sanitize true-false logic for "daemonize"
- Upstream version cs: b270a78130f40e648844671b3652919d86e1aef4</changelog>
  <changelog author="ckowalczyk@suse.com" date="1496404800">- Build: create and set working directory (bsc#1039727)
  * bug-1039727_booth-build.patch
- Configuration: handle hostnames in booth.conf file (bsc#1037422)
- Upstream version cs: bbddf969550969784b76b743baecdcf72796bdf7</changelog>
  <changelog author="ckowalczyk@suse.com" date="1498132800">- Clinet commands: fixed local IP addresses for booth grant, list, and peers
  commands (bsc#1045067)
  * bug-1045067_booth-fix-booth-grant-cmd.patch
- Patch bug-1039727_booth-build.patch merged to upstream:
  * Build: create and set working directory (bsc#1039727)
- Upstream version cs: 766d61881b2cb576645821322edda0edea04828d</changelog>
  <changelog author="ckowalczyk@suse.com" date="1512129600">- Tickets: added manual tickets, which allow handling 2-site setup
  (fate#322100)
- Debug mode: fixed the interaction with resource agents (bsc#1046790)
- Patch file bug-1045067_booth-fix-booth-grant-cmd.patch has been removed
  after the code being merged to upstream:
  * Clinet commands: fixed local IP addresses for booth grant, list,
    and peers commands (bsc#1045067)
- Upstream version cs: d4cb8cbdaf87e46f636c3d06730b902b79bdcb9c</changelog>
  <changelog author="ckowalczyk@suse.com" date="1519300800">- Build: replace SuSEFirewall2 by firewalld (fate#320794) in booth.spec
- Upstream version cs: 80199f9477fb4fbf8809f31986139efe3f4ef790</changelog>
  <changelog author="ckowalczyk@suse.com" date="1525089600">- Doc: fix the documentation build with asciidoctor (bsc#1075764):
  * fix_asciidoc_build.patch
- Service: restart arbitrator on failure
- Upstream version cs: c2389e3020e8a3780b679cf0c9857bd608e99fa1</changelog>
  <changelog author="aburlakov@suse.com" date="1547726400">- Update to version 1.0+20190112.497c0b9:
  * fix_asciidoc_build.patch is removed, because the tarball already contains the changes.
  * Low: handler: fix spurious warning on alleged "fall-through" in switch (bsc#1123312)
  * Low: main: fix hypothetical file path double traversal discrepancy (bsc#1123310)
  * Med: attr: fix derefence of unspecified value pointer (bsc#1123308)
  * maint: ocf + script: eliminate some false positives with ShellCheck (bsc#1123303)
  * test: unit-test.py: daemon will not stay in foreground with -D anymore (bsc#1123302)
  * test: avoid dangerous mutable/sticky default value (bsc#1123301)
  * test: drop/comment out superfluous imports (bsc#1123300)
  * test: drop underqualified identifier in unittest's 2.6 compat "polyfill" (bsc#1123299)
  * test: remove superfluous shebangs for import-only modules (bsc#1123297)
  * maint: fix typos introduced in 4bb484a (bsc#1123296)
  * maint: fix thinko in .gitignore introduced in 5a457ee (bsc#1123294)
  * Fix malformed man title (bsc#1123290)
  * Handle multi-leader situation for manual tickets. Added manual tickets to Life Tests framework (bsc#1123289)
  * Feature: add manual mode to booth tickets (bsc#1123287)
  * Fix GCC-7 warning on buffer size (bsc#1123285)</changelog>
  <changelog author="aburlakov@suse.com" date="1548676800">- test: fix read -a &lt;&lt;&lt; issue (bsc#1123313)
  * test-fix-read-a-issue.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1597838400">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="aburlakov@suse.com" date="1600257600">- Update to version 1.0+20200702.2f043da:
  * transport: Check fcntl return value
  * transport: setsockopt failures are not critical
  * pacemaker: Change rv handling of pcmk_get_attr
  * pacemaker: Express intention about logical or
  * main: mkdir failure is not critical
  * pacemaker: Handle updated exit code of crm_ticket
  * main: Delete lockfile when signal arrive too early
  * main: Accept longer config and lock file names
  * Fix gcc-10 warnings for multiple definition of pcmk_handler
  * Fix gcc-10 warnings for packed struct members
  * Use pkg-config to configure libxml-2.0</changelog>
  <changelog author="varkoly@suse.com" date="1622116800">- Update to version 1.0+20210519.bfb2f92:
  * config: Remove deprecated net functions
  * configure: drop unnecessary check and define
  * configure: move exec_prefix sanitizer closer to prefix
  * configure: drop dead code
  * configure: drop unnecessary macro
  * configure: use PKG_CONFIG to detect pacemaker user/group
  * configure: use resource-agents pkg-config info to determine ocfdir
  * configure: add BOOTH_PKG_CHECK_VAR macro to wrap PKG_CHECK_VAR
  * configure: detect and init pkg-config with proper macro
  * configure: Simplify libqb detection when libqb is not installed in standard paths
  * [build] ship booth.pc with basic booth build information for downstream packages to use
  * booth.spec: Change naming scheme for upgrades
  * boot.spec.in: Package html files when generated
  * build: Fix building of html docs with asciidoc
  * git-version-gen: Use fallback for git-archive
  * configure: Make sure without-html_man works
  * test: Add compatibility with iproute ss command
  * test: fix the delimiter in the here-string
  * build: Remove bashisms
  * booth.spec: Add fedora compatibility provides
  * build: Add option to enable tests during rpmbuild
  * build: Substitute hauser and haclient in RPM
  * build: Substitute python dependency in RPM
  * build: Substitute glue dependency in RPM
  * build: Substitute asciidoc or asciidoctor for RPM
  * build: Rework build of RPM
  * build: Use git-version-gen
  * configure: Always let automake set python vars
  * build: Delete cov directory on clean
  * build: Make sure tarball contains all needed files
  * build: Remove unneeded OS detection section
  * build: Make generating of HTML man work
- remove applied patch
  test-fix-read-a-issue.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632830400">- Use Python 3 for -test subpackage.</changelog>
  <changelog author="pgajdos@suse.com" date="1659009600">- Update to version 1.0+20220724.dce51f9:
  * ticket: Fix compiler warning
  * rpm: use new package name for pacemaker devel on opensuse
  * Revert "Refactor: main: substitute is_auth_req macro"
  * doc: Describe debug config file option
  * handler: Use only signal-safe functions
  * main: Use only signal-safe functions
  * fix bashisms (use printf instead of echo)
- fixes CVE-2022-2553 [bsc#1201946]</changelog>
  <changelog author="ygao@suse.com" date="1663070400">- Update to version 1.0+20220815.f40c2d5:
  * configure: Modernize configure.ac a bit
- spec: BuildRequires firewall-macros (bsc#1202959)
- spec: optionally BuildRequires cluster-glue-devel instead of libglue-devel</changelog>
  <changelog author="varkoly@suse.com" date="1678968000">- Update to version 1.0+20221117.9d4029a:
  * man: Add generated html files into gitignore
  * man: remove literal paragraph format from boothd.8
  * man: Remove italic bold formatting
  * man: Do not format __defaults__
  * man: Indent peers counters
  * man: Move debug description to better place
  * test: Add test for unknown/unexpected keyword
  * config: Include protocol in error message
  * config: Include keyword in error message
  * unit file: Remove Alias directive</changelog>
  <changelog author="varkoly@suse.com" date="1699963200">- Update to version 1.1+git0.09b0074:
  * build: Prepare version 1.1 release
  * build: Make distcheck work for non-root user
  * build: Include icons in release tarballs
  * build: Add release.mk
  * build: Add gitlog-to-changelog
  * tests: Fix Python 3.12 warning
  * attr: Fix glib hash_table != NULL assert
  * attr: Fix memory leak for list and get operation
  * main: Fix exit code on grant/revoke command error
  * spec: Migrate to SPDX license
- Added hardening to systemd service(s). Added patch(es):
  * harden_booth-arbitrator.service.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-3049 [bsc#1226032], specially crafted hash can lead to invalid HMAC being accepted by Booth server
  + booth-CVE-2024-3049.patch</changelog>
</package>
<package pkgid="0d4268f9fdf245aa195414c67d07d6b001e63daf897a4c034106f7c855fd3862" name="booth-test" arch="s390x">
  <version epoch="0" ver="1.1+git0.09b0074" rel="150600.3.3.1"/>
  <changelog author="dmuhamedagic@suse.com" date="1460116800">- Update to version v1.0_14_g4d35ac7:
  + main: fix address matching procedure (bsc#994999)</changelog>
  <changelog author="tchvatal@suse.com" date="1467288000">- Reduce conditionals to only keep the default values
- Run systemd macros in proper phases
- Convert to pkgconfig dependencies</changelog>
  <changelog author="ygao@suse.com" date="1468411200">- spec: Set the owner of /etc/booth and booth.conf.example to hacluster:haclient (bsc#968865)</changelog>
  <changelog author="ygao@suse.com" date="1487160000">- spec: fix booth-test containing undesired build sources
- make log contain source address of unknown site
- main: initialize Libcrypt properly before the first use (bsc#1025463)
- extprog: fix race condition on ticket loss (bsc#1025463)
- attr: fix wrong order for hash free functions (bsc#1025463)
- attr: set time string to "" when time is not set
- extprog: fix pid test
- ticket: reset next state on ticket reset
- alternative logger (in service-runnable script)
- allow skipping "coredump nursing" phase
- alternative "nametag" provider: libsystemd
- alternative range2random provider: glib
- alternative logging provider: libqb
- offer alternatives to libraries from (cluster-)glue
- setup_tcp_listener: close socket when no longer needed
- read_client: sizeof(*struct_ptr) instead of sizeof(struct_ptr) (bsc#1025463)
- get_local_id: denoopize dependent condition (signedness issue) (bsc#1025463)
- list_ticket: fix a memleak in case of buffer too small (bsc#1025463)
- do_status: close lock file when no longer needed
- format_peers: fix a memleak in case of buffer too small (bsc#1025463)
- read_config: close config file when no longer needed
- make foreach_* macros use variable refs passed as arguments (bsc#1025463)
- prevent possible truncation w/ invalid geoattrs in CIB (bsc#1025463)
- build: add proper zlib build-time check + link flag + spec's BR
- build: allow requesting no HTML man + use in spec
- fixup: sanitize true-false logic for "daemonize"
- Upstream version cs: b270a78130f40e648844671b3652919d86e1aef4</changelog>
  <changelog author="ckowalczyk@suse.com" date="1496404800">- Build: create and set working directory (bsc#1039727)
  * bug-1039727_booth-build.patch
- Configuration: handle hostnames in booth.conf file (bsc#1037422)
- Upstream version cs: bbddf969550969784b76b743baecdcf72796bdf7</changelog>
  <changelog author="ckowalczyk@suse.com" date="1498132800">- Clinet commands: fixed local IP addresses for booth grant, list, and peers
  commands (bsc#1045067)
  * bug-1045067_booth-fix-booth-grant-cmd.patch
- Patch bug-1039727_booth-build.patch merged to upstream:
  * Build: create and set working directory (bsc#1039727)
- Upstream version cs: 766d61881b2cb576645821322edda0edea04828d</changelog>
  <changelog author="ckowalczyk@suse.com" date="1512129600">- Tickets: added manual tickets, which allow handling 2-site setup
  (fate#322100)
- Debug mode: fixed the interaction with resource agents (bsc#1046790)
- Patch file bug-1045067_booth-fix-booth-grant-cmd.patch has been removed
  after the code being merged to upstream:
  * Clinet commands: fixed local IP addresses for booth grant, list,
    and peers commands (bsc#1045067)
- Upstream version cs: d4cb8cbdaf87e46f636c3d06730b902b79bdcb9c</changelog>
  <changelog author="ckowalczyk@suse.com" date="1519300800">- Build: replace SuSEFirewall2 by firewalld (fate#320794) in booth.spec
- Upstream version cs: 80199f9477fb4fbf8809f31986139efe3f4ef790</changelog>
  <changelog author="ckowalczyk@suse.com" date="1525089600">- Doc: fix the documentation build with asciidoctor (bsc#1075764):
  * fix_asciidoc_build.patch
- Service: restart arbitrator on failure
- Upstream version cs: c2389e3020e8a3780b679cf0c9857bd608e99fa1</changelog>
  <changelog author="aburlakov@suse.com" date="1547726400">- Update to version 1.0+20190112.497c0b9:
  * fix_asciidoc_build.patch is removed, because the tarball already contains the changes.
  * Low: handler: fix spurious warning on alleged "fall-through" in switch (bsc#1123312)
  * Low: main: fix hypothetical file path double traversal discrepancy (bsc#1123310)
  * Med: attr: fix derefence of unspecified value pointer (bsc#1123308)
  * maint: ocf + script: eliminate some false positives with ShellCheck (bsc#1123303)
  * test: unit-test.py: daemon will not stay in foreground with -D anymore (bsc#1123302)
  * test: avoid dangerous mutable/sticky default value (bsc#1123301)
  * test: drop/comment out superfluous imports (bsc#1123300)
  * test: drop underqualified identifier in unittest's 2.6 compat "polyfill" (bsc#1123299)
  * test: remove superfluous shebangs for import-only modules (bsc#1123297)
  * maint: fix typos introduced in 4bb484a (bsc#1123296)
  * maint: fix thinko in .gitignore introduced in 5a457ee (bsc#1123294)
  * Fix malformed man title (bsc#1123290)
  * Handle multi-leader situation for manual tickets. Added manual tickets to Life Tests framework (bsc#1123289)
  * Feature: add manual mode to booth tickets (bsc#1123287)
  * Fix GCC-7 warning on buffer size (bsc#1123285)</changelog>
  <changelog author="aburlakov@suse.com" date="1548676800">- test: fix read -a &lt;&lt;&lt; issue (bsc#1123313)
  * test-fix-read-a-issue.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1597838400">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="aburlakov@suse.com" date="1600257600">- Update to version 1.0+20200702.2f043da:
  * transport: Check fcntl return value
  * transport: setsockopt failures are not critical
  * pacemaker: Change rv handling of pcmk_get_attr
  * pacemaker: Express intention about logical or
  * main: mkdir failure is not critical
  * pacemaker: Handle updated exit code of crm_ticket
  * main: Delete lockfile when signal arrive too early
  * main: Accept longer config and lock file names
  * Fix gcc-10 warnings for multiple definition of pcmk_handler
  * Fix gcc-10 warnings for packed struct members
  * Use pkg-config to configure libxml-2.0</changelog>
  <changelog author="varkoly@suse.com" date="1622116800">- Update to version 1.0+20210519.bfb2f92:
  * config: Remove deprecated net functions
  * configure: drop unnecessary check and define
  * configure: move exec_prefix sanitizer closer to prefix
  * configure: drop dead code
  * configure: drop unnecessary macro
  * configure: use PKG_CONFIG to detect pacemaker user/group
  * configure: use resource-agents pkg-config info to determine ocfdir
  * configure: add BOOTH_PKG_CHECK_VAR macro to wrap PKG_CHECK_VAR
  * configure: detect and init pkg-config with proper macro
  * configure: Simplify libqb detection when libqb is not installed in standard paths
  * [build] ship booth.pc with basic booth build information for downstream packages to use
  * booth.spec: Change naming scheme for upgrades
  * boot.spec.in: Package html files when generated
  * build: Fix building of html docs with asciidoc
  * git-version-gen: Use fallback for git-archive
  * configure: Make sure without-html_man works
  * test: Add compatibility with iproute ss command
  * test: fix the delimiter in the here-string
  * build: Remove bashisms
  * booth.spec: Add fedora compatibility provides
  * build: Add option to enable tests during rpmbuild
  * build: Substitute hauser and haclient in RPM
  * build: Substitute python dependency in RPM
  * build: Substitute glue dependency in RPM
  * build: Substitute asciidoc or asciidoctor for RPM
  * build: Rework build of RPM
  * build: Use git-version-gen
  * configure: Always let automake set python vars
  * build: Delete cov directory on clean
  * build: Make sure tarball contains all needed files
  * build: Remove unneeded OS detection section
  * build: Make generating of HTML man work
- remove applied patch
  test-fix-read-a-issue.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632830400">- Use Python 3 for -test subpackage.</changelog>
  <changelog author="pgajdos@suse.com" date="1659009600">- Update to version 1.0+20220724.dce51f9:
  * ticket: Fix compiler warning
  * rpm: use new package name for pacemaker devel on opensuse
  * Revert "Refactor: main: substitute is_auth_req macro"
  * doc: Describe debug config file option
  * handler: Use only signal-safe functions
  * main: Use only signal-safe functions
  * fix bashisms (use printf instead of echo)
- fixes CVE-2022-2553 [bsc#1201946]</changelog>
  <changelog author="ygao@suse.com" date="1663070400">- Update to version 1.0+20220815.f40c2d5:
  * configure: Modernize configure.ac a bit
- spec: BuildRequires firewall-macros (bsc#1202959)
- spec: optionally BuildRequires cluster-glue-devel instead of libglue-devel</changelog>
  <changelog author="varkoly@suse.com" date="1678968000">- Update to version 1.0+20221117.9d4029a:
  * man: Add generated html files into gitignore
  * man: remove literal paragraph format from boothd.8
  * man: Remove italic bold formatting
  * man: Do not format __defaults__
  * man: Indent peers counters
  * man: Move debug description to better place
  * test: Add test for unknown/unexpected keyword
  * config: Include protocol in error message
  * config: Include keyword in error message
  * unit file: Remove Alias directive</changelog>
  <changelog author="varkoly@suse.com" date="1699963200">- Update to version 1.1+git0.09b0074:
  * build: Prepare version 1.1 release
  * build: Make distcheck work for non-root user
  * build: Include icons in release tarballs
  * build: Add release.mk
  * build: Add gitlog-to-changelog
  * tests: Fix Python 3.12 warning
  * attr: Fix glib hash_table != NULL assert
  * attr: Fix memory leak for list and get operation
  * main: Fix exit code on grant/revoke command error
  * spec: Migrate to SPDX license
- Added hardening to systemd service(s). Added patch(es):
  * harden_booth-arbitrator.service.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-3049 [bsc#1226032], specially crafted hash can lead to invalid HMAC being accepted by Booth server
  + booth-CVE-2024-3049.patch</changelog>
</package>
<package pkgid="df975a7ba76ba3351a19b1f3d3464426a5ae1968ada2d2aace6900fb56c4ced0" name="booth-test" arch="x86_64">
  <version epoch="0" ver="1.1+git0.09b0074" rel="150600.3.3.1"/>
  <changelog author="dmuhamedagic@suse.com" date="1460116800">- Update to version v1.0_14_g4d35ac7:
  + main: fix address matching procedure (bsc#994999)</changelog>
  <changelog author="tchvatal@suse.com" date="1467288000">- Reduce conditionals to only keep the default values
- Run systemd macros in proper phases
- Convert to pkgconfig dependencies</changelog>
  <changelog author="ygao@suse.com" date="1468411200">- spec: Set the owner of /etc/booth and booth.conf.example to hacluster:haclient (bsc#968865)</changelog>
  <changelog author="ygao@suse.com" date="1487160000">- spec: fix booth-test containing undesired build sources
- make log contain source address of unknown site
- main: initialize Libcrypt properly before the first use (bsc#1025463)
- extprog: fix race condition on ticket loss (bsc#1025463)
- attr: fix wrong order for hash free functions (bsc#1025463)
- attr: set time string to "" when time is not set
- extprog: fix pid test
- ticket: reset next state on ticket reset
- alternative logger (in service-runnable script)
- allow skipping "coredump nursing" phase
- alternative "nametag" provider: libsystemd
- alternative range2random provider: glib
- alternative logging provider: libqb
- offer alternatives to libraries from (cluster-)glue
- setup_tcp_listener: close socket when no longer needed
- read_client: sizeof(*struct_ptr) instead of sizeof(struct_ptr) (bsc#1025463)
- get_local_id: denoopize dependent condition (signedness issue) (bsc#1025463)
- list_ticket: fix a memleak in case of buffer too small (bsc#1025463)
- do_status: close lock file when no longer needed
- format_peers: fix a memleak in case of buffer too small (bsc#1025463)
- read_config: close config file when no longer needed
- make foreach_* macros use variable refs passed as arguments (bsc#1025463)
- prevent possible truncation w/ invalid geoattrs in CIB (bsc#1025463)
- build: add proper zlib build-time check + link flag + spec's BR
- build: allow requesting no HTML man + use in spec
- fixup: sanitize true-false logic for "daemonize"
- Upstream version cs: b270a78130f40e648844671b3652919d86e1aef4</changelog>
  <changelog author="ckowalczyk@suse.com" date="1496404800">- Build: create and set working directory (bsc#1039727)
  * bug-1039727_booth-build.patch
- Configuration: handle hostnames in booth.conf file (bsc#1037422)
- Upstream version cs: bbddf969550969784b76b743baecdcf72796bdf7</changelog>
  <changelog author="ckowalczyk@suse.com" date="1498132800">- Clinet commands: fixed local IP addresses for booth grant, list, and peers
  commands (bsc#1045067)
  * bug-1045067_booth-fix-booth-grant-cmd.patch
- Patch bug-1039727_booth-build.patch merged to upstream:
  * Build: create and set working directory (bsc#1039727)
- Upstream version cs: 766d61881b2cb576645821322edda0edea04828d</changelog>
  <changelog author="ckowalczyk@suse.com" date="1512129600">- Tickets: added manual tickets, which allow handling 2-site setup
  (fate#322100)
- Debug mode: fixed the interaction with resource agents (bsc#1046790)
- Patch file bug-1045067_booth-fix-booth-grant-cmd.patch has been removed
  after the code being merged to upstream:
  * Clinet commands: fixed local IP addresses for booth grant, list,
    and peers commands (bsc#1045067)
- Upstream version cs: d4cb8cbdaf87e46f636c3d06730b902b79bdcb9c</changelog>
  <changelog author="ckowalczyk@suse.com" date="1519300800">- Build: replace SuSEFirewall2 by firewalld (fate#320794) in booth.spec
- Upstream version cs: 80199f9477fb4fbf8809f31986139efe3f4ef790</changelog>
  <changelog author="ckowalczyk@suse.com" date="1525089600">- Doc: fix the documentation build with asciidoctor (bsc#1075764):
  * fix_asciidoc_build.patch
- Service: restart arbitrator on failure
- Upstream version cs: c2389e3020e8a3780b679cf0c9857bd608e99fa1</changelog>
  <changelog author="aburlakov@suse.com" date="1547726400">- Update to version 1.0+20190112.497c0b9:
  * fix_asciidoc_build.patch is removed, because the tarball already contains the changes.
  * Low: handler: fix spurious warning on alleged "fall-through" in switch (bsc#1123312)
  * Low: main: fix hypothetical file path double traversal discrepancy (bsc#1123310)
  * Med: attr: fix derefence of unspecified value pointer (bsc#1123308)
  * maint: ocf + script: eliminate some false positives with ShellCheck (bsc#1123303)
  * test: unit-test.py: daemon will not stay in foreground with -D anymore (bsc#1123302)
  * test: avoid dangerous mutable/sticky default value (bsc#1123301)
  * test: drop/comment out superfluous imports (bsc#1123300)
  * test: drop underqualified identifier in unittest's 2.6 compat "polyfill" (bsc#1123299)
  * test: remove superfluous shebangs for import-only modules (bsc#1123297)
  * maint: fix typos introduced in 4bb484a (bsc#1123296)
  * maint: fix thinko in .gitignore introduced in 5a457ee (bsc#1123294)
  * Fix malformed man title (bsc#1123290)
  * Handle multi-leader situation for manual tickets. Added manual tickets to Life Tests framework (bsc#1123289)
  * Feature: add manual mode to booth tickets (bsc#1123287)
  * Fix GCC-7 warning on buffer size (bsc#1123285)</changelog>
  <changelog author="aburlakov@suse.com" date="1548676800">- test: fix read -a &lt;&lt;&lt; issue (bsc#1123313)
  * test-fix-read-a-issue.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1597838400">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="aburlakov@suse.com" date="1600257600">- Update to version 1.0+20200702.2f043da:
  * transport: Check fcntl return value
  * transport: setsockopt failures are not critical
  * pacemaker: Change rv handling of pcmk_get_attr
  * pacemaker: Express intention about logical or
  * main: mkdir failure is not critical
  * pacemaker: Handle updated exit code of crm_ticket
  * main: Delete lockfile when signal arrive too early
  * main: Accept longer config and lock file names
  * Fix gcc-10 warnings for multiple definition of pcmk_handler
  * Fix gcc-10 warnings for packed struct members
  * Use pkg-config to configure libxml-2.0</changelog>
  <changelog author="varkoly@suse.com" date="1622116800">- Update to version 1.0+20210519.bfb2f92:
  * config: Remove deprecated net functions
  * configure: drop unnecessary check and define
  * configure: move exec_prefix sanitizer closer to prefix
  * configure: drop dead code
  * configure: drop unnecessary macro
  * configure: use PKG_CONFIG to detect pacemaker user/group
  * configure: use resource-agents pkg-config info to determine ocfdir
  * configure: add BOOTH_PKG_CHECK_VAR macro to wrap PKG_CHECK_VAR
  * configure: detect and init pkg-config with proper macro
  * configure: Simplify libqb detection when libqb is not installed in standard paths
  * [build] ship booth.pc with basic booth build information for downstream packages to use
  * booth.spec: Change naming scheme for upgrades
  * boot.spec.in: Package html files when generated
  * build: Fix building of html docs with asciidoc
  * git-version-gen: Use fallback for git-archive
  * configure: Make sure without-html_man works
  * test: Add compatibility with iproute ss command
  * test: fix the delimiter in the here-string
  * build: Remove bashisms
  * booth.spec: Add fedora compatibility provides
  * build: Add option to enable tests during rpmbuild
  * build: Substitute hauser and haclient in RPM
  * build: Substitute python dependency in RPM
  * build: Substitute glue dependency in RPM
  * build: Substitute asciidoc or asciidoctor for RPM
  * build: Rework build of RPM
  * build: Use git-version-gen
  * configure: Always let automake set python vars
  * build: Delete cov directory on clean
  * build: Make sure tarball contains all needed files
  * build: Remove unneeded OS detection section
  * build: Make generating of HTML man work
- remove applied patch
  test-fix-read-a-issue.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632830400">- Use Python 3 for -test subpackage.</changelog>
  <changelog author="pgajdos@suse.com" date="1659009600">- Update to version 1.0+20220724.dce51f9:
  * ticket: Fix compiler warning
  * rpm: use new package name for pacemaker devel on opensuse
  * Revert "Refactor: main: substitute is_auth_req macro"
  * doc: Describe debug config file option
  * handler: Use only signal-safe functions
  * main: Use only signal-safe functions
  * fix bashisms (use printf instead of echo)
- fixes CVE-2022-2553 [bsc#1201946]</changelog>
  <changelog author="ygao@suse.com" date="1663070400">- Update to version 1.0+20220815.f40c2d5:
  * configure: Modernize configure.ac a bit
- spec: BuildRequires firewall-macros (bsc#1202959)
- spec: optionally BuildRequires cluster-glue-devel instead of libglue-devel</changelog>
  <changelog author="varkoly@suse.com" date="1678968000">- Update to version 1.0+20221117.9d4029a:
  * man: Add generated html files into gitignore
  * man: remove literal paragraph format from boothd.8
  * man: Remove italic bold formatting
  * man: Do not format __defaults__
  * man: Indent peers counters
  * man: Move debug description to better place
  * test: Add test for unknown/unexpected keyword
  * config: Include protocol in error message
  * config: Include keyword in error message
  * unit file: Remove Alias directive</changelog>
  <changelog author="varkoly@suse.com" date="1699963200">- Update to version 1.1+git0.09b0074:
  * build: Prepare version 1.1 release
  * build: Make distcheck work for non-root user
  * build: Include icons in release tarballs
  * build: Add release.mk
  * build: Add gitlog-to-changelog
  * tests: Fix Python 3.12 warning
  * attr: Fix glib hash_table != NULL assert
  * attr: Fix memory leak for list and get operation
  * main: Fix exit code on grant/revoke command error
  * spec: Migrate to SPDX license
- Added hardening to systemd service(s). Added patch(es):
  * harden_booth-arbitrator.service.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-3049 [bsc#1226032], specially crafted hash can lead to invalid HMAC being accepted by Booth server
  + booth-CVE-2024-3049.patch</changelog>
</package>
<package pkgid="06494b09810c5ea49a713ef8670bb2149ba573be342c7ee3fda98df84e71227f" name="bouncycastle" arch="noarch">
  <version epoch="0" ver="1.78.1" rel="150200.3.29.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1687176000">- Update to version 1.74: [bsc#1212508, CVE-2023-33201]
  * Defects Fixed:
  - AsconEngine: Fixed a buffering bug when decrypting across
    multiple processBytes calls (ascon128a unaffected).
  - Context based sanity checking on PGP signatures has been added.
  - The ParallelHash clone constructor was not copying all fields.
  - The maximimum number of blocks for CTR/SIC modes was 1 block
    less than it should have been.
  * Additional Features and Functionality:
  - The PGP API now supports wildcard key IDs for public key
    based data encryption.
  - LMS now supports SHA256/192, SHAKE256/192, and SHAKE256/256
    (the additional SP 8000-208 parameter sets).
  - The PGP API now supports V5 and V6 AEAD encryption for
    encrypted data packets.
  - The PGP examples have been updated to reflect key size and algorithm
    changes that have occurred since they were first written (10+ years...).
  - (D)TLS: A new callback 'TlsPeer.notifyConnectionClosed' will be called
    when the connection is closed (including by failure).
  - BCJSSE: Improved logging of connection events and include unique IDs
    in connection-specific log messages.
  - BCJSSE: Server now logs the offered cipher suites when it fails to
    select one.
  - BCJSSE: Added support for SSLParameters namedGroups and
    signatureSchemes properties (can also be used via BCJSSE
    extension API in earlier Java versions).
  - DTLS: The initial handshake re-send time is now configurable by
    overriding 'TlsPeer.getHandshakeResendTimeMillis'.
  - DTLS: Added support for connection IDs per RFC 9146.
  - DTLS: Performance of DTLSVerifier has been improved so that it can
    reasonably be used for all incoming packets.
  - Initial support has been added for A Mechanism for Encoding
    Differences in Paired Certificates.
  - The PGP API now supports parsing, encoding, and fingerprinting
    of V6 EC/EdEC keys.
  - A thread safe verifier API has been added to the PGP API to support
    multi-threaded verification of certifications on keys and user IDs.
  - The number of keys/sub-keys in a PGPKeyRing can now be found by
    calling PGPKeyRing.size().
  - The PQC algorithms LMS/HSS, SPHINCS+, Dilithium, Falcon, and NTRU
    are now supported directly by the BC provider.
  * Notes:
  - The now defunct PQC SIKE algorithm has been removed, this has also
    meant the removal of its resource files so the provider is now quite
    a bit smaller.
  - As a precaution, HC128 now enforces a 128 bit IV, previous behaviour
    for shorter IVs can be supported where required by padding the IV to
    the 128 bits with zero.
  - PGP encrypted data generation now uses integrity protection by default.
    Previous behaviour for encrypted data can be supported where required
    by calling PGPDataEncryptorBuilder.setWithIntegrityPacket(false) when
    data encryption is set up.
  - There are now additional sanity checks in place to prevent accidental
    mis-use of PGPSignature objects. If this change causes any issues, you
    might want to check what your code is up to as there is probably a bug.
  * Security Advisories:
  - CVE-2023-33201: this release fixes an issue with the X509LDAPCertStoreSpi
    where a specially crafted certificate subject could be used to try and
    extract extra information out of an LDAP server with wild-card matthing
    enabled.
  * Rebase bouncycastle-javadoc.patch
  * Add bouncycastle-notests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1697630400">- Update to version 1.76:
  * Defects Fixed:
  - Service allocation in the provider could fail due to the lack
    of a permission block. This has been fixed.
  - JceKeyFingerPrintCalculator has been generalised for different
    providers by using "SHA-256" for the algorithm string.
  - BCJSSE: Fixed a regression in 1.74 (NullPointerException) that
    prevents a BCJSSE server from negotiating TLSv1.1 or earlier.
  - DTLS: Fixed server support for client_certificate_type extension.
  - Cipher.unwrap() for HQC could fail due to a miscalculation of
    the length of the KEM packet. This has been fixed.
  - There was exposure to a Java 7 method in the Java 5 to Java 8
    BCTLS jar which could cause issues with some TLS 1.2 cipher
    suites running on older JVMs. This is now fixed.
  * Additional Features and Functionality:
  - BCJSSE: Following OpenJDK, finalizers have been removed from
    SSLSocket subclasses. Applications should close sockets and
    not rely on garbage collection.
  - BCJSSE: Added support for boolean system property
    "jdk.tls.client.useCompatibilityMode" (default "true").
  - DTLS: Added server support for session resumption.
  - JcaPKCS10CertificationRequest will now work with EC on the
    OpenJDK provider.
  - TimeStamp generation now supports the SHA3 algorithm set.
  - The SPHINCS+ simple parameters are now fully supported in the
    BCPQC provider.
  - Kyber, Classic McEliece, HQC, and Bike now supported by the
    CRMF/CMS/CMP APIs.
  - Builder classes have been add for PGP ASCII Armored streams
    allowing CRCs and versions to now be optional.
  - An UnknownPacket type has been added to the PGP APIs to allow
    for forwards compatibility with upcoming revisions to the standard.
  * Rebase patch bouncycastle-notests.patch
- Update to version 1.75:
  * Defects Fixed:
  - Several Java 8 method calls were accidentally introduced in
    the Java 5 to Java 8 build. The affected classes have been
    refactored to remove this.
  - (D)TLS: renegotiation after resumption now fixed to avoid
    breaking connection.
  * Notes:
  - The ASN.1 core package has had some dead and retired methods
    cleaned up and removed.</changelog>
  <changelog author="pmonreal@suse.com" date="1701691200">- Update to version 1.77:
  * Defects Fixed:
  - Using an unescaped '=' in an X.500 RDN would result in the
    RDN being truncated silently. The issue is now detected and
    an exception is thrown.
  - asn1.eac.CertificateBody was returning certificateEffectiveDate
    from getCertificateExpirationDate(). This has been fixed to
    return certificateExpirationDate.
  - DTLS: Fixed retransmission in response to re-receipt of an
    aggregated ChangeCipherSpec.
  - (D)TLS: Fixed compliance for supported_groups extension.
    Server will no longer negotiate an EC cipher suite using a
    default curve when the ClientHello includes the supported_groups
    extension but it contains no curves in common with the server.
    Similarly, a DH cipher suite will not be negotiated when the
    ClientHello includes supported_groups, containing at least one
    FFDHE group, but none in common with the server.
  - IllegalStateException was being thrown by Ed25519/Ed448 SignatureSpi.
  - TLS: class annotation issues that could occur between the BC
    provider and the TLS API for the GCMParameterSpec class when
    the jars were loaded on the boot class path have been addressed.
  - Attempt to create an ASN.1 OID from a zero length byte array
    is now caught at construction time.
  - Attempt to create an X.509 extension block which is empty will
    now be blocked cause an exception.
  - IES implementation will now accept a null ParameterSpec if no
    nonce is needed.
  - An internal method in Arrays was failing to construct its
    failure message correctly on an error.
  - HSSKeyPublicParameters.generateLMSContext() would fail for a
    unit depth key.
  * Additional Features and Functionality:
  - BCJSSE: Added org.bouncycastle.jsse.client.omitSigAlgsCertExtension
    and org.bouncycastle.jsse.server.omitSigAlgsCertExtension boolean
    system properties to control (for client and server resp.) whether
    the signature_algorithms_cert extension should be omitted if it
    would be identical to signature_algorithms. Defaults to true, the
    historical behaviour.
  - The low-level HPKE API now allows the sender to specify an
    ephemeral key pair.
  - Support has been added for the delta-certificate requests in line
    with the current Chameleon Cert draft from the IETF.
  - Some accommodation has been added for historical systems to
    accommodate variations in the SHA-1 digest OID for CMS SignedData.
  - TLS: the TLS API will now try "RSAwithDigestAndMFG1" as well as
    the newer RSAPSS algorithm names when used with the JCA.
  - TLS: RSA key exchange cipher suites are now disabled by default.
  - Support has been added for PKCS#10 requests to allow certificates
    using the altSignature/altPublicKey extensions.
  * Notes:
  - Kyber and Dilithium have been updated according to the latest
    draft of the standard. Dilithium-AES and Kyber-AES have now been
    removed. Kyber now produces 256 bit secrets for all parameter sets
    (in line with the draft standard).
  - NTRU has been updated to produce 256 bit secrets in line with Kyber.
  - SPHINCS+ can now be used to generate certificates in line with
    those used by (Open Quantum Safe) OQS.
  - Falcon object idenitifiers are now in line with OQS as well.
  - PQC CMS SignedData now defaults to SHA-256 for signed attributes
    rather than SHAKE-256. This is also a compatibility change, but may
    change further again as the IETF standard for CMS is updated.</changelog>
  <changelog author="pmonreal@suse.com" date="1714392000">- Update to version 1.78: [bsc#1223252, CVE-2024-30171]
  * Security Advisories.
  - CVE-2024-29857: Importing an EC certificate with specially crafted
    F2m parameters can cause high CPU usage during parameter evaluation.
  - CVE-2024-30171: Possible timing based leakage in RSA based handshakes
    due to exception processing eliminated.
  - CVE-2024-30172: Crafted signature and public key can be used to
    trigger an infinite loop in the Ed25519 verification code.
  - CVE-2024-301XX: When endpoint identification is enabled in the BCJSSE
    and an SSL socket is not created with an explicit hostname (as happens
    with HttpsURLConnection), hostname verification could be performed
    against a DNS-resolved IP address. This has been fixed.
  * Defects Fixed:
  - Issues with a dangling weak reference causing intermittent
    NullPointerExceptions in the OcspCache have been fixed.
  - Issues with non-constant time RSA operations in TLS handshakes.
  - Issue with Ed25519, Ed448 signature verification causing intermittent
    infinite loop have been fixed.
  - Issues with non-constant time ML-KEM implementation ("Kyber Slash").
  - Align ML-KEM input validation with FIPS 203 IPD requirements.
  - Make PEM parsing more forgiving of whitespace to align with RFC 7468.
  - Fix CCM length checks with large nonce sizes (n=12, n=13).
  - EAC: Fixed the CertificateBody ASN.1 type to support an optional
    Certification Authority Reference in a Certificate Request.
  - ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized
    and the contents octets for both types are now limited to 4096 bytes.
  - BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(),
    which could cause issues for HSM RSA keys.
  - BCJSSE: When endpoint identification is enabled and an SSL socket is not
    created with an explicit hostname (as happens with HttpsURLConnection),
    hostname verification could be performed against a DNS-resolved IP address.
  - The missing module import of java.logging to the provider module has been added.
  - GOST ASN.1 public key alg parameters are now compliant with RFC 9215.
  - An off-by-one error in the encoding for EccP256CurvePoint for ITS.
  - PEM Parser now enforces PEM headers to start at the beginning of the line
    to be meaningful.
  * Additional Features and Functionality.
  - An implementation of MLS (RFC 9420 - The Messaging Layer Security Protocol)
    has been added as a new module.
  - NTRU now supports NTRU-HPS4096-1229 and NTRU-HRSS-1373.
  - Improvements to PGP support, including Camellia key wrapping and Curve25519,
    Curve448 key types (including XDH with HKDF).
  - Added initial support for ML-KEM in TLS.
  - Added XWing hybrid KEM construction (X25519 + ML-KEM-768).
  - Introduced initial KEMSpi support (NTRU, SNTRU Prime) for JDK 21+.
  - Introduced initial composite signature support for X509 Certificates.
  - PKCS#12 now supports PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM,
    PKCS12-DEF-AES256-AES128, and PKCS12-DEF-AES256-AES128-GCM.
  - The default type for the KeyStore.getInstance("PKCS12", "BC") can now be set
    using the org.bouncycastle.pkcs12.default system/security property.
  - The PGP SExpParser will now handle Ed25519 and Ed448 keys.
  - Dilithium and Kyber key encoding updated to latest Draft RFCs
    (draft-ietf-lamps-dilithium-certificates and draft-ietf-lamps-kyber-certificates)
  - Support has been added for encryption key derivation using HKDF in CMS, see
    draft-housley-lamps-cms-cek-hkdf-sha256.
  - X500Name now recognises jurisdiction{C,ST,L} DNs.
  - CertPathValidationContext and CertificatePoliciesValidation now include
    implementations of Memoable.
  - The Composite post-quantum signatures implementation has been updated to the
    latest draft draft-ounsworth-pq-composite-sigs.
  * Full release notes: bouncycastle.org/releasenotes.html#r1rv78
  * Rebase bouncycastle-notests.patch</changelog>
  <changelog author="fstrba@suse.com" date="1714392001">- Update to version 1.78.1
  * Defects Fixed:
  - The new dependency of the the PGP API on the bcutil jar was
    missing from the module jar, the OSGi manifest, and the Maven
    POM. This has been fixed.
  - Missing exports and duplicate imports have been added/removed
    from the OSGi manifests.
  - The OSGi manifests now have the same bundle IDs as 1.77 and
    lock down dependencies to the equivalent variations
  - A check in the X.509 Extensions class preventing the parsing
    of empty extensions has been removed.</changelog>
</package>
<package pkgid="d8d44c522264af035e7bc9668ff97e4b51d8e6c03e81886fd9d59c6a56b8e610" name="bouncycastle" arch="src">
  <version epoch="0" ver="1.78.1" rel="150200.3.29.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1687176000">- Update to version 1.74: [bsc#1212508, CVE-2023-33201]
  * Defects Fixed:
  - AsconEngine: Fixed a buffering bug when decrypting across
    multiple processBytes calls (ascon128a unaffected).
  - Context based sanity checking on PGP signatures has been added.
  - The ParallelHash clone constructor was not copying all fields.
  - The maximimum number of blocks for CTR/SIC modes was 1 block
    less than it should have been.
  * Additional Features and Functionality:
  - The PGP API now supports wildcard key IDs for public key
    based data encryption.
  - LMS now supports SHA256/192, SHAKE256/192, and SHAKE256/256
    (the additional SP 8000-208 parameter sets).
  - The PGP API now supports V5 and V6 AEAD encryption for
    encrypted data packets.
  - The PGP examples have been updated to reflect key size and algorithm
    changes that have occurred since they were first written (10+ years...).
  - (D)TLS: A new callback 'TlsPeer.notifyConnectionClosed' will be called
    when the connection is closed (including by failure).
  - BCJSSE: Improved logging of connection events and include unique IDs
    in connection-specific log messages.
  - BCJSSE: Server now logs the offered cipher suites when it fails to
    select one.
  - BCJSSE: Added support for SSLParameters namedGroups and
    signatureSchemes properties (can also be used via BCJSSE
    extension API in earlier Java versions).
  - DTLS: The initial handshake re-send time is now configurable by
    overriding 'TlsPeer.getHandshakeResendTimeMillis'.
  - DTLS: Added support for connection IDs per RFC 9146.
  - DTLS: Performance of DTLSVerifier has been improved so that it can
    reasonably be used for all incoming packets.
  - Initial support has been added for A Mechanism for Encoding
    Differences in Paired Certificates.
  - The PGP API now supports parsing, encoding, and fingerprinting
    of V6 EC/EdEC keys.
  - A thread safe verifier API has been added to the PGP API to support
    multi-threaded verification of certifications on keys and user IDs.
  - The number of keys/sub-keys in a PGPKeyRing can now be found by
    calling PGPKeyRing.size().
  - The PQC algorithms LMS/HSS, SPHINCS+, Dilithium, Falcon, and NTRU
    are now supported directly by the BC provider.
  * Notes:
  - The now defunct PQC SIKE algorithm has been removed, this has also
    meant the removal of its resource files so the provider is now quite
    a bit smaller.
  - As a precaution, HC128 now enforces a 128 bit IV, previous behaviour
    for shorter IVs can be supported where required by padding the IV to
    the 128 bits with zero.
  - PGP encrypted data generation now uses integrity protection by default.
    Previous behaviour for encrypted data can be supported where required
    by calling PGPDataEncryptorBuilder.setWithIntegrityPacket(false) when
    data encryption is set up.
  - There are now additional sanity checks in place to prevent accidental
    mis-use of PGPSignature objects. If this change causes any issues, you
    might want to check what your code is up to as there is probably a bug.
  * Security Advisories:
  - CVE-2023-33201: this release fixes an issue with the X509LDAPCertStoreSpi
    where a specially crafted certificate subject could be used to try and
    extract extra information out of an LDAP server with wild-card matthing
    enabled.
  * Rebase bouncycastle-javadoc.patch
  * Add bouncycastle-notests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1697630400">- Update to version 1.76:
  * Defects Fixed:
  - Service allocation in the provider could fail due to the lack
    of a permission block. This has been fixed.
  - JceKeyFingerPrintCalculator has been generalised for different
    providers by using "SHA-256" for the algorithm string.
  - BCJSSE: Fixed a regression in 1.74 (NullPointerException) that
    prevents a BCJSSE server from negotiating TLSv1.1 or earlier.
  - DTLS: Fixed server support for client_certificate_type extension.
  - Cipher.unwrap() for HQC could fail due to a miscalculation of
    the length of the KEM packet. This has been fixed.
  - There was exposure to a Java 7 method in the Java 5 to Java 8
    BCTLS jar which could cause issues with some TLS 1.2 cipher
    suites running on older JVMs. This is now fixed.
  * Additional Features and Functionality:
  - BCJSSE: Following OpenJDK, finalizers have been removed from
    SSLSocket subclasses. Applications should close sockets and
    not rely on garbage collection.
  - BCJSSE: Added support for boolean system property
    "jdk.tls.client.useCompatibilityMode" (default "true").
  - DTLS: Added server support for session resumption.
  - JcaPKCS10CertificationRequest will now work with EC on the
    OpenJDK provider.
  - TimeStamp generation now supports the SHA3 algorithm set.
  - The SPHINCS+ simple parameters are now fully supported in the
    BCPQC provider.
  - Kyber, Classic McEliece, HQC, and Bike now supported by the
    CRMF/CMS/CMP APIs.
  - Builder classes have been add for PGP ASCII Armored streams
    allowing CRCs and versions to now be optional.
  - An UnknownPacket type has been added to the PGP APIs to allow
    for forwards compatibility with upcoming revisions to the standard.
  * Rebase patch bouncycastle-notests.patch
- Update to version 1.75:
  * Defects Fixed:
  - Several Java 8 method calls were accidentally introduced in
    the Java 5 to Java 8 build. The affected classes have been
    refactored to remove this.
  - (D)TLS: renegotiation after resumption now fixed to avoid
    breaking connection.
  * Notes:
  - The ASN.1 core package has had some dead and retired methods
    cleaned up and removed.</changelog>
  <changelog author="pmonreal@suse.com" date="1701691200">- Update to version 1.77:
  * Defects Fixed:
  - Using an unescaped '=' in an X.500 RDN would result in the
    RDN being truncated silently. The issue is now detected and
    an exception is thrown.
  - asn1.eac.CertificateBody was returning certificateEffectiveDate
    from getCertificateExpirationDate(). This has been fixed to
    return certificateExpirationDate.
  - DTLS: Fixed retransmission in response to re-receipt of an
    aggregated ChangeCipherSpec.
  - (D)TLS: Fixed compliance for supported_groups extension.
    Server will no longer negotiate an EC cipher suite using a
    default curve when the ClientHello includes the supported_groups
    extension but it contains no curves in common with the server.
    Similarly, a DH cipher suite will not be negotiated when the
    ClientHello includes supported_groups, containing at least one
    FFDHE group, but none in common with the server.
  - IllegalStateException was being thrown by Ed25519/Ed448 SignatureSpi.
  - TLS: class annotation issues that could occur between the BC
    provider and the TLS API for the GCMParameterSpec class when
    the jars were loaded on the boot class path have been addressed.
  - Attempt to create an ASN.1 OID from a zero length byte array
    is now caught at construction time.
  - Attempt to create an X.509 extension block which is empty will
    now be blocked cause an exception.
  - IES implementation will now accept a null ParameterSpec if no
    nonce is needed.
  - An internal method in Arrays was failing to construct its
    failure message correctly on an error.
  - HSSKeyPublicParameters.generateLMSContext() would fail for a
    unit depth key.
  * Additional Features and Functionality:
  - BCJSSE: Added org.bouncycastle.jsse.client.omitSigAlgsCertExtension
    and org.bouncycastle.jsse.server.omitSigAlgsCertExtension boolean
    system properties to control (for client and server resp.) whether
    the signature_algorithms_cert extension should be omitted if it
    would be identical to signature_algorithms. Defaults to true, the
    historical behaviour.
  - The low-level HPKE API now allows the sender to specify an
    ephemeral key pair.
  - Support has been added for the delta-certificate requests in line
    with the current Chameleon Cert draft from the IETF.
  - Some accommodation has been added for historical systems to
    accommodate variations in the SHA-1 digest OID for CMS SignedData.
  - TLS: the TLS API will now try "RSAwithDigestAndMFG1" as well as
    the newer RSAPSS algorithm names when used with the JCA.
  - TLS: RSA key exchange cipher suites are now disabled by default.
  - Support has been added for PKCS#10 requests to allow certificates
    using the altSignature/altPublicKey extensions.
  * Notes:
  - Kyber and Dilithium have been updated according to the latest
    draft of the standard. Dilithium-AES and Kyber-AES have now been
    removed. Kyber now produces 256 bit secrets for all parameter sets
    (in line with the draft standard).
  - NTRU has been updated to produce 256 bit secrets in line with Kyber.
  - SPHINCS+ can now be used to generate certificates in line with
    those used by (Open Quantum Safe) OQS.
  - Falcon object idenitifiers are now in line with OQS as well.
  - PQC CMS SignedData now defaults to SHA-256 for signed attributes
    rather than SHAKE-256. This is also a compatibility change, but may
    change further again as the IETF standard for CMS is updated.</changelog>
  <changelog author="pmonreal@suse.com" date="1714392000">- Update to version 1.78: [bsc#1223252, CVE-2024-30171]
  * Security Advisories.
  - CVE-2024-29857: Importing an EC certificate with specially crafted
    F2m parameters can cause high CPU usage during parameter evaluation.
  - CVE-2024-30171: Possible timing based leakage in RSA based handshakes
    due to exception processing eliminated.
  - CVE-2024-30172: Crafted signature and public key can be used to
    trigger an infinite loop in the Ed25519 verification code.
  - CVE-2024-301XX: When endpoint identification is enabled in the BCJSSE
    and an SSL socket is not created with an explicit hostname (as happens
    with HttpsURLConnection), hostname verification could be performed
    against a DNS-resolved IP address. This has been fixed.
  * Defects Fixed:
  - Issues with a dangling weak reference causing intermittent
    NullPointerExceptions in the OcspCache have been fixed.
  - Issues with non-constant time RSA operations in TLS handshakes.
  - Issue with Ed25519, Ed448 signature verification causing intermittent
    infinite loop have been fixed.
  - Issues with non-constant time ML-KEM implementation ("Kyber Slash").
  - Align ML-KEM input validation with FIPS 203 IPD requirements.
  - Make PEM parsing more forgiving of whitespace to align with RFC 7468.
  - Fix CCM length checks with large nonce sizes (n=12, n=13).
  - EAC: Fixed the CertificateBody ASN.1 type to support an optional
    Certification Authority Reference in a Certificate Request.
  - ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized
    and the contents octets for both types are now limited to 4096 bytes.
  - BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(),
    which could cause issues for HSM RSA keys.
  - BCJSSE: When endpoint identification is enabled and an SSL socket is not
    created with an explicit hostname (as happens with HttpsURLConnection),
    hostname verification could be performed against a DNS-resolved IP address.
  - The missing module import of java.logging to the provider module has been added.
  - GOST ASN.1 public key alg parameters are now compliant with RFC 9215.
  - An off-by-one error in the encoding for EccP256CurvePoint for ITS.
  - PEM Parser now enforces PEM headers to start at the beginning of the line
    to be meaningful.
  * Additional Features and Functionality.
  - An implementation of MLS (RFC 9420 - The Messaging Layer Security Protocol)
    has been added as a new module.
  - NTRU now supports NTRU-HPS4096-1229 and NTRU-HRSS-1373.
  - Improvements to PGP support, including Camellia key wrapping and Curve25519,
    Curve448 key types (including XDH with HKDF).
  - Added initial support for ML-KEM in TLS.
  - Added XWing hybrid KEM construction (X25519 + ML-KEM-768).
  - Introduced initial KEMSpi support (NTRU, SNTRU Prime) for JDK 21+.
  - Introduced initial composite signature support for X509 Certificates.
  - PKCS#12 now supports PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM,
    PKCS12-DEF-AES256-AES128, and PKCS12-DEF-AES256-AES128-GCM.
  - The default type for the KeyStore.getInstance("PKCS12", "BC") can now be set
    using the org.bouncycastle.pkcs12.default system/security property.
  - The PGP SExpParser will now handle Ed25519 and Ed448 keys.
  - Dilithium and Kyber key encoding updated to latest Draft RFCs
    (draft-ietf-lamps-dilithium-certificates and draft-ietf-lamps-kyber-certificates)
  - Support has been added for encryption key derivation using HKDF in CMS, see
    draft-housley-lamps-cms-cek-hkdf-sha256.
  - X500Name now recognises jurisdiction{C,ST,L} DNs.
  - CertPathValidationContext and CertificatePoliciesValidation now include
    implementations of Memoable.
  - The Composite post-quantum signatures implementation has been updated to the
    latest draft draft-ounsworth-pq-composite-sigs.
  * Full release notes: bouncycastle.org/releasenotes.html#r1rv78
  * Rebase bouncycastle-notests.patch</changelog>
  <changelog author="fstrba@suse.com" date="1714392001">- Update to version 1.78.1
  * Defects Fixed:
  - The new dependency of the the PGP API on the bcutil jar was
    missing from the module jar, the OSGi manifest, and the Maven
    POM. This has been fixed.
  - Missing exports and duplicate imports have been added/removed
    from the OSGi manifests.
  - The OSGi manifests now have the same bundle IDs as 1.77 and
    lock down dependencies to the equivalent variations
  - A check in the X.509 Extensions class preventing the parsing
    of empty extensions has been removed.</changelog>
</package>
<package pkgid="f10c2c33174e8abadb9c558905010413123a647ab2f059e2245fb701c74347cc" name="bouncycastle-javadoc" arch="noarch">
  <version epoch="0" ver="1.78.1" rel="150200.3.29.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1687176000">- Update to version 1.74: [bsc#1212508, CVE-2023-33201]
  * Defects Fixed:
  - AsconEngine: Fixed a buffering bug when decrypting across
    multiple processBytes calls (ascon128a unaffected).
  - Context based sanity checking on PGP signatures has been added.
  - The ParallelHash clone constructor was not copying all fields.
  - The maximimum number of blocks for CTR/SIC modes was 1 block
    less than it should have been.
  * Additional Features and Functionality:
  - The PGP API now supports wildcard key IDs for public key
    based data encryption.
  - LMS now supports SHA256/192, SHAKE256/192, and SHAKE256/256
    (the additional SP 8000-208 parameter sets).
  - The PGP API now supports V5 and V6 AEAD encryption for
    encrypted data packets.
  - The PGP examples have been updated to reflect key size and algorithm
    changes that have occurred since they were first written (10+ years...).
  - (D)TLS: A new callback 'TlsPeer.notifyConnectionClosed' will be called
    when the connection is closed (including by failure).
  - BCJSSE: Improved logging of connection events and include unique IDs
    in connection-specific log messages.
  - BCJSSE: Server now logs the offered cipher suites when it fails to
    select one.
  - BCJSSE: Added support for SSLParameters namedGroups and
    signatureSchemes properties (can also be used via BCJSSE
    extension API in earlier Java versions).
  - DTLS: The initial handshake re-send time is now configurable by
    overriding 'TlsPeer.getHandshakeResendTimeMillis'.
  - DTLS: Added support for connection IDs per RFC 9146.
  - DTLS: Performance of DTLSVerifier has been improved so that it can
    reasonably be used for all incoming packets.
  - Initial support has been added for A Mechanism for Encoding
    Differences in Paired Certificates.
  - The PGP API now supports parsing, encoding, and fingerprinting
    of V6 EC/EdEC keys.
  - A thread safe verifier API has been added to the PGP API to support
    multi-threaded verification of certifications on keys and user IDs.
  - The number of keys/sub-keys in a PGPKeyRing can now be found by
    calling PGPKeyRing.size().
  - The PQC algorithms LMS/HSS, SPHINCS+, Dilithium, Falcon, and NTRU
    are now supported directly by the BC provider.
  * Notes:
  - The now defunct PQC SIKE algorithm has been removed, this has also
    meant the removal of its resource files so the provider is now quite
    a bit smaller.
  - As a precaution, HC128 now enforces a 128 bit IV, previous behaviour
    for shorter IVs can be supported where required by padding the IV to
    the 128 bits with zero.
  - PGP encrypted data generation now uses integrity protection by default.
    Previous behaviour for encrypted data can be supported where required
    by calling PGPDataEncryptorBuilder.setWithIntegrityPacket(false) when
    data encryption is set up.
  - There are now additional sanity checks in place to prevent accidental
    mis-use of PGPSignature objects. If this change causes any issues, you
    might want to check what your code is up to as there is probably a bug.
  * Security Advisories:
  - CVE-2023-33201: this release fixes an issue with the X509LDAPCertStoreSpi
    where a specially crafted certificate subject could be used to try and
    extract extra information out of an LDAP server with wild-card matthing
    enabled.
  * Rebase bouncycastle-javadoc.patch
  * Add bouncycastle-notests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1697630400">- Update to version 1.76:
  * Defects Fixed:
  - Service allocation in the provider could fail due to the lack
    of a permission block. This has been fixed.
  - JceKeyFingerPrintCalculator has been generalised for different
    providers by using "SHA-256" for the algorithm string.
  - BCJSSE: Fixed a regression in 1.74 (NullPointerException) that
    prevents a BCJSSE server from negotiating TLSv1.1 or earlier.
  - DTLS: Fixed server support for client_certificate_type extension.
  - Cipher.unwrap() for HQC could fail due to a miscalculation of
    the length of the KEM packet. This has been fixed.
  - There was exposure to a Java 7 method in the Java 5 to Java 8
    BCTLS jar which could cause issues with some TLS 1.2 cipher
    suites running on older JVMs. This is now fixed.
  * Additional Features and Functionality:
  - BCJSSE: Following OpenJDK, finalizers have been removed from
    SSLSocket subclasses. Applications should close sockets and
    not rely on garbage collection.
  - BCJSSE: Added support for boolean system property
    "jdk.tls.client.useCompatibilityMode" (default "true").
  - DTLS: Added server support for session resumption.
  - JcaPKCS10CertificationRequest will now work with EC on the
    OpenJDK provider.
  - TimeStamp generation now supports the SHA3 algorithm set.
  - The SPHINCS+ simple parameters are now fully supported in the
    BCPQC provider.
  - Kyber, Classic McEliece, HQC, and Bike now supported by the
    CRMF/CMS/CMP APIs.
  - Builder classes have been add for PGP ASCII Armored streams
    allowing CRCs and versions to now be optional.
  - An UnknownPacket type has been added to the PGP APIs to allow
    for forwards compatibility with upcoming revisions to the standard.
  * Rebase patch bouncycastle-notests.patch
- Update to version 1.75:
  * Defects Fixed:
  - Several Java 8 method calls were accidentally introduced in
    the Java 5 to Java 8 build. The affected classes have been
    refactored to remove this.
  - (D)TLS: renegotiation after resumption now fixed to avoid
    breaking connection.
  * Notes:
  - The ASN.1 core package has had some dead and retired methods
    cleaned up and removed.</changelog>
  <changelog author="pmonreal@suse.com" date="1701691200">- Update to version 1.77:
  * Defects Fixed:
  - Using an unescaped '=' in an X.500 RDN would result in the
    RDN being truncated silently. The issue is now detected and
    an exception is thrown.
  - asn1.eac.CertificateBody was returning certificateEffectiveDate
    from getCertificateExpirationDate(). This has been fixed to
    return certificateExpirationDate.
  - DTLS: Fixed retransmission in response to re-receipt of an
    aggregated ChangeCipherSpec.
  - (D)TLS: Fixed compliance for supported_groups extension.
    Server will no longer negotiate an EC cipher suite using a
    default curve when the ClientHello includes the supported_groups
    extension but it contains no curves in common with the server.
    Similarly, a DH cipher suite will not be negotiated when the
    ClientHello includes supported_groups, containing at least one
    FFDHE group, but none in common with the server.
  - IllegalStateException was being thrown by Ed25519/Ed448 SignatureSpi.
  - TLS: class annotation issues that could occur between the BC
    provider and the TLS API for the GCMParameterSpec class when
    the jars were loaded on the boot class path have been addressed.
  - Attempt to create an ASN.1 OID from a zero length byte array
    is now caught at construction time.
  - Attempt to create an X.509 extension block which is empty will
    now be blocked cause an exception.
  - IES implementation will now accept a null ParameterSpec if no
    nonce is needed.
  - An internal method in Arrays was failing to construct its
    failure message correctly on an error.
  - HSSKeyPublicParameters.generateLMSContext() would fail for a
    unit depth key.
  * Additional Features and Functionality:
  - BCJSSE: Added org.bouncycastle.jsse.client.omitSigAlgsCertExtension
    and org.bouncycastle.jsse.server.omitSigAlgsCertExtension boolean
    system properties to control (for client and server resp.) whether
    the signature_algorithms_cert extension should be omitted if it
    would be identical to signature_algorithms. Defaults to true, the
    historical behaviour.
  - The low-level HPKE API now allows the sender to specify an
    ephemeral key pair.
  - Support has been added for the delta-certificate requests in line
    with the current Chameleon Cert draft from the IETF.
  - Some accommodation has been added for historical systems to
    accommodate variations in the SHA-1 digest OID for CMS SignedData.
  - TLS: the TLS API will now try "RSAwithDigestAndMFG1" as well as
    the newer RSAPSS algorithm names when used with the JCA.
  - TLS: RSA key exchange cipher suites are now disabled by default.
  - Support has been added for PKCS#10 requests to allow certificates
    using the altSignature/altPublicKey extensions.
  * Notes:
  - Kyber and Dilithium have been updated according to the latest
    draft of the standard. Dilithium-AES and Kyber-AES have now been
    removed. Kyber now produces 256 bit secrets for all parameter sets
    (in line with the draft standard).
  - NTRU has been updated to produce 256 bit secrets in line with Kyber.
  - SPHINCS+ can now be used to generate certificates in line with
    those used by (Open Quantum Safe) OQS.
  - Falcon object idenitifiers are now in line with OQS as well.
  - PQC CMS SignedData now defaults to SHA-256 for signed attributes
    rather than SHAKE-256. This is also a compatibility change, but may
    change further again as the IETF standard for CMS is updated.</changelog>
  <changelog author="pmonreal@suse.com" date="1714392000">- Update to version 1.78: [bsc#1223252, CVE-2024-30171]
  * Security Advisories.
  - CVE-2024-29857: Importing an EC certificate with specially crafted
    F2m parameters can cause high CPU usage during parameter evaluation.
  - CVE-2024-30171: Possible timing based leakage in RSA based handshakes
    due to exception processing eliminated.
  - CVE-2024-30172: Crafted signature and public key can be used to
    trigger an infinite loop in the Ed25519 verification code.
  - CVE-2024-301XX: When endpoint identification is enabled in the BCJSSE
    and an SSL socket is not created with an explicit hostname (as happens
    with HttpsURLConnection), hostname verification could be performed
    against a DNS-resolved IP address. This has been fixed.
  * Defects Fixed:
  - Issues with a dangling weak reference causing intermittent
    NullPointerExceptions in the OcspCache have been fixed.
  - Issues with non-constant time RSA operations in TLS handshakes.
  - Issue with Ed25519, Ed448 signature verification causing intermittent
    infinite loop have been fixed.
  - Issues with non-constant time ML-KEM implementation ("Kyber Slash").
  - Align ML-KEM input validation with FIPS 203 IPD requirements.
  - Make PEM parsing more forgiving of whitespace to align with RFC 7468.
  - Fix CCM length checks with large nonce sizes (n=12, n=13).
  - EAC: Fixed the CertificateBody ASN.1 type to support an optional
    Certification Authority Reference in a Certificate Request.
  - ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized
    and the contents octets for both types are now limited to 4096 bytes.
  - BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(),
    which could cause issues for HSM RSA keys.
  - BCJSSE: When endpoint identification is enabled and an SSL socket is not
    created with an explicit hostname (as happens with HttpsURLConnection),
    hostname verification could be performed against a DNS-resolved IP address.
  - The missing module import of java.logging to the provider module has been added.
  - GOST ASN.1 public key alg parameters are now compliant with RFC 9215.
  - An off-by-one error in the encoding for EccP256CurvePoint for ITS.
  - PEM Parser now enforces PEM headers to start at the beginning of the line
    to be meaningful.
  * Additional Features and Functionality.
  - An implementation of MLS (RFC 9420 - The Messaging Layer Security Protocol)
    has been added as a new module.
  - NTRU now supports NTRU-HPS4096-1229 and NTRU-HRSS-1373.
  - Improvements to PGP support, including Camellia key wrapping and Curve25519,
    Curve448 key types (including XDH with HKDF).
  - Added initial support for ML-KEM in TLS.
  - Added XWing hybrid KEM construction (X25519 + ML-KEM-768).
  - Introduced initial KEMSpi support (NTRU, SNTRU Prime) for JDK 21+.
  - Introduced initial composite signature support for X509 Certificates.
  - PKCS#12 now supports PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM,
    PKCS12-DEF-AES256-AES128, and PKCS12-DEF-AES256-AES128-GCM.
  - The default type for the KeyStore.getInstance("PKCS12", "BC") can now be set
    using the org.bouncycastle.pkcs12.default system/security property.
  - The PGP SExpParser will now handle Ed25519 and Ed448 keys.
  - Dilithium and Kyber key encoding updated to latest Draft RFCs
    (draft-ietf-lamps-dilithium-certificates and draft-ietf-lamps-kyber-certificates)
  - Support has been added for encryption key derivation using HKDF in CMS, see
    draft-housley-lamps-cms-cek-hkdf-sha256.
  - X500Name now recognises jurisdiction{C,ST,L} DNs.
  - CertPathValidationContext and CertificatePoliciesValidation now include
    implementations of Memoable.
  - The Composite post-quantum signatures implementation has been updated to the
    latest draft draft-ounsworth-pq-composite-sigs.
  * Full release notes: bouncycastle.org/releasenotes.html#r1rv78
  * Rebase bouncycastle-notests.patch</changelog>
  <changelog author="fstrba@suse.com" date="1714392001">- Update to version 1.78.1
  * Defects Fixed:
  - The new dependency of the the PGP API on the bcutil jar was
    missing from the module jar, the OSGi manifest, and the Maven
    POM. This has been fixed.
  - Missing exports and duplicate imports have been added/removed
    from the OSGi manifests.
  - The OSGi manifests now have the same bundle IDs as 1.77 and
    lock down dependencies to the equivalent variations
  - A check in the X.509 Extensions class preventing the parsing
    of empty extensions has been removed.</changelog>
</package>
<package pkgid="7bf041e3e9b2eea43aaa94160781b974a331c9446285311cc138d694fd4c0e94" name="bouncycastle-jmail" arch="noarch">
  <version epoch="0" ver="1.78.1" rel="150200.3.29.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1687176000">- Update to version 1.74: [bsc#1212508, CVE-2023-33201]
  * Defects Fixed:
  - AsconEngine: Fixed a buffering bug when decrypting across
    multiple processBytes calls (ascon128a unaffected).
  - Context based sanity checking on PGP signatures has been added.
  - The ParallelHash clone constructor was not copying all fields.
  - The maximimum number of blocks for CTR/SIC modes was 1 block
    less than it should have been.
  * Additional Features and Functionality:
  - The PGP API now supports wildcard key IDs for public key
    based data encryption.
  - LMS now supports SHA256/192, SHAKE256/192, and SHAKE256/256
    (the additional SP 8000-208 parameter sets).
  - The PGP API now supports V5 and V6 AEAD encryption for
    encrypted data packets.
  - The PGP examples have been updated to reflect key size and algorithm
    changes that have occurred since they were first written (10+ years...).
  - (D)TLS: A new callback 'TlsPeer.notifyConnectionClosed' will be called
    when the connection is closed (including by failure).
  - BCJSSE: Improved logging of connection events and include unique IDs
    in connection-specific log messages.
  - BCJSSE: Server now logs the offered cipher suites when it fails to
    select one.
  - BCJSSE: Added support for SSLParameters namedGroups and
    signatureSchemes properties (can also be used via BCJSSE
    extension API in earlier Java versions).
  - DTLS: The initial handshake re-send time is now configurable by
    overriding 'TlsPeer.getHandshakeResendTimeMillis'.
  - DTLS: Added support for connection IDs per RFC 9146.
  - DTLS: Performance of DTLSVerifier has been improved so that it can
    reasonably be used for all incoming packets.
  - Initial support has been added for A Mechanism for Encoding
    Differences in Paired Certificates.
  - The PGP API now supports parsing, encoding, and fingerprinting
    of V6 EC/EdEC keys.
  - A thread safe verifier API has been added to the PGP API to support
    multi-threaded verification of certifications on keys and user IDs.
  - The number of keys/sub-keys in a PGPKeyRing can now be found by
    calling PGPKeyRing.size().
  - The PQC algorithms LMS/HSS, SPHINCS+, Dilithium, Falcon, and NTRU
    are now supported directly by the BC provider.
  * Notes:
  - The now defunct PQC SIKE algorithm has been removed, this has also
    meant the removal of its resource files so the provider is now quite
    a bit smaller.
  - As a precaution, HC128 now enforces a 128 bit IV, previous behaviour
    for shorter IVs can be supported where required by padding the IV to
    the 128 bits with zero.
  - PGP encrypted data generation now uses integrity protection by default.
    Previous behaviour for encrypted data can be supported where required
    by calling PGPDataEncryptorBuilder.setWithIntegrityPacket(false) when
    data encryption is set up.
  - There are now additional sanity checks in place to prevent accidental
    mis-use of PGPSignature objects. If this change causes any issues, you
    might want to check what your code is up to as there is probably a bug.
  * Security Advisories:
  - CVE-2023-33201: this release fixes an issue with the X509LDAPCertStoreSpi
    where a specially crafted certificate subject could be used to try and
    extract extra information out of an LDAP server with wild-card matthing
    enabled.
  * Rebase bouncycastle-javadoc.patch
  * Add bouncycastle-notests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1697630400">- Update to version 1.76:
  * Defects Fixed:
  - Service allocation in the provider could fail due to the lack
    of a permission block. This has been fixed.
  - JceKeyFingerPrintCalculator has been generalised for different
    providers by using "SHA-256" for the algorithm string.
  - BCJSSE: Fixed a regression in 1.74 (NullPointerException) that
    prevents a BCJSSE server from negotiating TLSv1.1 or earlier.
  - DTLS: Fixed server support for client_certificate_type extension.
  - Cipher.unwrap() for HQC could fail due to a miscalculation of
    the length of the KEM packet. This has been fixed.
  - There was exposure to a Java 7 method in the Java 5 to Java 8
    BCTLS jar which could cause issues with some TLS 1.2 cipher
    suites running on older JVMs. This is now fixed.
  * Additional Features and Functionality:
  - BCJSSE: Following OpenJDK, finalizers have been removed from
    SSLSocket subclasses. Applications should close sockets and
    not rely on garbage collection.
  - BCJSSE: Added support for boolean system property
    "jdk.tls.client.useCompatibilityMode" (default "true").
  - DTLS: Added server support for session resumption.
  - JcaPKCS10CertificationRequest will now work with EC on the
    OpenJDK provider.
  - TimeStamp generation now supports the SHA3 algorithm set.
  - The SPHINCS+ simple parameters are now fully supported in the
    BCPQC provider.
  - Kyber, Classic McEliece, HQC, and Bike now supported by the
    CRMF/CMS/CMP APIs.
  - Builder classes have been add for PGP ASCII Armored streams
    allowing CRCs and versions to now be optional.
  - An UnknownPacket type has been added to the PGP APIs to allow
    for forwards compatibility with upcoming revisions to the standard.
  * Rebase patch bouncycastle-notests.patch
- Update to version 1.75:
  * Defects Fixed:
  - Several Java 8 method calls were accidentally introduced in
    the Java 5 to Java 8 build. The affected classes have been
    refactored to remove this.
  - (D)TLS: renegotiation after resumption now fixed to avoid
    breaking connection.
  * Notes:
  - The ASN.1 core package has had some dead and retired methods
    cleaned up and removed.</changelog>
  <changelog author="pmonreal@suse.com" date="1701691200">- Update to version 1.77:
  * Defects Fixed:
  - Using an unescaped '=' in an X.500 RDN would result in the
    RDN being truncated silently. The issue is now detected and
    an exception is thrown.
  - asn1.eac.CertificateBody was returning certificateEffectiveDate
    from getCertificateExpirationDate(). This has been fixed to
    return certificateExpirationDate.
  - DTLS: Fixed retransmission in response to re-receipt of an
    aggregated ChangeCipherSpec.
  - (D)TLS: Fixed compliance for supported_groups extension.
    Server will no longer negotiate an EC cipher suite using a
    default curve when the ClientHello includes the supported_groups
    extension but it contains no curves in common with the server.
    Similarly, a DH cipher suite will not be negotiated when the
    ClientHello includes supported_groups, containing at least one
    FFDHE group, but none in common with the server.
  - IllegalStateException was being thrown by Ed25519/Ed448 SignatureSpi.
  - TLS: class annotation issues that could occur between the BC
    provider and the TLS API for the GCMParameterSpec class when
    the jars were loaded on the boot class path have been addressed.
  - Attempt to create an ASN.1 OID from a zero length byte array
    is now caught at construction time.
  - Attempt to create an X.509 extension block which is empty will
    now be blocked cause an exception.
  - IES implementation will now accept a null ParameterSpec if no
    nonce is needed.
  - An internal method in Arrays was failing to construct its
    failure message correctly on an error.
  - HSSKeyPublicParameters.generateLMSContext() would fail for a
    unit depth key.
  * Additional Features and Functionality:
  - BCJSSE: Added org.bouncycastle.jsse.client.omitSigAlgsCertExtension
    and org.bouncycastle.jsse.server.omitSigAlgsCertExtension boolean
    system properties to control (for client and server resp.) whether
    the signature_algorithms_cert extension should be omitted if it
    would be identical to signature_algorithms. Defaults to true, the
    historical behaviour.
  - The low-level HPKE API now allows the sender to specify an
    ephemeral key pair.
  - Support has been added for the delta-certificate requests in line
    with the current Chameleon Cert draft from the IETF.
  - Some accommodation has been added for historical systems to
    accommodate variations in the SHA-1 digest OID for CMS SignedData.
  - TLS: the TLS API will now try "RSAwithDigestAndMFG1" as well as
    the newer RSAPSS algorithm names when used with the JCA.
  - TLS: RSA key exchange cipher suites are now disabled by default.
  - Support has been added for PKCS#10 requests to allow certificates
    using the altSignature/altPublicKey extensions.
  * Notes:
  - Kyber and Dilithium have been updated according to the latest
    draft of the standard. Dilithium-AES and Kyber-AES have now been
    removed. Kyber now produces 256 bit secrets for all parameter sets
    (in line with the draft standard).
  - NTRU has been updated to produce 256 bit secrets in line with Kyber.
  - SPHINCS+ can now be used to generate certificates in line with
    those used by (Open Quantum Safe) OQS.
  - Falcon object idenitifiers are now in line with OQS as well.
  - PQC CMS SignedData now defaults to SHA-256 for signed attributes
    rather than SHAKE-256. This is also a compatibility change, but may
    change further again as the IETF standard for CMS is updated.</changelog>
  <changelog author="pmonreal@suse.com" date="1714392000">- Update to version 1.78: [bsc#1223252, CVE-2024-30171]
  * Security Advisories.
  - CVE-2024-29857: Importing an EC certificate with specially crafted
    F2m parameters can cause high CPU usage during parameter evaluation.
  - CVE-2024-30171: Possible timing based leakage in RSA based handshakes
    due to exception processing eliminated.
  - CVE-2024-30172: Crafted signature and public key can be used to
    trigger an infinite loop in the Ed25519 verification code.
  - CVE-2024-301XX: When endpoint identification is enabled in the BCJSSE
    and an SSL socket is not created with an explicit hostname (as happens
    with HttpsURLConnection), hostname verification could be performed
    against a DNS-resolved IP address. This has been fixed.
  * Defects Fixed:
  - Issues with a dangling weak reference causing intermittent
    NullPointerExceptions in the OcspCache have been fixed.
  - Issues with non-constant time RSA operations in TLS handshakes.
  - Issue with Ed25519, Ed448 signature verification causing intermittent
    infinite loop have been fixed.
  - Issues with non-constant time ML-KEM implementation ("Kyber Slash").
  - Align ML-KEM input validation with FIPS 203 IPD requirements.
  - Make PEM parsing more forgiving of whitespace to align with RFC 7468.
  - Fix CCM length checks with large nonce sizes (n=12, n=13).
  - EAC: Fixed the CertificateBody ASN.1 type to support an optional
    Certification Authority Reference in a Certificate Request.
  - ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized
    and the contents octets for both types are now limited to 4096 bytes.
  - BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(),
    which could cause issues for HSM RSA keys.
  - BCJSSE: When endpoint identification is enabled and an SSL socket is not
    created with an explicit hostname (as happens with HttpsURLConnection),
    hostname verification could be performed against a DNS-resolved IP address.
  - The missing module import of java.logging to the provider module has been added.
  - GOST ASN.1 public key alg parameters are now compliant with RFC 9215.
  - An off-by-one error in the encoding for EccP256CurvePoint for ITS.
  - PEM Parser now enforces PEM headers to start at the beginning of the line
    to be meaningful.
  * Additional Features and Functionality.
  - An implementation of MLS (RFC 9420 - The Messaging Layer Security Protocol)
    has been added as a new module.
  - NTRU now supports NTRU-HPS4096-1229 and NTRU-HRSS-1373.
  - Improvements to PGP support, including Camellia key wrapping and Curve25519,
    Curve448 key types (including XDH with HKDF).
  - Added initial support for ML-KEM in TLS.
  - Added XWing hybrid KEM construction (X25519 + ML-KEM-768).
  - Introduced initial KEMSpi support (NTRU, SNTRU Prime) for JDK 21+.
  - Introduced initial composite signature support for X509 Certificates.
  - PKCS#12 now supports PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM,
    PKCS12-DEF-AES256-AES128, and PKCS12-DEF-AES256-AES128-GCM.
  - The default type for the KeyStore.getInstance("PKCS12", "BC") can now be set
    using the org.bouncycastle.pkcs12.default system/security property.
  - The PGP SExpParser will now handle Ed25519 and Ed448 keys.
  - Dilithium and Kyber key encoding updated to latest Draft RFCs
    (draft-ietf-lamps-dilithium-certificates and draft-ietf-lamps-kyber-certificates)
  - Support has been added for encryption key derivation using HKDF in CMS, see
    draft-housley-lamps-cms-cek-hkdf-sha256.
  - X500Name now recognises jurisdiction{C,ST,L} DNs.
  - CertPathValidationContext and CertificatePoliciesValidation now include
    implementations of Memoable.
  - The Composite post-quantum signatures implementation has been updated to the
    latest draft draft-ounsworth-pq-composite-sigs.
  * Full release notes: bouncycastle.org/releasenotes.html#r1rv78
  * Rebase bouncycastle-notests.patch</changelog>
  <changelog author="fstrba@suse.com" date="1714392001">- Update to version 1.78.1
  * Defects Fixed:
  - The new dependency of the the PGP API on the bcutil jar was
    missing from the module jar, the OSGi manifest, and the Maven
    POM. This has been fixed.
  - Missing exports and duplicate imports have been added/removed
    from the OSGi manifests.
  - The OSGi manifests now have the same bundle IDs as 1.77 and
    lock down dependencies to the equivalent variations
  - A check in the X.509 Extensions class preventing the parsing
    of empty extensions has been removed.</changelog>
</package>
<package pkgid="69c22953cc92d32ae9e462a50d444d1cfbbe41610663d9b3bfbad0dbf133e1c9" name="bouncycastle-mail" arch="noarch">
  <version epoch="0" ver="1.78.1" rel="150200.3.29.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1687176000">- Update to version 1.74: [bsc#1212508, CVE-2023-33201]
  * Defects Fixed:
  - AsconEngine: Fixed a buffering bug when decrypting across
    multiple processBytes calls (ascon128a unaffected).
  - Context based sanity checking on PGP signatures has been added.
  - The ParallelHash clone constructor was not copying all fields.
  - The maximimum number of blocks for CTR/SIC modes was 1 block
    less than it should have been.
  * Additional Features and Functionality:
  - The PGP API now supports wildcard key IDs for public key
    based data encryption.
  - LMS now supports SHA256/192, SHAKE256/192, and SHAKE256/256
    (the additional SP 8000-208 parameter sets).
  - The PGP API now supports V5 and V6 AEAD encryption for
    encrypted data packets.
  - The PGP examples have been updated to reflect key size and algorithm
    changes that have occurred since they were first written (10+ years...).
  - (D)TLS: A new callback 'TlsPeer.notifyConnectionClosed' will be called
    when the connection is closed (including by failure).
  - BCJSSE: Improved logging of connection events and include unique IDs
    in connection-specific log messages.
  - BCJSSE: Server now logs the offered cipher suites when it fails to
    select one.
  - BCJSSE: Added support for SSLParameters namedGroups and
    signatureSchemes properties (can also be used via BCJSSE
    extension API in earlier Java versions).
  - DTLS: The initial handshake re-send time is now configurable by
    overriding 'TlsPeer.getHandshakeResendTimeMillis'.
  - DTLS: Added support for connection IDs per RFC 9146.
  - DTLS: Performance of DTLSVerifier has been improved so that it can
    reasonably be used for all incoming packets.
  - Initial support has been added for A Mechanism for Encoding
    Differences in Paired Certificates.
  - The PGP API now supports parsing, encoding, and fingerprinting
    of V6 EC/EdEC keys.
  - A thread safe verifier API has been added to the PGP API to support
    multi-threaded verification of certifications on keys and user IDs.
  - The number of keys/sub-keys in a PGPKeyRing can now be found by
    calling PGPKeyRing.size().
  - The PQC algorithms LMS/HSS, SPHINCS+, Dilithium, Falcon, and NTRU
    are now supported directly by the BC provider.
  * Notes:
  - The now defunct PQC SIKE algorithm has been removed, this has also
    meant the removal of its resource files so the provider is now quite
    a bit smaller.
  - As a precaution, HC128 now enforces a 128 bit IV, previous behaviour
    for shorter IVs can be supported where required by padding the IV to
    the 128 bits with zero.
  - PGP encrypted data generation now uses integrity protection by default.
    Previous behaviour for encrypted data can be supported where required
    by calling PGPDataEncryptorBuilder.setWithIntegrityPacket(false) when
    data encryption is set up.
  - There are now additional sanity checks in place to prevent accidental
    mis-use of PGPSignature objects. If this change causes any issues, you
    might want to check what your code is up to as there is probably a bug.
  * Security Advisories:
  - CVE-2023-33201: this release fixes an issue with the X509LDAPCertStoreSpi
    where a specially crafted certificate subject could be used to try and
    extract extra information out of an LDAP server with wild-card matthing
    enabled.
  * Rebase bouncycastle-javadoc.patch
  * Add bouncycastle-notests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1697630400">- Update to version 1.76:
  * Defects Fixed:
  - Service allocation in the provider could fail due to the lack
    of a permission block. This has been fixed.
  - JceKeyFingerPrintCalculator has been generalised for different
    providers by using "SHA-256" for the algorithm string.
  - BCJSSE: Fixed a regression in 1.74 (NullPointerException) that
    prevents a BCJSSE server from negotiating TLSv1.1 or earlier.
  - DTLS: Fixed server support for client_certificate_type extension.
  - Cipher.unwrap() for HQC could fail due to a miscalculation of
    the length of the KEM packet. This has been fixed.
  - There was exposure to a Java 7 method in the Java 5 to Java 8
    BCTLS jar which could cause issues with some TLS 1.2 cipher
    suites running on older JVMs. This is now fixed.
  * Additional Features and Functionality:
  - BCJSSE: Following OpenJDK, finalizers have been removed from
    SSLSocket subclasses. Applications should close sockets and
    not rely on garbage collection.
  - BCJSSE: Added support for boolean system property
    "jdk.tls.client.useCompatibilityMode" (default "true").
  - DTLS: Added server support for session resumption.
  - JcaPKCS10CertificationRequest will now work with EC on the
    OpenJDK provider.
  - TimeStamp generation now supports the SHA3 algorithm set.
  - The SPHINCS+ simple parameters are now fully supported in the
    BCPQC provider.
  - Kyber, Classic McEliece, HQC, and Bike now supported by the
    CRMF/CMS/CMP APIs.
  - Builder classes have been add for PGP ASCII Armored streams
    allowing CRCs and versions to now be optional.
  - An UnknownPacket type has been added to the PGP APIs to allow
    for forwards compatibility with upcoming revisions to the standard.
  * Rebase patch bouncycastle-notests.patch
- Update to version 1.75:
  * Defects Fixed:
  - Several Java 8 method calls were accidentally introduced in
    the Java 5 to Java 8 build. The affected classes have been
    refactored to remove this.
  - (D)TLS: renegotiation after resumption now fixed to avoid
    breaking connection.
  * Notes:
  - The ASN.1 core package has had some dead and retired methods
    cleaned up and removed.</changelog>
  <changelog author="pmonreal@suse.com" date="1701691200">- Update to version 1.77:
  * Defects Fixed:
  - Using an unescaped '=' in an X.500 RDN would result in the
    RDN being truncated silently. The issue is now detected and
    an exception is thrown.
  - asn1.eac.CertificateBody was returning certificateEffectiveDate
    from getCertificateExpirationDate(). This has been fixed to
    return certificateExpirationDate.
  - DTLS: Fixed retransmission in response to re-receipt of an
    aggregated ChangeCipherSpec.
  - (D)TLS: Fixed compliance for supported_groups extension.
    Server will no longer negotiate an EC cipher suite using a
    default curve when the ClientHello includes the supported_groups
    extension but it contains no curves in common with the server.
    Similarly, a DH cipher suite will not be negotiated when the
    ClientHello includes supported_groups, containing at least one
    FFDHE group, but none in common with the server.
  - IllegalStateException was being thrown by Ed25519/Ed448 SignatureSpi.
  - TLS: class annotation issues that could occur between the BC
    provider and the TLS API for the GCMParameterSpec class when
    the jars were loaded on the boot class path have been addressed.
  - Attempt to create an ASN.1 OID from a zero length byte array
    is now caught at construction time.
  - Attempt to create an X.509 extension block which is empty will
    now be blocked cause an exception.
  - IES implementation will now accept a null ParameterSpec if no
    nonce is needed.
  - An internal method in Arrays was failing to construct its
    failure message correctly on an error.
  - HSSKeyPublicParameters.generateLMSContext() would fail for a
    unit depth key.
  * Additional Features and Functionality:
  - BCJSSE: Added org.bouncycastle.jsse.client.omitSigAlgsCertExtension
    and org.bouncycastle.jsse.server.omitSigAlgsCertExtension boolean
    system properties to control (for client and server resp.) whether
    the signature_algorithms_cert extension should be omitted if it
    would be identical to signature_algorithms. Defaults to true, the
    historical behaviour.
  - The low-level HPKE API now allows the sender to specify an
    ephemeral key pair.
  - Support has been added for the delta-certificate requests in line
    with the current Chameleon Cert draft from the IETF.
  - Some accommodation has been added for historical systems to
    accommodate variations in the SHA-1 digest OID for CMS SignedData.
  - TLS: the TLS API will now try "RSAwithDigestAndMFG1" as well as
    the newer RSAPSS algorithm names when used with the JCA.
  - TLS: RSA key exchange cipher suites are now disabled by default.
  - Support has been added for PKCS#10 requests to allow certificates
    using the altSignature/altPublicKey extensions.
  * Notes:
  - Kyber and Dilithium have been updated according to the latest
    draft of the standard. Dilithium-AES and Kyber-AES have now been
    removed. Kyber now produces 256 bit secrets for all parameter sets
    (in line with the draft standard).
  - NTRU has been updated to produce 256 bit secrets in line with Kyber.
  - SPHINCS+ can now be used to generate certificates in line with
    those used by (Open Quantum Safe) OQS.
  - Falcon object idenitifiers are now in line with OQS as well.
  - PQC CMS SignedData now defaults to SHA-256 for signed attributes
    rather than SHAKE-256. This is also a compatibility change, but may
    change further again as the IETF standard for CMS is updated.</changelog>
  <changelog author="pmonreal@suse.com" date="1714392000">- Update to version 1.78: [bsc#1223252, CVE-2024-30171]
  * Security Advisories.
  - CVE-2024-29857: Importing an EC certificate with specially crafted
    F2m parameters can cause high CPU usage during parameter evaluation.
  - CVE-2024-30171: Possible timing based leakage in RSA based handshakes
    due to exception processing eliminated.
  - CVE-2024-30172: Crafted signature and public key can be used to
    trigger an infinite loop in the Ed25519 verification code.
  - CVE-2024-301XX: When endpoint identification is enabled in the BCJSSE
    and an SSL socket is not created with an explicit hostname (as happens
    with HttpsURLConnection), hostname verification could be performed
    against a DNS-resolved IP address. This has been fixed.
  * Defects Fixed:
  - Issues with a dangling weak reference causing intermittent
    NullPointerExceptions in the OcspCache have been fixed.
  - Issues with non-constant time RSA operations in TLS handshakes.
  - Issue with Ed25519, Ed448 signature verification causing intermittent
    infinite loop have been fixed.
  - Issues with non-constant time ML-KEM implementation ("Kyber Slash").
  - Align ML-KEM input validation with FIPS 203 IPD requirements.
  - Make PEM parsing more forgiving of whitespace to align with RFC 7468.
  - Fix CCM length checks with large nonce sizes (n=12, n=13).
  - EAC: Fixed the CertificateBody ASN.1 type to support an optional
    Certification Authority Reference in a Certificate Request.
  - ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized
    and the contents octets for both types are now limited to 4096 bytes.
  - BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(),
    which could cause issues for HSM RSA keys.
  - BCJSSE: When endpoint identification is enabled and an SSL socket is not
    created with an explicit hostname (as happens with HttpsURLConnection),
    hostname verification could be performed against a DNS-resolved IP address.
  - The missing module import of java.logging to the provider module has been added.
  - GOST ASN.1 public key alg parameters are now compliant with RFC 9215.
  - An off-by-one error in the encoding for EccP256CurvePoint for ITS.
  - PEM Parser now enforces PEM headers to start at the beginning of the line
    to be meaningful.
  * Additional Features and Functionality.
  - An implementation of MLS (RFC 9420 - The Messaging Layer Security Protocol)
    has been added as a new module.
  - NTRU now supports NTRU-HPS4096-1229 and NTRU-HRSS-1373.
  - Improvements to PGP support, including Camellia key wrapping and Curve25519,
    Curve448 key types (including XDH with HKDF).
  - Added initial support for ML-KEM in TLS.
  - Added XWing hybrid KEM construction (X25519 + ML-KEM-768).
  - Introduced initial KEMSpi support (NTRU, SNTRU Prime) for JDK 21+.
  - Introduced initial composite signature support for X509 Certificates.
  - PKCS#12 now supports PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM,
    PKCS12-DEF-AES256-AES128, and PKCS12-DEF-AES256-AES128-GCM.
  - The default type for the KeyStore.getInstance("PKCS12", "BC") can now be set
    using the org.bouncycastle.pkcs12.default system/security property.
  - The PGP SExpParser will now handle Ed25519 and Ed448 keys.
  - Dilithium and Kyber key encoding updated to latest Draft RFCs
    (draft-ietf-lamps-dilithium-certificates and draft-ietf-lamps-kyber-certificates)
  - Support has been added for encryption key derivation using HKDF in CMS, see
    draft-housley-lamps-cms-cek-hkdf-sha256.
  - X500Name now recognises jurisdiction{C,ST,L} DNs.
  - CertPathValidationContext and CertificatePoliciesValidation now include
    implementations of Memoable.
  - The Composite post-quantum signatures implementation has been updated to the
    latest draft draft-ounsworth-pq-composite-sigs.
  * Full release notes: bouncycastle.org/releasenotes.html#r1rv78
  * Rebase bouncycastle-notests.patch</changelog>
  <changelog author="fstrba@suse.com" date="1714392001">- Update to version 1.78.1
  * Defects Fixed:
  - The new dependency of the the PGP API on the bcutil jar was
    missing from the module jar, the OSGi manifest, and the Maven
    POM. This has been fixed.
  - Missing exports and duplicate imports have been added/removed
    from the OSGi manifests.
  - The OSGi manifests now have the same bundle IDs as 1.77 and
    lock down dependencies to the equivalent variations
  - A check in the X.509 Extensions class preventing the parsing
    of empty extensions has been removed.</changelog>
</package>
<package pkgid="022af6e723dea1adc758454d0d9f2f6892602c0b7b725acaadbf4e6b8a80f574" name="bouncycastle-pg" arch="noarch">
  <version epoch="0" ver="1.78.1" rel="150200.3.29.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1687176000">- Update to version 1.74: [bsc#1212508, CVE-2023-33201]
  * Defects Fixed:
  - AsconEngine: Fixed a buffering bug when decrypting across
    multiple processBytes calls (ascon128a unaffected).
  - Context based sanity checking on PGP signatures has been added.
  - The ParallelHash clone constructor was not copying all fields.
  - The maximimum number of blocks for CTR/SIC modes was 1 block
    less than it should have been.
  * Additional Features and Functionality:
  - The PGP API now supports wildcard key IDs for public key
    based data encryption.
  - LMS now supports SHA256/192, SHAKE256/192, and SHAKE256/256
    (the additional SP 8000-208 parameter sets).
  - The PGP API now supports V5 and V6 AEAD encryption for
    encrypted data packets.
  - The PGP examples have been updated to reflect key size and algorithm
    changes that have occurred since they were first written (10+ years...).
  - (D)TLS: A new callback 'TlsPeer.notifyConnectionClosed' will be called
    when the connection is closed (including by failure).
  - BCJSSE: Improved logging of connection events and include unique IDs
    in connection-specific log messages.
  - BCJSSE: Server now logs the offered cipher suites when it fails to
    select one.
  - BCJSSE: Added support for SSLParameters namedGroups and
    signatureSchemes properties (can also be used via BCJSSE
    extension API in earlier Java versions).
  - DTLS: The initial handshake re-send time is now configurable by
    overriding 'TlsPeer.getHandshakeResendTimeMillis'.
  - DTLS: Added support for connection IDs per RFC 9146.
  - DTLS: Performance of DTLSVerifier has been improved so that it can
    reasonably be used for all incoming packets.
  - Initial support has been added for A Mechanism for Encoding
    Differences in Paired Certificates.
  - The PGP API now supports parsing, encoding, and fingerprinting
    of V6 EC/EdEC keys.
  - A thread safe verifier API has been added to the PGP API to support
    multi-threaded verification of certifications on keys and user IDs.
  - The number of keys/sub-keys in a PGPKeyRing can now be found by
    calling PGPKeyRing.size().
  - The PQC algorithms LMS/HSS, SPHINCS+, Dilithium, Falcon, and NTRU
    are now supported directly by the BC provider.
  * Notes:
  - The now defunct PQC SIKE algorithm has been removed, this has also
    meant the removal of its resource files so the provider is now quite
    a bit smaller.
  - As a precaution, HC128 now enforces a 128 bit IV, previous behaviour
    for shorter IVs can be supported where required by padding the IV to
    the 128 bits with zero.
  - PGP encrypted data generation now uses integrity protection by default.
    Previous behaviour for encrypted data can be supported where required
    by calling PGPDataEncryptorBuilder.setWithIntegrityPacket(false) when
    data encryption is set up.
  - There are now additional sanity checks in place to prevent accidental
    mis-use of PGPSignature objects. If this change causes any issues, you
    might want to check what your code is up to as there is probably a bug.
  * Security Advisories:
  - CVE-2023-33201: this release fixes an issue with the X509LDAPCertStoreSpi
    where a specially crafted certificate subject could be used to try and
    extract extra information out of an LDAP server with wild-card matthing
    enabled.
  * Rebase bouncycastle-javadoc.patch
  * Add bouncycastle-notests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1697630400">- Update to version 1.76:
  * Defects Fixed:
  - Service allocation in the provider could fail due to the lack
    of a permission block. This has been fixed.
  - JceKeyFingerPrintCalculator has been generalised for different
    providers by using "SHA-256" for the algorithm string.
  - BCJSSE: Fixed a regression in 1.74 (NullPointerException) that
    prevents a BCJSSE server from negotiating TLSv1.1 or earlier.
  - DTLS: Fixed server support for client_certificate_type extension.
  - Cipher.unwrap() for HQC could fail due to a miscalculation of
    the length of the KEM packet. This has been fixed.
  - There was exposure to a Java 7 method in the Java 5 to Java 8
    BCTLS jar which could cause issues with some TLS 1.2 cipher
    suites running on older JVMs. This is now fixed.
  * Additional Features and Functionality:
  - BCJSSE: Following OpenJDK, finalizers have been removed from
    SSLSocket subclasses. Applications should close sockets and
    not rely on garbage collection.
  - BCJSSE: Added support for boolean system property
    "jdk.tls.client.useCompatibilityMode" (default "true").
  - DTLS: Added server support for session resumption.
  - JcaPKCS10CertificationRequest will now work with EC on the
    OpenJDK provider.
  - TimeStamp generation now supports the SHA3 algorithm set.
  - The SPHINCS+ simple parameters are now fully supported in the
    BCPQC provider.
  - Kyber, Classic McEliece, HQC, and Bike now supported by the
    CRMF/CMS/CMP APIs.
  - Builder classes have been add for PGP ASCII Armored streams
    allowing CRCs and versions to now be optional.
  - An UnknownPacket type has been added to the PGP APIs to allow
    for forwards compatibility with upcoming revisions to the standard.
  * Rebase patch bouncycastle-notests.patch
- Update to version 1.75:
  * Defects Fixed:
  - Several Java 8 method calls were accidentally introduced in
    the Java 5 to Java 8 build. The affected classes have been
    refactored to remove this.
  - (D)TLS: renegotiation after resumption now fixed to avoid
    breaking connection.
  * Notes:
  - The ASN.1 core package has had some dead and retired methods
    cleaned up and removed.</changelog>
  <changelog author="pmonreal@suse.com" date="1701691200">- Update to version 1.77:
  * Defects Fixed:
  - Using an unescaped '=' in an X.500 RDN would result in the
    RDN being truncated silently. The issue is now detected and
    an exception is thrown.
  - asn1.eac.CertificateBody was returning certificateEffectiveDate
    from getCertificateExpirationDate(). This has been fixed to
    return certificateExpirationDate.
  - DTLS: Fixed retransmission in response to re-receipt of an
    aggregated ChangeCipherSpec.
  - (D)TLS: Fixed compliance for supported_groups extension.
    Server will no longer negotiate an EC cipher suite using a
    default curve when the ClientHello includes the supported_groups
    extension but it contains no curves in common with the server.
    Similarly, a DH cipher suite will not be negotiated when the
    ClientHello includes supported_groups, containing at least one
    FFDHE group, but none in common with the server.
  - IllegalStateException was being thrown by Ed25519/Ed448 SignatureSpi.
  - TLS: class annotation issues that could occur between the BC
    provider and the TLS API for the GCMParameterSpec class when
    the jars were loaded on the boot class path have been addressed.
  - Attempt to create an ASN.1 OID from a zero length byte array
    is now caught at construction time.
  - Attempt to create an X.509 extension block which is empty will
    now be blocked cause an exception.
  - IES implementation will now accept a null ParameterSpec if no
    nonce is needed.
  - An internal method in Arrays was failing to construct its
    failure message correctly on an error.
  - HSSKeyPublicParameters.generateLMSContext() would fail for a
    unit depth key.
  * Additional Features and Functionality:
  - BCJSSE: Added org.bouncycastle.jsse.client.omitSigAlgsCertExtension
    and org.bouncycastle.jsse.server.omitSigAlgsCertExtension boolean
    system properties to control (for client and server resp.) whether
    the signature_algorithms_cert extension should be omitted if it
    would be identical to signature_algorithms. Defaults to true, the
    historical behaviour.
  - The low-level HPKE API now allows the sender to specify an
    ephemeral key pair.
  - Support has been added for the delta-certificate requests in line
    with the current Chameleon Cert draft from the IETF.
  - Some accommodation has been added for historical systems to
    accommodate variations in the SHA-1 digest OID for CMS SignedData.
  - TLS: the TLS API will now try "RSAwithDigestAndMFG1" as well as
    the newer RSAPSS algorithm names when used with the JCA.
  - TLS: RSA key exchange cipher suites are now disabled by default.
  - Support has been added for PKCS#10 requests to allow certificates
    using the altSignature/altPublicKey extensions.
  * Notes:
  - Kyber and Dilithium have been updated according to the latest
    draft of the standard. Dilithium-AES and Kyber-AES have now been
    removed. Kyber now produces 256 bit secrets for all parameter sets
    (in line with the draft standard).
  - NTRU has been updated to produce 256 bit secrets in line with Kyber.
  - SPHINCS+ can now be used to generate certificates in line with
    those used by (Open Quantum Safe) OQS.
  - Falcon object idenitifiers are now in line with OQS as well.
  - PQC CMS SignedData now defaults to SHA-256 for signed attributes
    rather than SHAKE-256. This is also a compatibility change, but may
    change further again as the IETF standard for CMS is updated.</changelog>
  <changelog author="pmonreal@suse.com" date="1714392000">- Update to version 1.78: [bsc#1223252, CVE-2024-30171]
  * Security Advisories.
  - CVE-2024-29857: Importing an EC certificate with specially crafted
    F2m parameters can cause high CPU usage during parameter evaluation.
  - CVE-2024-30171: Possible timing based leakage in RSA based handshakes
    due to exception processing eliminated.
  - CVE-2024-30172: Crafted signature and public key can be used to
    trigger an infinite loop in the Ed25519 verification code.
  - CVE-2024-301XX: When endpoint identification is enabled in the BCJSSE
    and an SSL socket is not created with an explicit hostname (as happens
    with HttpsURLConnection), hostname verification could be performed
    against a DNS-resolved IP address. This has been fixed.
  * Defects Fixed:
  - Issues with a dangling weak reference causing intermittent
    NullPointerExceptions in the OcspCache have been fixed.
  - Issues with non-constant time RSA operations in TLS handshakes.
  - Issue with Ed25519, Ed448 signature verification causing intermittent
    infinite loop have been fixed.
  - Issues with non-constant time ML-KEM implementation ("Kyber Slash").
  - Align ML-KEM input validation with FIPS 203 IPD requirements.
  - Make PEM parsing more forgiving of whitespace to align with RFC 7468.
  - Fix CCM length checks with large nonce sizes (n=12, n=13).
  - EAC: Fixed the CertificateBody ASN.1 type to support an optional
    Certification Authority Reference in a Certificate Request.
  - ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized
    and the contents octets for both types are now limited to 4096 bytes.
  - BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(),
    which could cause issues for HSM RSA keys.
  - BCJSSE: When endpoint identification is enabled and an SSL socket is not
    created with an explicit hostname (as happens with HttpsURLConnection),
    hostname verification could be performed against a DNS-resolved IP address.
  - The missing module import of java.logging to the provider module has been added.
  - GOST ASN.1 public key alg parameters are now compliant with RFC 9215.
  - An off-by-one error in the encoding for EccP256CurvePoint for ITS.
  - PEM Parser now enforces PEM headers to start at the beginning of the line
    to be meaningful.
  * Additional Features and Functionality.
  - An implementation of MLS (RFC 9420 - The Messaging Layer Security Protocol)
    has been added as a new module.
  - NTRU now supports NTRU-HPS4096-1229 and NTRU-HRSS-1373.
  - Improvements to PGP support, including Camellia key wrapping and Curve25519,
    Curve448 key types (including XDH with HKDF).
  - Added initial support for ML-KEM in TLS.
  - Added XWing hybrid KEM construction (X25519 + ML-KEM-768).
  - Introduced initial KEMSpi support (NTRU, SNTRU Prime) for JDK 21+.
  - Introduced initial composite signature support for X509 Certificates.
  - PKCS#12 now supports PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM,
    PKCS12-DEF-AES256-AES128, and PKCS12-DEF-AES256-AES128-GCM.
  - The default type for the KeyStore.getInstance("PKCS12", "BC") can now be set
    using the org.bouncycastle.pkcs12.default system/security property.
  - The PGP SExpParser will now handle Ed25519 and Ed448 keys.
  - Dilithium and Kyber key encoding updated to latest Draft RFCs
    (draft-ietf-lamps-dilithium-certificates and draft-ietf-lamps-kyber-certificates)
  - Support has been added for encryption key derivation using HKDF in CMS, see
    draft-housley-lamps-cms-cek-hkdf-sha256.
  - X500Name now recognises jurisdiction{C,ST,L} DNs.
  - CertPathValidationContext and CertificatePoliciesValidation now include
    implementations of Memoable.
  - The Composite post-quantum signatures implementation has been updated to the
    latest draft draft-ounsworth-pq-composite-sigs.
  * Full release notes: bouncycastle.org/releasenotes.html#r1rv78
  * Rebase bouncycastle-notests.patch</changelog>
  <changelog author="fstrba@suse.com" date="1714392001">- Update to version 1.78.1
  * Defects Fixed:
  - The new dependency of the the PGP API on the bcutil jar was
    missing from the module jar, the OSGi manifest, and the Maven
    POM. This has been fixed.
  - Missing exports and duplicate imports have been added/removed
    from the OSGi manifests.
  - The OSGi manifests now have the same bundle IDs as 1.77 and
    lock down dependencies to the equivalent variations
  - A check in the X.509 Extensions class preventing the parsing
    of empty extensions has been removed.</changelog>
</package>
<package pkgid="5697e56ba427e320c8133d05c41027af5eda6c545fc88105774650e5772aef73" name="bouncycastle-pkix" arch="noarch">
  <version epoch="0" ver="1.78.1" rel="150200.3.29.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1687176000">- Update to version 1.74: [bsc#1212508, CVE-2023-33201]
  * Defects Fixed:
  - AsconEngine: Fixed a buffering bug when decrypting across
    multiple processBytes calls (ascon128a unaffected).
  - Context based sanity checking on PGP signatures has been added.
  - The ParallelHash clone constructor was not copying all fields.
  - The maximimum number of blocks for CTR/SIC modes was 1 block
    less than it should have been.
  * Additional Features and Functionality:
  - The PGP API now supports wildcard key IDs for public key
    based data encryption.
  - LMS now supports SHA256/192, SHAKE256/192, and SHAKE256/256
    (the additional SP 8000-208 parameter sets).
  - The PGP API now supports V5 and V6 AEAD encryption for
    encrypted data packets.
  - The PGP examples have been updated to reflect key size and algorithm
    changes that have occurred since they were first written (10+ years...).
  - (D)TLS: A new callback 'TlsPeer.notifyConnectionClosed' will be called
    when the connection is closed (including by failure).
  - BCJSSE: Improved logging of connection events and include unique IDs
    in connection-specific log messages.
  - BCJSSE: Server now logs the offered cipher suites when it fails to
    select one.
  - BCJSSE: Added support for SSLParameters namedGroups and
    signatureSchemes properties (can also be used via BCJSSE
    extension API in earlier Java versions).
  - DTLS: The initial handshake re-send time is now configurable by
    overriding 'TlsPeer.getHandshakeResendTimeMillis'.
  - DTLS: Added support for connection IDs per RFC 9146.
  - DTLS: Performance of DTLSVerifier has been improved so that it can
    reasonably be used for all incoming packets.
  - Initial support has been added for A Mechanism for Encoding
    Differences in Paired Certificates.
  - The PGP API now supports parsing, encoding, and fingerprinting
    of V6 EC/EdEC keys.
  - A thread safe verifier API has been added to the PGP API to support
    multi-threaded verification of certifications on keys and user IDs.
  - The number of keys/sub-keys in a PGPKeyRing can now be found by
    calling PGPKeyRing.size().
  - The PQC algorithms LMS/HSS, SPHINCS+, Dilithium, Falcon, and NTRU
    are now supported directly by the BC provider.
  * Notes:
  - The now defunct PQC SIKE algorithm has been removed, this has also
    meant the removal of its resource files so the provider is now quite
    a bit smaller.
  - As a precaution, HC128 now enforces a 128 bit IV, previous behaviour
    for shorter IVs can be supported where required by padding the IV to
    the 128 bits with zero.
  - PGP encrypted data generation now uses integrity protection by default.
    Previous behaviour for encrypted data can be supported where required
    by calling PGPDataEncryptorBuilder.setWithIntegrityPacket(false) when
    data encryption is set up.
  - There are now additional sanity checks in place to prevent accidental
    mis-use of PGPSignature objects. If this change causes any issues, you
    might want to check what your code is up to as there is probably a bug.
  * Security Advisories:
  - CVE-2023-33201: this release fixes an issue with the X509LDAPCertStoreSpi
    where a specially crafted certificate subject could be used to try and
    extract extra information out of an LDAP server with wild-card matthing
    enabled.
  * Rebase bouncycastle-javadoc.patch
  * Add bouncycastle-notests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1697630400">- Update to version 1.76:
  * Defects Fixed:
  - Service allocation in the provider could fail due to the lack
    of a permission block. This has been fixed.
  - JceKeyFingerPrintCalculator has been generalised for different
    providers by using "SHA-256" for the algorithm string.
  - BCJSSE: Fixed a regression in 1.74 (NullPointerException) that
    prevents a BCJSSE server from negotiating TLSv1.1 or earlier.
  - DTLS: Fixed server support for client_certificate_type extension.
  - Cipher.unwrap() for HQC could fail due to a miscalculation of
    the length of the KEM packet. This has been fixed.
  - There was exposure to a Java 7 method in the Java 5 to Java 8
    BCTLS jar which could cause issues with some TLS 1.2 cipher
    suites running on older JVMs. This is now fixed.
  * Additional Features and Functionality:
  - BCJSSE: Following OpenJDK, finalizers have been removed from
    SSLSocket subclasses. Applications should close sockets and
    not rely on garbage collection.
  - BCJSSE: Added support for boolean system property
    "jdk.tls.client.useCompatibilityMode" (default "true").
  - DTLS: Added server support for session resumption.
  - JcaPKCS10CertificationRequest will now work with EC on the
    OpenJDK provider.
  - TimeStamp generation now supports the SHA3 algorithm set.
  - The SPHINCS+ simple parameters are now fully supported in the
    BCPQC provider.
  - Kyber, Classic McEliece, HQC, and Bike now supported by the
    CRMF/CMS/CMP APIs.
  - Builder classes have been add for PGP ASCII Armored streams
    allowing CRCs and versions to now be optional.
  - An UnknownPacket type has been added to the PGP APIs to allow
    for forwards compatibility with upcoming revisions to the standard.
  * Rebase patch bouncycastle-notests.patch
- Update to version 1.75:
  * Defects Fixed:
  - Several Java 8 method calls were accidentally introduced in
    the Java 5 to Java 8 build. The affected classes have been
    refactored to remove this.
  - (D)TLS: renegotiation after resumption now fixed to avoid
    breaking connection.
  * Notes:
  - The ASN.1 core package has had some dead and retired methods
    cleaned up and removed.</changelog>
  <changelog author="pmonreal@suse.com" date="1701691200">- Update to version 1.77:
  * Defects Fixed:
  - Using an unescaped '=' in an X.500 RDN would result in the
    RDN being truncated silently. The issue is now detected and
    an exception is thrown.
  - asn1.eac.CertificateBody was returning certificateEffectiveDate
    from getCertificateExpirationDate(). This has been fixed to
    return certificateExpirationDate.
  - DTLS: Fixed retransmission in response to re-receipt of an
    aggregated ChangeCipherSpec.
  - (D)TLS: Fixed compliance for supported_groups extension.
    Server will no longer negotiate an EC cipher suite using a
    default curve when the ClientHello includes the supported_groups
    extension but it contains no curves in common with the server.
    Similarly, a DH cipher suite will not be negotiated when the
    ClientHello includes supported_groups, containing at least one
    FFDHE group, but none in common with the server.
  - IllegalStateException was being thrown by Ed25519/Ed448 SignatureSpi.
  - TLS: class annotation issues that could occur between the BC
    provider and the TLS API for the GCMParameterSpec class when
    the jars were loaded on the boot class path have been addressed.
  - Attempt to create an ASN.1 OID from a zero length byte array
    is now caught at construction time.
  - Attempt to create an X.509 extension block which is empty will
    now be blocked cause an exception.
  - IES implementation will now accept a null ParameterSpec if no
    nonce is needed.
  - An internal method in Arrays was failing to construct its
    failure message correctly on an error.
  - HSSKeyPublicParameters.generateLMSContext() would fail for a
    unit depth key.
  * Additional Features and Functionality:
  - BCJSSE: Added org.bouncycastle.jsse.client.omitSigAlgsCertExtension
    and org.bouncycastle.jsse.server.omitSigAlgsCertExtension boolean
    system properties to control (for client and server resp.) whether
    the signature_algorithms_cert extension should be omitted if it
    would be identical to signature_algorithms. Defaults to true, the
    historical behaviour.
  - The low-level HPKE API now allows the sender to specify an
    ephemeral key pair.
  - Support has been added for the delta-certificate requests in line
    with the current Chameleon Cert draft from the IETF.
  - Some accommodation has been added for historical systems to
    accommodate variations in the SHA-1 digest OID for CMS SignedData.
  - TLS: the TLS API will now try "RSAwithDigestAndMFG1" as well as
    the newer RSAPSS algorithm names when used with the JCA.
  - TLS: RSA key exchange cipher suites are now disabled by default.
  - Support has been added for PKCS#10 requests to allow certificates
    using the altSignature/altPublicKey extensions.
  * Notes:
  - Kyber and Dilithium have been updated according to the latest
    draft of the standard. Dilithium-AES and Kyber-AES have now been
    removed. Kyber now produces 256 bit secrets for all parameter sets
    (in line with the draft standard).
  - NTRU has been updated to produce 256 bit secrets in line with Kyber.
  - SPHINCS+ can now be used to generate certificates in line with
    those used by (Open Quantum Safe) OQS.
  - Falcon object idenitifiers are now in line with OQS as well.
  - PQC CMS SignedData now defaults to SHA-256 for signed attributes
    rather than SHAKE-256. This is also a compatibility change, but may
    change further again as the IETF standard for CMS is updated.</changelog>
  <changelog author="pmonreal@suse.com" date="1714392000">- Update to version 1.78: [bsc#1223252, CVE-2024-30171]
  * Security Advisories.
  - CVE-2024-29857: Importing an EC certificate with specially crafted
    F2m parameters can cause high CPU usage during parameter evaluation.
  - CVE-2024-30171: Possible timing based leakage in RSA based handshakes
    due to exception processing eliminated.
  - CVE-2024-30172: Crafted signature and public key can be used to
    trigger an infinite loop in the Ed25519 verification code.
  - CVE-2024-301XX: When endpoint identification is enabled in the BCJSSE
    and an SSL socket is not created with an explicit hostname (as happens
    with HttpsURLConnection), hostname verification could be performed
    against a DNS-resolved IP address. This has been fixed.
  * Defects Fixed:
  - Issues with a dangling weak reference causing intermittent
    NullPointerExceptions in the OcspCache have been fixed.
  - Issues with non-constant time RSA operations in TLS handshakes.
  - Issue with Ed25519, Ed448 signature verification causing intermittent
    infinite loop have been fixed.
  - Issues with non-constant time ML-KEM implementation ("Kyber Slash").
  - Align ML-KEM input validation with FIPS 203 IPD requirements.
  - Make PEM parsing more forgiving of whitespace to align with RFC 7468.
  - Fix CCM length checks with large nonce sizes (n=12, n=13).
  - EAC: Fixed the CertificateBody ASN.1 type to support an optional
    Certification Authority Reference in a Certificate Request.
  - ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized
    and the contents octets for both types are now limited to 4096 bytes.
  - BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(),
    which could cause issues for HSM RSA keys.
  - BCJSSE: When endpoint identification is enabled and an SSL socket is not
    created with an explicit hostname (as happens with HttpsURLConnection),
    hostname verification could be performed against a DNS-resolved IP address.
  - The missing module import of java.logging to the provider module has been added.
  - GOST ASN.1 public key alg parameters are now compliant with RFC 9215.
  - An off-by-one error in the encoding for EccP256CurvePoint for ITS.
  - PEM Parser now enforces PEM headers to start at the beginning of the line
    to be meaningful.
  * Additional Features and Functionality.
  - An implementation of MLS (RFC 9420 - The Messaging Layer Security Protocol)
    has been added as a new module.
  - NTRU now supports NTRU-HPS4096-1229 and NTRU-HRSS-1373.
  - Improvements to PGP support, including Camellia key wrapping and Curve25519,
    Curve448 key types (including XDH with HKDF).
  - Added initial support for ML-KEM in TLS.
  - Added XWing hybrid KEM construction (X25519 + ML-KEM-768).
  - Introduced initial KEMSpi support (NTRU, SNTRU Prime) for JDK 21+.
  - Introduced initial composite signature support for X509 Certificates.
  - PKCS#12 now supports PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM,
    PKCS12-DEF-AES256-AES128, and PKCS12-DEF-AES256-AES128-GCM.
  - The default type for the KeyStore.getInstance("PKCS12", "BC") can now be set
    using the org.bouncycastle.pkcs12.default system/security property.
  - The PGP SExpParser will now handle Ed25519 and Ed448 keys.
  - Dilithium and Kyber key encoding updated to latest Draft RFCs
    (draft-ietf-lamps-dilithium-certificates and draft-ietf-lamps-kyber-certificates)
  - Support has been added for encryption key derivation using HKDF in CMS, see
    draft-housley-lamps-cms-cek-hkdf-sha256.
  - X500Name now recognises jurisdiction{C,ST,L} DNs.
  - CertPathValidationContext and CertificatePoliciesValidation now include
    implementations of Memoable.
  - The Composite post-quantum signatures implementation has been updated to the
    latest draft draft-ounsworth-pq-composite-sigs.
  * Full release notes: bouncycastle.org/releasenotes.html#r1rv78
  * Rebase bouncycastle-notests.patch</changelog>
  <changelog author="fstrba@suse.com" date="1714392001">- Update to version 1.78.1
  * Defects Fixed:
  - The new dependency of the the PGP API on the bcutil jar was
    missing from the module jar, the OSGi manifest, and the Maven
    POM. This has been fixed.
  - Missing exports and duplicate imports have been added/removed
    from the OSGi manifests.
  - The OSGi manifests now have the same bundle IDs as 1.77 and
    lock down dependencies to the equivalent variations
  - A check in the X.509 Extensions class preventing the parsing
    of empty extensions has been removed.</changelog>
</package>
<package pkgid="64e34b14cc01f32e4edd4198ccd5dafcc40ff61f622523a2ac85005ae95b85d2" name="bouncycastle-tls" arch="noarch">
  <version epoch="0" ver="1.78.1" rel="150200.3.29.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1687176000">- Update to version 1.74: [bsc#1212508, CVE-2023-33201]
  * Defects Fixed:
  - AsconEngine: Fixed a buffering bug when decrypting across
    multiple processBytes calls (ascon128a unaffected).
  - Context based sanity checking on PGP signatures has been added.
  - The ParallelHash clone constructor was not copying all fields.
  - The maximimum number of blocks for CTR/SIC modes was 1 block
    less than it should have been.
  * Additional Features and Functionality:
  - The PGP API now supports wildcard key IDs for public key
    based data encryption.
  - LMS now supports SHA256/192, SHAKE256/192, and SHAKE256/256
    (the additional SP 8000-208 parameter sets).
  - The PGP API now supports V5 and V6 AEAD encryption for
    encrypted data packets.
  - The PGP examples have been updated to reflect key size and algorithm
    changes that have occurred since they were first written (10+ years...).
  - (D)TLS: A new callback 'TlsPeer.notifyConnectionClosed' will be called
    when the connection is closed (including by failure).
  - BCJSSE: Improved logging of connection events and include unique IDs
    in connection-specific log messages.
  - BCJSSE: Server now logs the offered cipher suites when it fails to
    select one.
  - BCJSSE: Added support for SSLParameters namedGroups and
    signatureSchemes properties (can also be used via BCJSSE
    extension API in earlier Java versions).
  - DTLS: The initial handshake re-send time is now configurable by
    overriding 'TlsPeer.getHandshakeResendTimeMillis'.
  - DTLS: Added support for connection IDs per RFC 9146.
  - DTLS: Performance of DTLSVerifier has been improved so that it can
    reasonably be used for all incoming packets.
  - Initial support has been added for A Mechanism for Encoding
    Differences in Paired Certificates.
  - The PGP API now supports parsing, encoding, and fingerprinting
    of V6 EC/EdEC keys.
  - A thread safe verifier API has been added to the PGP API to support
    multi-threaded verification of certifications on keys and user IDs.
  - The number of keys/sub-keys in a PGPKeyRing can now be found by
    calling PGPKeyRing.size().
  - The PQC algorithms LMS/HSS, SPHINCS+, Dilithium, Falcon, and NTRU
    are now supported directly by the BC provider.
  * Notes:
  - The now defunct PQC SIKE algorithm has been removed, this has also
    meant the removal of its resource files so the provider is now quite
    a bit smaller.
  - As a precaution, HC128 now enforces a 128 bit IV, previous behaviour
    for shorter IVs can be supported where required by padding the IV to
    the 128 bits with zero.
  - PGP encrypted data generation now uses integrity protection by default.
    Previous behaviour for encrypted data can be supported where required
    by calling PGPDataEncryptorBuilder.setWithIntegrityPacket(false) when
    data encryption is set up.
  - There are now additional sanity checks in place to prevent accidental
    mis-use of PGPSignature objects. If this change causes any issues, you
    might want to check what your code is up to as there is probably a bug.
  * Security Advisories:
  - CVE-2023-33201: this release fixes an issue with the X509LDAPCertStoreSpi
    where a specially crafted certificate subject could be used to try and
    extract extra information out of an LDAP server with wild-card matthing
    enabled.
  * Rebase bouncycastle-javadoc.patch
  * Add bouncycastle-notests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1697630400">- Update to version 1.76:
  * Defects Fixed:
  - Service allocation in the provider could fail due to the lack
    of a permission block. This has been fixed.
  - JceKeyFingerPrintCalculator has been generalised for different
    providers by using "SHA-256" for the algorithm string.
  - BCJSSE: Fixed a regression in 1.74 (NullPointerException) that
    prevents a BCJSSE server from negotiating TLSv1.1 or earlier.
  - DTLS: Fixed server support for client_certificate_type extension.
  - Cipher.unwrap() for HQC could fail due to a miscalculation of
    the length of the KEM packet. This has been fixed.
  - There was exposure to a Java 7 method in the Java 5 to Java 8
    BCTLS jar which could cause issues with some TLS 1.2 cipher
    suites running on older JVMs. This is now fixed.
  * Additional Features and Functionality:
  - BCJSSE: Following OpenJDK, finalizers have been removed from
    SSLSocket subclasses. Applications should close sockets and
    not rely on garbage collection.
  - BCJSSE: Added support for boolean system property
    "jdk.tls.client.useCompatibilityMode" (default "true").
  - DTLS: Added server support for session resumption.
  - JcaPKCS10CertificationRequest will now work with EC on the
    OpenJDK provider.
  - TimeStamp generation now supports the SHA3 algorithm set.
  - The SPHINCS+ simple parameters are now fully supported in the
    BCPQC provider.
  - Kyber, Classic McEliece, HQC, and Bike now supported by the
    CRMF/CMS/CMP APIs.
  - Builder classes have been add for PGP ASCII Armored streams
    allowing CRCs and versions to now be optional.
  - An UnknownPacket type has been added to the PGP APIs to allow
    for forwards compatibility with upcoming revisions to the standard.
  * Rebase patch bouncycastle-notests.patch
- Update to version 1.75:
  * Defects Fixed:
  - Several Java 8 method calls were accidentally introduced in
    the Java 5 to Java 8 build. The affected classes have been
    refactored to remove this.
  - (D)TLS: renegotiation after resumption now fixed to avoid
    breaking connection.
  * Notes:
  - The ASN.1 core package has had some dead and retired methods
    cleaned up and removed.</changelog>
  <changelog author="pmonreal@suse.com" date="1701691200">- Update to version 1.77:
  * Defects Fixed:
  - Using an unescaped '=' in an X.500 RDN would result in the
    RDN being truncated silently. The issue is now detected and
    an exception is thrown.
  - asn1.eac.CertificateBody was returning certificateEffectiveDate
    from getCertificateExpirationDate(). This has been fixed to
    return certificateExpirationDate.
  - DTLS: Fixed retransmission in response to re-receipt of an
    aggregated ChangeCipherSpec.
  - (D)TLS: Fixed compliance for supported_groups extension.
    Server will no longer negotiate an EC cipher suite using a
    default curve when the ClientHello includes the supported_groups
    extension but it contains no curves in common with the server.
    Similarly, a DH cipher suite will not be negotiated when the
    ClientHello includes supported_groups, containing at least one
    FFDHE group, but none in common with the server.
  - IllegalStateException was being thrown by Ed25519/Ed448 SignatureSpi.
  - TLS: class annotation issues that could occur between the BC
    provider and the TLS API for the GCMParameterSpec class when
    the jars were loaded on the boot class path have been addressed.
  - Attempt to create an ASN.1 OID from a zero length byte array
    is now caught at construction time.
  - Attempt to create an X.509 extension block which is empty will
    now be blocked cause an exception.
  - IES implementation will now accept a null ParameterSpec if no
    nonce is needed.
  - An internal method in Arrays was failing to construct its
    failure message correctly on an error.
  - HSSKeyPublicParameters.generateLMSContext() would fail for a
    unit depth key.
  * Additional Features and Functionality:
  - BCJSSE: Added org.bouncycastle.jsse.client.omitSigAlgsCertExtension
    and org.bouncycastle.jsse.server.omitSigAlgsCertExtension boolean
    system properties to control (for client and server resp.) whether
    the signature_algorithms_cert extension should be omitted if it
    would be identical to signature_algorithms. Defaults to true, the
    historical behaviour.
  - The low-level HPKE API now allows the sender to specify an
    ephemeral key pair.
  - Support has been added for the delta-certificate requests in line
    with the current Chameleon Cert draft from the IETF.
  - Some accommodation has been added for historical systems to
    accommodate variations in the SHA-1 digest OID for CMS SignedData.
  - TLS: the TLS API will now try "RSAwithDigestAndMFG1" as well as
    the newer RSAPSS algorithm names when used with the JCA.
  - TLS: RSA key exchange cipher suites are now disabled by default.
  - Support has been added for PKCS#10 requests to allow certificates
    using the altSignature/altPublicKey extensions.
  * Notes:
  - Kyber and Dilithium have been updated according to the latest
    draft of the standard. Dilithium-AES and Kyber-AES have now been
    removed. Kyber now produces 256 bit secrets for all parameter sets
    (in line with the draft standard).
  - NTRU has been updated to produce 256 bit secrets in line with Kyber.
  - SPHINCS+ can now be used to generate certificates in line with
    those used by (Open Quantum Safe) OQS.
  - Falcon object idenitifiers are now in line with OQS as well.
  - PQC CMS SignedData now defaults to SHA-256 for signed attributes
    rather than SHAKE-256. This is also a compatibility change, but may
    change further again as the IETF standard for CMS is updated.</changelog>
  <changelog author="pmonreal@suse.com" date="1714392000">- Update to version 1.78: [bsc#1223252, CVE-2024-30171]
  * Security Advisories.
  - CVE-2024-29857: Importing an EC certificate with specially crafted
    F2m parameters can cause high CPU usage during parameter evaluation.
  - CVE-2024-30171: Possible timing based leakage in RSA based handshakes
    due to exception processing eliminated.
  - CVE-2024-30172: Crafted signature and public key can be used to
    trigger an infinite loop in the Ed25519 verification code.
  - CVE-2024-301XX: When endpoint identification is enabled in the BCJSSE
    and an SSL socket is not created with an explicit hostname (as happens
    with HttpsURLConnection), hostname verification could be performed
    against a DNS-resolved IP address. This has been fixed.
  * Defects Fixed:
  - Issues with a dangling weak reference causing intermittent
    NullPointerExceptions in the OcspCache have been fixed.
  - Issues with non-constant time RSA operations in TLS handshakes.
  - Issue with Ed25519, Ed448 signature verification causing intermittent
    infinite loop have been fixed.
  - Issues with non-constant time ML-KEM implementation ("Kyber Slash").
  - Align ML-KEM input validation with FIPS 203 IPD requirements.
  - Make PEM parsing more forgiving of whitespace to align with RFC 7468.
  - Fix CCM length checks with large nonce sizes (n=12, n=13).
  - EAC: Fixed the CertificateBody ASN.1 type to support an optional
    Certification Authority Reference in a Certificate Request.
  - ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized
    and the contents octets for both types are now limited to 4096 bytes.
  - BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(),
    which could cause issues for HSM RSA keys.
  - BCJSSE: When endpoint identification is enabled and an SSL socket is not
    created with an explicit hostname (as happens with HttpsURLConnection),
    hostname verification could be performed against a DNS-resolved IP address.
  - The missing module import of java.logging to the provider module has been added.
  - GOST ASN.1 public key alg parameters are now compliant with RFC 9215.
  - An off-by-one error in the encoding for EccP256CurvePoint for ITS.
  - PEM Parser now enforces PEM headers to start at the beginning of the line
    to be meaningful.
  * Additional Features and Functionality.
  - An implementation of MLS (RFC 9420 - The Messaging Layer Security Protocol)
    has been added as a new module.
  - NTRU now supports NTRU-HPS4096-1229 and NTRU-HRSS-1373.
  - Improvements to PGP support, including Camellia key wrapping and Curve25519,
    Curve448 key types (including XDH with HKDF).
  - Added initial support for ML-KEM in TLS.
  - Added XWing hybrid KEM construction (X25519 + ML-KEM-768).
  - Introduced initial KEMSpi support (NTRU, SNTRU Prime) for JDK 21+.
  - Introduced initial composite signature support for X509 Certificates.
  - PKCS#12 now supports PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM,
    PKCS12-DEF-AES256-AES128, and PKCS12-DEF-AES256-AES128-GCM.
  - The default type for the KeyStore.getInstance("PKCS12", "BC") can now be set
    using the org.bouncycastle.pkcs12.default system/security property.
  - The PGP SExpParser will now handle Ed25519 and Ed448 keys.
  - Dilithium and Kyber key encoding updated to latest Draft RFCs
    (draft-ietf-lamps-dilithium-certificates and draft-ietf-lamps-kyber-certificates)
  - Support has been added for encryption key derivation using HKDF in CMS, see
    draft-housley-lamps-cms-cek-hkdf-sha256.
  - X500Name now recognises jurisdiction{C,ST,L} DNs.
  - CertPathValidationContext and CertificatePoliciesValidation now include
    implementations of Memoable.
  - The Composite post-quantum signatures implementation has been updated to the
    latest draft draft-ounsworth-pq-composite-sigs.
  * Full release notes: bouncycastle.org/releasenotes.html#r1rv78
  * Rebase bouncycastle-notests.patch</changelog>
  <changelog author="fstrba@suse.com" date="1714392001">- Update to version 1.78.1
  * Defects Fixed:
  - The new dependency of the the PGP API on the bcutil jar was
    missing from the module jar, the OSGi manifest, and the Maven
    POM. This has been fixed.
  - Missing exports and duplicate imports have been added/removed
    from the OSGi manifests.
  - The OSGi manifests now have the same bundle IDs as 1.77 and
    lock down dependencies to the equivalent variations
  - A check in the X.509 Extensions class preventing the parsing
    of empty extensions has been removed.</changelog>
</package>
<package pkgid="c60762827fd44ce3a079a5da31f70890ba1f3670c3549add2e7dfbb669895679" name="bouncycastle-util" arch="noarch">
  <version epoch="0" ver="1.78.1" rel="150200.3.29.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1687176000">- Update to version 1.74: [bsc#1212508, CVE-2023-33201]
  * Defects Fixed:
  - AsconEngine: Fixed a buffering bug when decrypting across
    multiple processBytes calls (ascon128a unaffected).
  - Context based sanity checking on PGP signatures has been added.
  - The ParallelHash clone constructor was not copying all fields.
  - The maximimum number of blocks for CTR/SIC modes was 1 block
    less than it should have been.
  * Additional Features and Functionality:
  - The PGP API now supports wildcard key IDs for public key
    based data encryption.
  - LMS now supports SHA256/192, SHAKE256/192, and SHAKE256/256
    (the additional SP 8000-208 parameter sets).
  - The PGP API now supports V5 and V6 AEAD encryption for
    encrypted data packets.
  - The PGP examples have been updated to reflect key size and algorithm
    changes that have occurred since they were first written (10+ years...).
  - (D)TLS: A new callback 'TlsPeer.notifyConnectionClosed' will be called
    when the connection is closed (including by failure).
  - BCJSSE: Improved logging of connection events and include unique IDs
    in connection-specific log messages.
  - BCJSSE: Server now logs the offered cipher suites when it fails to
    select one.
  - BCJSSE: Added support for SSLParameters namedGroups and
    signatureSchemes properties (can also be used via BCJSSE
    extension API in earlier Java versions).
  - DTLS: The initial handshake re-send time is now configurable by
    overriding 'TlsPeer.getHandshakeResendTimeMillis'.
  - DTLS: Added support for connection IDs per RFC 9146.
  - DTLS: Performance of DTLSVerifier has been improved so that it can
    reasonably be used for all incoming packets.
  - Initial support has been added for A Mechanism for Encoding
    Differences in Paired Certificates.
  - The PGP API now supports parsing, encoding, and fingerprinting
    of V6 EC/EdEC keys.
  - A thread safe verifier API has been added to the PGP API to support
    multi-threaded verification of certifications on keys and user IDs.
  - The number of keys/sub-keys in a PGPKeyRing can now be found by
    calling PGPKeyRing.size().
  - The PQC algorithms LMS/HSS, SPHINCS+, Dilithium, Falcon, and NTRU
    are now supported directly by the BC provider.
  * Notes:
  - The now defunct PQC SIKE algorithm has been removed, this has also
    meant the removal of its resource files so the provider is now quite
    a bit smaller.
  - As a precaution, HC128 now enforces a 128 bit IV, previous behaviour
    for shorter IVs can be supported where required by padding the IV to
    the 128 bits with zero.
  - PGP encrypted data generation now uses integrity protection by default.
    Previous behaviour for encrypted data can be supported where required
    by calling PGPDataEncryptorBuilder.setWithIntegrityPacket(false) when
    data encryption is set up.
  - There are now additional sanity checks in place to prevent accidental
    mis-use of PGPSignature objects. If this change causes any issues, you
    might want to check what your code is up to as there is probably a bug.
  * Security Advisories:
  - CVE-2023-33201: this release fixes an issue with the X509LDAPCertStoreSpi
    where a specially crafted certificate subject could be used to try and
    extract extra information out of an LDAP server with wild-card matthing
    enabled.
  * Rebase bouncycastle-javadoc.patch
  * Add bouncycastle-notests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1697630400">- Update to version 1.76:
  * Defects Fixed:
  - Service allocation in the provider could fail due to the lack
    of a permission block. This has been fixed.
  - JceKeyFingerPrintCalculator has been generalised for different
    providers by using "SHA-256" for the algorithm string.
  - BCJSSE: Fixed a regression in 1.74 (NullPointerException) that
    prevents a BCJSSE server from negotiating TLSv1.1 or earlier.
  - DTLS: Fixed server support for client_certificate_type extension.
  - Cipher.unwrap() for HQC could fail due to a miscalculation of
    the length of the KEM packet. This has been fixed.
  - There was exposure to a Java 7 method in the Java 5 to Java 8
    BCTLS jar which could cause issues with some TLS 1.2 cipher
    suites running on older JVMs. This is now fixed.
  * Additional Features and Functionality:
  - BCJSSE: Following OpenJDK, finalizers have been removed from
    SSLSocket subclasses. Applications should close sockets and
    not rely on garbage collection.
  - BCJSSE: Added support for boolean system property
    "jdk.tls.client.useCompatibilityMode" (default "true").
  - DTLS: Added server support for session resumption.
  - JcaPKCS10CertificationRequest will now work with EC on the
    OpenJDK provider.
  - TimeStamp generation now supports the SHA3 algorithm set.
  - The SPHINCS+ simple parameters are now fully supported in the
    BCPQC provider.
  - Kyber, Classic McEliece, HQC, and Bike now supported by the
    CRMF/CMS/CMP APIs.
  - Builder classes have been add for PGP ASCII Armored streams
    allowing CRCs and versions to now be optional.
  - An UnknownPacket type has been added to the PGP APIs to allow
    for forwards compatibility with upcoming revisions to the standard.
  * Rebase patch bouncycastle-notests.patch
- Update to version 1.75:
  * Defects Fixed:
  - Several Java 8 method calls were accidentally introduced in
    the Java 5 to Java 8 build. The affected classes have been
    refactored to remove this.
  - (D)TLS: renegotiation after resumption now fixed to avoid
    breaking connection.
  * Notes:
  - The ASN.1 core package has had some dead and retired methods
    cleaned up and removed.</changelog>
  <changelog author="pmonreal@suse.com" date="1701691200">- Update to version 1.77:
  * Defects Fixed:
  - Using an unescaped '=' in an X.500 RDN would result in the
    RDN being truncated silently. The issue is now detected and
    an exception is thrown.
  - asn1.eac.CertificateBody was returning certificateEffectiveDate
    from getCertificateExpirationDate(). This has been fixed to
    return certificateExpirationDate.
  - DTLS: Fixed retransmission in response to re-receipt of an
    aggregated ChangeCipherSpec.
  - (D)TLS: Fixed compliance for supported_groups extension.
    Server will no longer negotiate an EC cipher suite using a
    default curve when the ClientHello includes the supported_groups
    extension but it contains no curves in common with the server.
    Similarly, a DH cipher suite will not be negotiated when the
    ClientHello includes supported_groups, containing at least one
    FFDHE group, but none in common with the server.
  - IllegalStateException was being thrown by Ed25519/Ed448 SignatureSpi.
  - TLS: class annotation issues that could occur between the BC
    provider and the TLS API for the GCMParameterSpec class when
    the jars were loaded on the boot class path have been addressed.
  - Attempt to create an ASN.1 OID from a zero length byte array
    is now caught at construction time.
  - Attempt to create an X.509 extension block which is empty will
    now be blocked cause an exception.
  - IES implementation will now accept a null ParameterSpec if no
    nonce is needed.
  - An internal method in Arrays was failing to construct its
    failure message correctly on an error.
  - HSSKeyPublicParameters.generateLMSContext() would fail for a
    unit depth key.
  * Additional Features and Functionality:
  - BCJSSE: Added org.bouncycastle.jsse.client.omitSigAlgsCertExtension
    and org.bouncycastle.jsse.server.omitSigAlgsCertExtension boolean
    system properties to control (for client and server resp.) whether
    the signature_algorithms_cert extension should be omitted if it
    would be identical to signature_algorithms. Defaults to true, the
    historical behaviour.
  - The low-level HPKE API now allows the sender to specify an
    ephemeral key pair.
  - Support has been added for the delta-certificate requests in line
    with the current Chameleon Cert draft from the IETF.
  - Some accommodation has been added for historical systems to
    accommodate variations in the SHA-1 digest OID for CMS SignedData.
  - TLS: the TLS API will now try "RSAwithDigestAndMFG1" as well as
    the newer RSAPSS algorithm names when used with the JCA.
  - TLS: RSA key exchange cipher suites are now disabled by default.
  - Support has been added for PKCS#10 requests to allow certificates
    using the altSignature/altPublicKey extensions.
  * Notes:
  - Kyber and Dilithium have been updated according to the latest
    draft of the standard. Dilithium-AES and Kyber-AES have now been
    removed. Kyber now produces 256 bit secrets for all parameter sets
    (in line with the draft standard).
  - NTRU has been updated to produce 256 bit secrets in line with Kyber.
  - SPHINCS+ can now be used to generate certificates in line with
    those used by (Open Quantum Safe) OQS.
  - Falcon object idenitifiers are now in line with OQS as well.
  - PQC CMS SignedData now defaults to SHA-256 for signed attributes
    rather than SHAKE-256. This is also a compatibility change, but may
    change further again as the IETF standard for CMS is updated.</changelog>
  <changelog author="pmonreal@suse.com" date="1714392000">- Update to version 1.78: [bsc#1223252, CVE-2024-30171]
  * Security Advisories.
  - CVE-2024-29857: Importing an EC certificate with specially crafted
    F2m parameters can cause high CPU usage during parameter evaluation.
  - CVE-2024-30171: Possible timing based leakage in RSA based handshakes
    due to exception processing eliminated.
  - CVE-2024-30172: Crafted signature and public key can be used to
    trigger an infinite loop in the Ed25519 verification code.
  - CVE-2024-301XX: When endpoint identification is enabled in the BCJSSE
    and an SSL socket is not created with an explicit hostname (as happens
    with HttpsURLConnection), hostname verification could be performed
    against a DNS-resolved IP address. This has been fixed.
  * Defects Fixed:
  - Issues with a dangling weak reference causing intermittent
    NullPointerExceptions in the OcspCache have been fixed.
  - Issues with non-constant time RSA operations in TLS handshakes.
  - Issue with Ed25519, Ed448 signature verification causing intermittent
    infinite loop have been fixed.
  - Issues with non-constant time ML-KEM implementation ("Kyber Slash").
  - Align ML-KEM input validation with FIPS 203 IPD requirements.
  - Make PEM parsing more forgiving of whitespace to align with RFC 7468.
  - Fix CCM length checks with large nonce sizes (n=12, n=13).
  - EAC: Fixed the CertificateBody ASN.1 type to support an optional
    Certification Authority Reference in a Certificate Request.
  - ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized
    and the contents octets for both types are now limited to 4096 bytes.
  - BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(),
    which could cause issues for HSM RSA keys.
  - BCJSSE: When endpoint identification is enabled and an SSL socket is not
    created with an explicit hostname (as happens with HttpsURLConnection),
    hostname verification could be performed against a DNS-resolved IP address.
  - The missing module import of java.logging to the provider module has been added.
  - GOST ASN.1 public key alg parameters are now compliant with RFC 9215.
  - An off-by-one error in the encoding for EccP256CurvePoint for ITS.
  - PEM Parser now enforces PEM headers to start at the beginning of the line
    to be meaningful.
  * Additional Features and Functionality.
  - An implementation of MLS (RFC 9420 - The Messaging Layer Security Protocol)
    has been added as a new module.
  - NTRU now supports NTRU-HPS4096-1229 and NTRU-HRSS-1373.
  - Improvements to PGP support, including Camellia key wrapping and Curve25519,
    Curve448 key types (including XDH with HKDF).
  - Added initial support for ML-KEM in TLS.
  - Added XWing hybrid KEM construction (X25519 + ML-KEM-768).
  - Introduced initial KEMSpi support (NTRU, SNTRU Prime) for JDK 21+.
  - Introduced initial composite signature support for X509 Certificates.
  - PKCS#12 now supports PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM,
    PKCS12-DEF-AES256-AES128, and PKCS12-DEF-AES256-AES128-GCM.
  - The default type for the KeyStore.getInstance("PKCS12", "BC") can now be set
    using the org.bouncycastle.pkcs12.default system/security property.
  - The PGP SExpParser will now handle Ed25519 and Ed448 keys.
  - Dilithium and Kyber key encoding updated to latest Draft RFCs
    (draft-ietf-lamps-dilithium-certificates and draft-ietf-lamps-kyber-certificates)
  - Support has been added for encryption key derivation using HKDF in CMS, see
    draft-housley-lamps-cms-cek-hkdf-sha256.
  - X500Name now recognises jurisdiction{C,ST,L} DNs.
  - CertPathValidationContext and CertificatePoliciesValidation now include
    implementations of Memoable.
  - The Composite post-quantum signatures implementation has been updated to the
    latest draft draft-ounsworth-pq-composite-sigs.
  * Full release notes: bouncycastle.org/releasenotes.html#r1rv78
  * Rebase bouncycastle-notests.patch</changelog>
  <changelog author="fstrba@suse.com" date="1714392001">- Update to version 1.78.1
  * Defects Fixed:
  - The new dependency of the the PGP API on the bcutil jar was
    missing from the module jar, the OSGi manifest, and the Maven
    POM. This has been fixed.
  - Missing exports and duplicate imports have been added/removed
    from the OSGi manifests.
  - The OSGi manifests now have the same bundle IDs as 1.77 and
    lock down dependencies to the equivalent variations
  - A check in the X.509 Extensions class preventing the parsing
    of empty extensions has been removed.</changelog>
</package>
<package pkgid="dcf0a94d3e6b2fbf11ae2cfc588545d19c12bbb56f11a3ea3af1ed669bb91c5b" name="bpftool" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.19.3.3"/>
  <changelog author="mrostecki@opensuse.org" date="1557403200">- Initial release</changelog>
  <changelog author="lnussel@suse.de" date="1578484800">- use optflags for building
- build and install man pages</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1683115200">- Add dwarves as build dependency as pahole is called during build
- Fix BTF-to-C converter's padding logic (jsc#PED-3924)
  New patch: libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1693569600">- Update bpftool align with v5.19-based kernel
  + Implement BTFGen (i.e gen min_core_btf command)
  + Support for new btf kind BTF_KIND_DECL_TAG and BTF_KIND_TYPE_TAG
  + Support multiple .rodata/.data internal maps in skeleton
  + Probes for bounded loops, instruction set extensions, and offload-enabled
  + Generate Light skeleton for the kernel
  + Enable libbpf's strict mode by default
  + Show program &amp; link type names
  + Support showing program names declared in BTF
  + Add BPF_TRACE_KPROBE_MULTI to attach type names table
  + Check unprivileged_bpf_disabled against value of 2
  + Use sysfs vmlinux when dumping BTF by ID
- Drop libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch as the fix is now
  included</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697803200">- Update bpftool align with v6.4-based kernel
  + Support for KIND_RESTRICT in gen min_core_btf command
  + Support BPF_MAP_TYPE_USER_RINGBUF map type
  + Support new cgroup local storage
  + Support printing opcodes and source file references in CFG
  + Probe for memcg-based accounting and bump rlimit only if needed
  + Allow toggling autoattach for bpf prog load|loadall
  + Remove support of --legacy option for bpftool
  + Remove BPF_OBJ_NAME_LEN restriction when looking up bpf program by name</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1705924800">- Update bpftool to align with v6.5-based kernel
  * show map IDs along with struct_ops links
  * show map IDs instead of raw value for map_of_maps types
  * show target_{obj,btf}_id in tracing link info</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1716379200">- Enable showing info for processes holding BPF map/prog/link/btf FDs
  (jsc#PED-8375)</changelog>
</package>
<package pkgid="d07d3641f9832715cf93a9cc898fa22556a1761804e80dc94ca4fe51c457a977" name="bpftool" arch="ppc64le">
  <version epoch="0" ver="6.4.0" rel="150600.19.3.3"/>
  <changelog author="mrostecki@opensuse.org" date="1557403200">- Initial release</changelog>
  <changelog author="lnussel@suse.de" date="1578484800">- use optflags for building
- build and install man pages</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1683115200">- Add dwarves as build dependency as pahole is called during build
- Fix BTF-to-C converter's padding logic (jsc#PED-3924)
  New patch: libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1693569600">- Update bpftool align with v5.19-based kernel
  + Implement BTFGen (i.e gen min_core_btf command)
  + Support for new btf kind BTF_KIND_DECL_TAG and BTF_KIND_TYPE_TAG
  + Support multiple .rodata/.data internal maps in skeleton
  + Probes for bounded loops, instruction set extensions, and offload-enabled
  + Generate Light skeleton for the kernel
  + Enable libbpf's strict mode by default
  + Show program &amp; link type names
  + Support showing program names declared in BTF
  + Add BPF_TRACE_KPROBE_MULTI to attach type names table
  + Check unprivileged_bpf_disabled against value of 2
  + Use sysfs vmlinux when dumping BTF by ID
- Drop libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch as the fix is now
  included</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697803200">- Update bpftool align with v6.4-based kernel
  + Support for KIND_RESTRICT in gen min_core_btf command
  + Support BPF_MAP_TYPE_USER_RINGBUF map type
  + Support new cgroup local storage
  + Support printing opcodes and source file references in CFG
  + Probe for memcg-based accounting and bump rlimit only if needed
  + Allow toggling autoattach for bpf prog load|loadall
  + Remove support of --legacy option for bpftool
  + Remove BPF_OBJ_NAME_LEN restriction when looking up bpf program by name</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1705924800">- Update bpftool to align with v6.5-based kernel
  * show map IDs along with struct_ops links
  * show map IDs instead of raw value for map_of_maps types
  * show target_{obj,btf}_id in tracing link info</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1716379200">- Enable showing info for processes holding BPF map/prog/link/btf FDs
  (jsc#PED-8375)</changelog>
</package>
<package pkgid="7ccb46bad37466e1d69178a78a300512a743416974650fefd875fd5b1cf80e39" name="bpftool" arch="s390x">
  <version epoch="0" ver="6.4.0" rel="150600.19.3.3"/>
  <changelog author="mrostecki@opensuse.org" date="1557403200">- Initial release</changelog>
  <changelog author="lnussel@suse.de" date="1578484800">- use optflags for building
- build and install man pages</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1683115200">- Add dwarves as build dependency as pahole is called during build
- Fix BTF-to-C converter's padding logic (jsc#PED-3924)
  New patch: libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1693569600">- Update bpftool align with v5.19-based kernel
  + Implement BTFGen (i.e gen min_core_btf command)
  + Support for new btf kind BTF_KIND_DECL_TAG and BTF_KIND_TYPE_TAG
  + Support multiple .rodata/.data internal maps in skeleton
  + Probes for bounded loops, instruction set extensions, and offload-enabled
  + Generate Light skeleton for the kernel
  + Enable libbpf's strict mode by default
  + Show program &amp; link type names
  + Support showing program names declared in BTF
  + Add BPF_TRACE_KPROBE_MULTI to attach type names table
  + Check unprivileged_bpf_disabled against value of 2
  + Use sysfs vmlinux when dumping BTF by ID
- Drop libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch as the fix is now
  included</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697803200">- Update bpftool align with v6.4-based kernel
  + Support for KIND_RESTRICT in gen min_core_btf command
  + Support BPF_MAP_TYPE_USER_RINGBUF map type
  + Support new cgroup local storage
  + Support printing opcodes and source file references in CFG
  + Probe for memcg-based accounting and bump rlimit only if needed
  + Allow toggling autoattach for bpf prog load|loadall
  + Remove support of --legacy option for bpftool
  + Remove BPF_OBJ_NAME_LEN restriction when looking up bpf program by name</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1705924800">- Update bpftool to align with v6.5-based kernel
  * show map IDs along with struct_ops links
  * show map IDs instead of raw value for map_of_maps types
  * show target_{obj,btf}_id in tracing link info</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1716379200">- Enable showing info for processes holding BPF map/prog/link/btf FDs
  (jsc#PED-8375)</changelog>
</package>
<package pkgid="4fe9a244459f281c3abd13b21602e2aa62ff15418a2257f77d3d491c81f7b56d" name="bpftool" arch="src">
  <version epoch="0" ver="6.4.0" rel="150600.19.3.3"/>
  <changelog author="mrostecki@opensuse.org" date="1557403200">- Initial release</changelog>
  <changelog author="lnussel@suse.de" date="1578484800">- use optflags for building
- build and install man pages</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1683115200">- Add dwarves as build dependency as pahole is called during build
- Fix BTF-to-C converter's padding logic (jsc#PED-3924)
  New patch: libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1693569600">- Update bpftool align with v5.19-based kernel
  + Implement BTFGen (i.e gen min_core_btf command)
  + Support for new btf kind BTF_KIND_DECL_TAG and BTF_KIND_TYPE_TAG
  + Support multiple .rodata/.data internal maps in skeleton
  + Probes for bounded loops, instruction set extensions, and offload-enabled
  + Generate Light skeleton for the kernel
  + Enable libbpf's strict mode by default
  + Show program &amp; link type names
  + Support showing program names declared in BTF
  + Add BPF_TRACE_KPROBE_MULTI to attach type names table
  + Check unprivileged_bpf_disabled against value of 2
  + Use sysfs vmlinux when dumping BTF by ID
- Drop libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch as the fix is now
  included</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697803200">- Update bpftool align with v6.4-based kernel
  + Support for KIND_RESTRICT in gen min_core_btf command
  + Support BPF_MAP_TYPE_USER_RINGBUF map type
  + Support new cgroup local storage
  + Support printing opcodes and source file references in CFG
  + Probe for memcg-based accounting and bump rlimit only if needed
  + Allow toggling autoattach for bpf prog load|loadall
  + Remove support of --legacy option for bpftool
  + Remove BPF_OBJ_NAME_LEN restriction when looking up bpf program by name</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1705924800">- Update bpftool to align with v6.5-based kernel
  * show map IDs along with struct_ops links
  * show map IDs instead of raw value for map_of_maps types
  * show target_{obj,btf}_id in tracing link info</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1716379200">- Enable showing info for processes holding BPF map/prog/link/btf FDs
  (jsc#PED-8375)</changelog>
</package>
<package pkgid="c4da7c84826b7addba3974cf3dd18142391cf1f7c9222c29f1f63c035174e61d" name="bpftool" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.19.3.3"/>
  <changelog author="mrostecki@opensuse.org" date="1557403200">- Initial release</changelog>
  <changelog author="lnussel@suse.de" date="1578484800">- use optflags for building
- build and install man pages</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1683115200">- Add dwarves as build dependency as pahole is called during build
- Fix BTF-to-C converter's padding logic (jsc#PED-3924)
  New patch: libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1693569600">- Update bpftool align with v5.19-based kernel
  + Implement BTFGen (i.e gen min_core_btf command)
  + Support for new btf kind BTF_KIND_DECL_TAG and BTF_KIND_TYPE_TAG
  + Support multiple .rodata/.data internal maps in skeleton
  + Probes for bounded loops, instruction set extensions, and offload-enabled
  + Generate Light skeleton for the kernel
  + Enable libbpf's strict mode by default
  + Show program &amp; link type names
  + Support showing program names declared in BTF
  + Add BPF_TRACE_KPROBE_MULTI to attach type names table
  + Check unprivileged_bpf_disabled against value of 2
  + Use sysfs vmlinux when dumping BTF by ID
- Drop libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch as the fix is now
  included</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697803200">- Update bpftool align with v6.4-based kernel
  + Support for KIND_RESTRICT in gen min_core_btf command
  + Support BPF_MAP_TYPE_USER_RINGBUF map type
  + Support new cgroup local storage
  + Support printing opcodes and source file references in CFG
  + Probe for memcg-based accounting and bump rlimit only if needed
  + Allow toggling autoattach for bpf prog load|loadall
  + Remove support of --legacy option for bpftool
  + Remove BPF_OBJ_NAME_LEN restriction when looking up bpf program by name</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1705924800">- Update bpftool to align with v6.5-based kernel
  * show map IDs along with struct_ops links
  * show map IDs instead of raw value for map_of_maps types
  * show target_{obj,btf}_id in tracing link info</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1716379200">- Enable showing info for processes holding BPF map/prog/link/btf FDs
  (jsc#PED-8375)</changelog>
</package>
<package pkgid="2521f62bc46b415df15ef64d7876cd9c7d1c39afef832692451a8151600de85a" name="bpftool" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.19.6.1"/>
  <changelog author="mrostecki@opensuse.org" date="1557403200">- Initial release</changelog>
  <changelog author="lnussel@suse.de" date="1578484800">- use optflags for building
- build and install man pages</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1683115200">- Add dwarves as build dependency as pahole is called during build
- Fix BTF-to-C converter's padding logic (jsc#PED-3924)
  New patch: libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1693569600">- Update bpftool align with v5.19-based kernel
  + Implement BTFGen (i.e gen min_core_btf command)
  + Support for new btf kind BTF_KIND_DECL_TAG and BTF_KIND_TYPE_TAG
  + Support multiple .rodata/.data internal maps in skeleton
  + Probes for bounded loops, instruction set extensions, and offload-enabled
  + Generate Light skeleton for the kernel
  + Enable libbpf's strict mode by default
  + Show program &amp; link type names
  + Support showing program names declared in BTF
  + Add BPF_TRACE_KPROBE_MULTI to attach type names table
  + Check unprivileged_bpf_disabled against value of 2
  + Use sysfs vmlinux when dumping BTF by ID
- Drop libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch as the fix is now
  included</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697803200">- Update bpftool align with v6.4-based kernel
  + Support for KIND_RESTRICT in gen min_core_btf command
  + Support BPF_MAP_TYPE_USER_RINGBUF map type
  + Support new cgroup local storage
  + Support printing opcodes and source file references in CFG
  + Probe for memcg-based accounting and bump rlimit only if needed
  + Allow toggling autoattach for bpf prog load|loadall
  + Remove support of --legacy option for bpftool
  + Remove BPF_OBJ_NAME_LEN restriction when looking up bpf program by name</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1705924800">- Update bpftool to align with v6.5-based kernel
  * show map IDs along with struct_ops links
  * show map IDs instead of raw value for map_of_maps types
  * show target_{obj,btf}_id in tracing link info</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1716379200">- Enable showing info for processes holding BPF map/prog/link/btf FDs
  (jsc#PED-8375)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1730980800">- Fix undefined behavior in qsort(NULL, 0, ...) (bsc#1232258
  CVE-2024-49987)
  * add bpftool-Fix-undefined-behavior-in-qsort-NULL-0.patch</changelog>
</package>
<package pkgid="e46da3f6a7b87e97b477380c52fdc4a630aa257bd6c5b0d83a9ce74c5f7a35d2" name="bpftool" arch="ppc64le">
  <version epoch="0" ver="6.4.0" rel="150600.19.6.1"/>
  <changelog author="mrostecki@opensuse.org" date="1557403200">- Initial release</changelog>
  <changelog author="lnussel@suse.de" date="1578484800">- use optflags for building
- build and install man pages</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1683115200">- Add dwarves as build dependency as pahole is called during build
- Fix BTF-to-C converter's padding logic (jsc#PED-3924)
  New patch: libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1693569600">- Update bpftool align with v5.19-based kernel
  + Implement BTFGen (i.e gen min_core_btf command)
  + Support for new btf kind BTF_KIND_DECL_TAG and BTF_KIND_TYPE_TAG
  + Support multiple .rodata/.data internal maps in skeleton
  + Probes for bounded loops, instruction set extensions, and offload-enabled
  + Generate Light skeleton for the kernel
  + Enable libbpf's strict mode by default
  + Show program &amp; link type names
  + Support showing program names declared in BTF
  + Add BPF_TRACE_KPROBE_MULTI to attach type names table
  + Check unprivileged_bpf_disabled against value of 2
  + Use sysfs vmlinux when dumping BTF by ID
- Drop libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch as the fix is now
  included</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697803200">- Update bpftool align with v6.4-based kernel
  + Support for KIND_RESTRICT in gen min_core_btf command
  + Support BPF_MAP_TYPE_USER_RINGBUF map type
  + Support new cgroup local storage
  + Support printing opcodes and source file references in CFG
  + Probe for memcg-based accounting and bump rlimit only if needed
  + Allow toggling autoattach for bpf prog load|loadall
  + Remove support of --legacy option for bpftool
  + Remove BPF_OBJ_NAME_LEN restriction when looking up bpf program by name</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1705924800">- Update bpftool to align with v6.5-based kernel
  * show map IDs along with struct_ops links
  * show map IDs instead of raw value for map_of_maps types
  * show target_{obj,btf}_id in tracing link info</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1716379200">- Enable showing info for processes holding BPF map/prog/link/btf FDs
  (jsc#PED-8375)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1730980800">- Fix undefined behavior in qsort(NULL, 0, ...) (bsc#1232258
  CVE-2024-49987)
  * add bpftool-Fix-undefined-behavior-in-qsort-NULL-0.patch</changelog>
</package>
<package pkgid="cc4e933b7927cb6c57299b871d7ddf5e42b9d19352755e045d1a1d5e4892a200" name="bpftool" arch="s390x">
  <version epoch="0" ver="6.4.0" rel="150600.19.6.1"/>
  <changelog author="mrostecki@opensuse.org" date="1557403200">- Initial release</changelog>
  <changelog author="lnussel@suse.de" date="1578484800">- use optflags for building
- build and install man pages</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1683115200">- Add dwarves as build dependency as pahole is called during build
- Fix BTF-to-C converter's padding logic (jsc#PED-3924)
  New patch: libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1693569600">- Update bpftool align with v5.19-based kernel
  + Implement BTFGen (i.e gen min_core_btf command)
  + Support for new btf kind BTF_KIND_DECL_TAG and BTF_KIND_TYPE_TAG
  + Support multiple .rodata/.data internal maps in skeleton
  + Probes for bounded loops, instruction set extensions, and offload-enabled
  + Generate Light skeleton for the kernel
  + Enable libbpf's strict mode by default
  + Show program &amp; link type names
  + Support showing program names declared in BTF
  + Add BPF_TRACE_KPROBE_MULTI to attach type names table
  + Check unprivileged_bpf_disabled against value of 2
  + Use sysfs vmlinux when dumping BTF by ID
- Drop libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch as the fix is now
  included</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697803200">- Update bpftool align with v6.4-based kernel
  + Support for KIND_RESTRICT in gen min_core_btf command
  + Support BPF_MAP_TYPE_USER_RINGBUF map type
  + Support new cgroup local storage
  + Support printing opcodes and source file references in CFG
  + Probe for memcg-based accounting and bump rlimit only if needed
  + Allow toggling autoattach for bpf prog load|loadall
  + Remove support of --legacy option for bpftool
  + Remove BPF_OBJ_NAME_LEN restriction when looking up bpf program by name</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1705924800">- Update bpftool to align with v6.5-based kernel
  * show map IDs along with struct_ops links
  * show map IDs instead of raw value for map_of_maps types
  * show target_{obj,btf}_id in tracing link info</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1716379200">- Enable showing info for processes holding BPF map/prog/link/btf FDs
  (jsc#PED-8375)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1730980800">- Fix undefined behavior in qsort(NULL, 0, ...) (bsc#1232258
  CVE-2024-49987)
  * add bpftool-Fix-undefined-behavior-in-qsort-NULL-0.patch</changelog>
</package>
<package pkgid="8407cc462a1bd910c7e1dc5b19db2fc3b32c0037a3066f3c066255edcb296fc6" name="bpftool" arch="src">
  <version epoch="0" ver="6.4.0" rel="150600.19.6.1"/>
  <changelog author="mrostecki@opensuse.org" date="1557403200">- Initial release</changelog>
  <changelog author="lnussel@suse.de" date="1578484800">- use optflags for building
- build and install man pages</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1683115200">- Add dwarves as build dependency as pahole is called during build
- Fix BTF-to-C converter's padding logic (jsc#PED-3924)
  New patch: libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1693569600">- Update bpftool align with v5.19-based kernel
  + Implement BTFGen (i.e gen min_core_btf command)
  + Support for new btf kind BTF_KIND_DECL_TAG and BTF_KIND_TYPE_TAG
  + Support multiple .rodata/.data internal maps in skeleton
  + Probes for bounded loops, instruction set extensions, and offload-enabled
  + Generate Light skeleton for the kernel
  + Enable libbpf's strict mode by default
  + Show program &amp; link type names
  + Support showing program names declared in BTF
  + Add BPF_TRACE_KPROBE_MULTI to attach type names table
  + Check unprivileged_bpf_disabled against value of 2
  + Use sysfs vmlinux when dumping BTF by ID
- Drop libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch as the fix is now
  included</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697803200">- Update bpftool align with v6.4-based kernel
  + Support for KIND_RESTRICT in gen min_core_btf command
  + Support BPF_MAP_TYPE_USER_RINGBUF map type
  + Support new cgroup local storage
  + Support printing opcodes and source file references in CFG
  + Probe for memcg-based accounting and bump rlimit only if needed
  + Allow toggling autoattach for bpf prog load|loadall
  + Remove support of --legacy option for bpftool
  + Remove BPF_OBJ_NAME_LEN restriction when looking up bpf program by name</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1705924800">- Update bpftool to align with v6.5-based kernel
  * show map IDs along with struct_ops links
  * show map IDs instead of raw value for map_of_maps types
  * show target_{obj,btf}_id in tracing link info</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1716379200">- Enable showing info for processes holding BPF map/prog/link/btf FDs
  (jsc#PED-8375)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1730980800">- Fix undefined behavior in qsort(NULL, 0, ...) (bsc#1232258
  CVE-2024-49987)
  * add bpftool-Fix-undefined-behavior-in-qsort-NULL-0.patch</changelog>
</package>
<package pkgid="870b35d27df45b4a299005da9853f4dcd2c9d2b77a373dabcd7f569294b32c98" name="bpftool" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.19.6.1"/>
  <changelog author="mrostecki@opensuse.org" date="1557403200">- Initial release</changelog>
  <changelog author="lnussel@suse.de" date="1578484800">- use optflags for building
- build and install man pages</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1683115200">- Add dwarves as build dependency as pahole is called during build
- Fix BTF-to-C converter's padding logic (jsc#PED-3924)
  New patch: libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1693569600">- Update bpftool align with v5.19-based kernel
  + Implement BTFGen (i.e gen min_core_btf command)
  + Support for new btf kind BTF_KIND_DECL_TAG and BTF_KIND_TYPE_TAG
  + Support multiple .rodata/.data internal maps in skeleton
  + Probes for bounded loops, instruction set extensions, and offload-enabled
  + Generate Light skeleton for the kernel
  + Enable libbpf's strict mode by default
  + Show program &amp; link type names
  + Support showing program names declared in BTF
  + Add BPF_TRACE_KPROBE_MULTI to attach type names table
  + Check unprivileged_bpf_disabled against value of 2
  + Use sysfs vmlinux when dumping BTF by ID
- Drop libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch as the fix is now
  included</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697803200">- Update bpftool align with v6.4-based kernel
  + Support for KIND_RESTRICT in gen min_core_btf command
  + Support BPF_MAP_TYPE_USER_RINGBUF map type
  + Support new cgroup local storage
  + Support printing opcodes and source file references in CFG
  + Probe for memcg-based accounting and bump rlimit only if needed
  + Allow toggling autoattach for bpf prog load|loadall
  + Remove support of --legacy option for bpftool
  + Remove BPF_OBJ_NAME_LEN restriction when looking up bpf program by name</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1705924800">- Update bpftool to align with v6.5-based kernel
  * show map IDs along with struct_ops links
  * show map IDs instead of raw value for map_of_maps types
  * show target_{obj,btf}_id in tracing link info</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1716379200">- Enable showing info for processes holding BPF map/prog/link/btf FDs
  (jsc#PED-8375)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1730980800">- Fix undefined behavior in qsort(NULL, 0, ...) (bsc#1232258
  CVE-2024-49987)
  * add bpftool-Fix-undefined-behavior-in-qsort-NULL-0.patch</changelog>
</package>
<package pkgid="8a03473b243e062804c962a7f4ed05f2f8c2cb5642cb27de9fc7080caedb3fe0" name="bsdtar" arch="aarch64">
  <version epoch="0" ver="3.7.2" rel="150600.3.3.1"/>
  <changelog author="idonmez@suse.com" date="1581508800">- Update to version 3.4.2
  New features:
  * support for atomic file extraction (bsdtar -x --safe-writes) (#1289)
  * support for mbed TLS (PolarSSL) (#1301)
  Important bugfixes:
  * security fixes in RAR5 reader (#1280 #1326)
  * compression buffer fix in XAR writer (#1317)
  * fix uname and gname longer than 32 characters in PAX writer (#1319)
  * fix segfault when archiving hard links in ISO9660 and XAR writers (#1325)
  * fix support for extracting 7z archive entries with Delta filter (#987)</changelog>
  <changelog author="idonmez@suse.com" date="1582027200">- Switch back to cmake build now that cmake-mini exists, this will
  no longer create a build-cycle.</changelog>
  <changelog author="idonmez@suse.com" date="1589976000">- Update to version 3.4.3
  * support for pzstd compressed files (#1357)
  * support for RHT.security.selinux tar extended attribute (#1348)
  * various zstd fixes and improvements (#1342 #1352 #1359)
  * child process handling fixes (#1372)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599480000">- fix build with binutils submitted to Factory, adding upstream
  libarchive-3.4.3-fix_test_write_disk_secure.patch</changelog>
  <changelog author="idonmez@suse.com" date="1606824000">- Update to version 3.5.0
  New features:
  * mtree digest reader support (#1347)
  * completed support for UTF-8 encoding conversion (#1389)
  * minor API enhancements (#1258, #1405)
  * support for system extended attributes (#1409)
  * support for decompression of symbolic links in zipx archives (#1435)
  Important bugfixes
  * fixed extraction of archives with hard links pointing to itself (#1381)
  * cpio fixes (#1387, #1388)
  * fixed uninitialized size in rar5_read_data (#1408)
  * fixed memory leaks in error case of archive_write_open() functions (#1456)
- Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream.</changelog>
  <changelog author="dmueller@suse.com" date="1609934400">- update to 3.5.1:
  * various compilation fixes (#1461, #1462, #1463, #1464)
  * fixed undefined behavior in a function in warc reader (#1465)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1631448000">- Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target
  (CVE-2021-23177, bsc#1192425)
  * CVE-2021-23177.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1634817600">- Fix CVE-2021-31566, modifies file flags of symlink target
  (CVE-2021-31566, bsc#1192426.patch)
  CVE-2021-31566.patch
- Fix bsc#1192427, processing fixup entries may follow symbolic links
  bsc1192427.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636286400">- update to 3.5.2:
  * CPIO: Support for PWB and v7 binary cpio formats
  * ZIP reader: Support of deflate algorithm in symbolic link decompression
  * security: fix handling of symbolic link ACLs on Linux (boo#1192425)
  * security: never follow symlinks when setting file flags on Linux (boo#1192426)
  * security: do not follow symlinks when processing the fixup list (boo#1192427)
  * fix extraction of hardlinks to symlinks
  * 7zip reader and writer fixes
  * RAR reader fixes
  * ZIP reader: fix excessive read for padded zip
  * CAB reader: fix double free
  * handle short writes from archive_write_callback
- Drop upstream mereged:
  * CVE-2021-23177.patch
  * CVE-2021-31566.patch
  * bsc1192427.patch</changelog>
  <changelog author="adrian@suse.de" date="1638187200">- fix permission settings on following symlinks (fix-following-symlinks.patch)
  this fixes also wrong permissions of /var/tmp in factory systems
  CVE-2021-31566</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645617600">- Fix CVE-2021-36976 use-after-free in copy_string
  (CVE-2021-36976, bsc#1188572)
  * fix-CVE-2021-36976.patch
- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  CVE-2017-5601, bsc#1022528, bsc#1189528</changelog>
  <changelog author="rpm@fthiessen.de" date="1645704000">- Update to 3.6.0
  * Fix use-after-free bug (CVE-2021-36976)
  * tar: new option "--no-read-sparse"
  * tar: threads support for zstd
  * RAR reader: filter support
  * RAR5 reader: self-extracting archive support
  * ZIP reader: zstd decompression support
  * tar: respect "--ignore-zeros" in c, r and u modes
  * reduced size of application binaries
  * internal code optimizations
- Drop upstream merged:
  * fix-following-symlinks.patch
  * fix-CVE-2021-36976.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649332800">- Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init
  (CVE-2022-26280, bsc#1197634)
  * fix-CVE-2022-26280.patch</changelog>
  <changelog author="dmueller@suse.com" date="1649419200">- update to 3.6.1:
  * 7zip reader: fix PPMD read beyond boundary (#1671)
  * ZIP reader: fix possible out of bounds read (OSS-Fuzz 38766 #1672)
  * ISO reader: fix possible heap buffer overflow in read_children() (OSS-Fuzz 38764, #1685)
  * RARv4 redaer: fix multiple issues in RARv4 filter code (introduced in libarchive 3.6.0)
  * fix heap use after free in archive_read_format_rar_read_data() (OSS-Fuzz 44547, 52efa50)
  * fix null dereference in read_data_compressed() (OSS-Fuzz 44843, 1271f77)
  * fix heap user after free in run_filters() (OSS-Fuzz 46279, #1715)
- Drop upstream merged fix-CVE-2022-26280.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1669118400">- Fix CVE-2022-36227, Handle a calloc returning NULL
  (CVE-2022-36227, bsc#1205629)
  * CVE-2022-36227.patch</changelog>
  <changelog author="dmueller@suse.com" date="1671796800">- update to 3.6.2 (bsc#1205629, CVE-2022-36227)
  * NULL pointer dereference vulnerability in archive_write.c
  * include ZSTD in Windows builds (#1688)
  * SSL fixes on Windows (#1714, #1723, #1724)
  * rar5 reader: fix possible garbled output with bsdtar -O (#1745)
  * mtree reader: support reading mtree files with tabs (#1783)
  * various small fixes for issues found by CodeQL
- Drop upstream merged CVE-2022-36227.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1690200000">- update to 3.7.0
  * bsdunzip port from FreeBSD
  * fix 2 year 2038 issues</changelog>
  <changelog author="dmueller@suse.com" date="1694952000">- update to 3.7.2:
  * Multiple vulnerabilities have been fixed in the PAX writer
  * bsdunzip(1) now correctly handles arguments following an
  - x after the zipfile
  * zstd filter now supports the "long" write option
  * SEGV and stack buffer overflow in verbose mode of cpio
  * bsdunzip updated to match latest upstream code
  * miscellaneous functional bugfixes</changelog>
  <changelog author="dmueller@suse.com" date="1703851200">- skip write tests on 32bit, they OOM</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1718193600">- Fix CVE-2024-20696, heap based out-of-bounds write
  (CVE-2024-20696, bsc#1225971)
  * CVE-2024-20696.patch
- Fix CVE-2024-20697, Out of bounds Remote Code Execution Vulnerability
  (CVE-2024-20697, bsc#1225972)
  * CVE-2024-20697.patch</changelog>
</package>
<package pkgid="f5ee32f1eea6fa390041562f89cc2f5ec1d7d91649ed315cb2c8b11469a7042d" name="bsdtar" arch="ppc64le">
  <version epoch="0" ver="3.7.2" rel="150600.3.3.1"/>
  <changelog author="idonmez@suse.com" date="1581508800">- Update to version 3.4.2
  New features:
  * support for atomic file extraction (bsdtar -x --safe-writes) (#1289)
  * support for mbed TLS (PolarSSL) (#1301)
  Important bugfixes:
  * security fixes in RAR5 reader (#1280 #1326)
  * compression buffer fix in XAR writer (#1317)
  * fix uname and gname longer than 32 characters in PAX writer (#1319)
  * fix segfault when archiving hard links in ISO9660 and XAR writers (#1325)
  * fix support for extracting 7z archive entries with Delta filter (#987)</changelog>
  <changelog author="idonmez@suse.com" date="1582027200">- Switch back to cmake build now that cmake-mini exists, this will
  no longer create a build-cycle.</changelog>
  <changelog author="idonmez@suse.com" date="1589976000">- Update to version 3.4.3
  * support for pzstd compressed files (#1357)
  * support for RHT.security.selinux tar extended attribute (#1348)
  * various zstd fixes and improvements (#1342 #1352 #1359)
  * child process handling fixes (#1372)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599480000">- fix build with binutils submitted to Factory, adding upstream
  libarchive-3.4.3-fix_test_write_disk_secure.patch</changelog>
  <changelog author="idonmez@suse.com" date="1606824000">- Update to version 3.5.0
  New features:
  * mtree digest reader support (#1347)
  * completed support for UTF-8 encoding conversion (#1389)
  * minor API enhancements (#1258, #1405)
  * support for system extended attributes (#1409)
  * support for decompression of symbolic links in zipx archives (#1435)
  Important bugfixes
  * fixed extraction of archives with hard links pointing to itself (#1381)
  * cpio fixes (#1387, #1388)
  * fixed uninitialized size in rar5_read_data (#1408)
  * fixed memory leaks in error case of archive_write_open() functions (#1456)
- Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream.</changelog>
  <changelog author="dmueller@suse.com" date="1609934400">- update to 3.5.1:
  * various compilation fixes (#1461, #1462, #1463, #1464)
  * fixed undefined behavior in a function in warc reader (#1465)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1631448000">- Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target
  (CVE-2021-23177, bsc#1192425)
  * CVE-2021-23177.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1634817600">- Fix CVE-2021-31566, modifies file flags of symlink target
  (CVE-2021-31566, bsc#1192426.patch)
  CVE-2021-31566.patch
- Fix bsc#1192427, processing fixup entries may follow symbolic links
  bsc1192427.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636286400">- update to 3.5.2:
  * CPIO: Support for PWB and v7 binary cpio formats
  * ZIP reader: Support of deflate algorithm in symbolic link decompression
  * security: fix handling of symbolic link ACLs on Linux (boo#1192425)
  * security: never follow symlinks when setting file flags on Linux (boo#1192426)
  * security: do not follow symlinks when processing the fixup list (boo#1192427)
  * fix extraction of hardlinks to symlinks
  * 7zip reader and writer fixes
  * RAR reader fixes
  * ZIP reader: fix excessive read for padded zip
  * CAB reader: fix double free
  * handle short writes from archive_write_callback
- Drop upstream mereged:
  * CVE-2021-23177.patch
  * CVE-2021-31566.patch
  * bsc1192427.patch</changelog>
  <changelog author="adrian@suse.de" date="1638187200">- fix permission settings on following symlinks (fix-following-symlinks.patch)
  this fixes also wrong permissions of /var/tmp in factory systems
  CVE-2021-31566</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645617600">- Fix CVE-2021-36976 use-after-free in copy_string
  (CVE-2021-36976, bsc#1188572)
  * fix-CVE-2021-36976.patch
- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  CVE-2017-5601, bsc#1022528, bsc#1189528</changelog>
  <changelog author="rpm@fthiessen.de" date="1645704000">- Update to 3.6.0
  * Fix use-after-free bug (CVE-2021-36976)
  * tar: new option "--no-read-sparse"
  * tar: threads support for zstd
  * RAR reader: filter support
  * RAR5 reader: self-extracting archive support
  * ZIP reader: zstd decompression support
  * tar: respect "--ignore-zeros" in c, r and u modes
  * reduced size of application binaries
  * internal code optimizations
- Drop upstream merged:
  * fix-following-symlinks.patch
  * fix-CVE-2021-36976.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649332800">- Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init
  (CVE-2022-26280, bsc#1197634)
  * fix-CVE-2022-26280.patch</changelog>
  <changelog author="dmueller@suse.com" date="1649419200">- update to 3.6.1:
  * 7zip reader: fix PPMD read beyond boundary (#1671)
  * ZIP reader: fix possible out of bounds read (OSS-Fuzz 38766 #1672)
  * ISO reader: fix possible heap buffer overflow in read_children() (OSS-Fuzz 38764, #1685)
  * RARv4 redaer: fix multiple issues in RARv4 filter code (introduced in libarchive 3.6.0)
  * fix heap use after free in archive_read_format_rar_read_data() (OSS-Fuzz 44547, 52efa50)
  * fix null dereference in read_data_compressed() (OSS-Fuzz 44843, 1271f77)
  * fix heap user after free in run_filters() (OSS-Fuzz 46279, #1715)
- Drop upstream merged fix-CVE-2022-26280.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1669118400">- Fix CVE-2022-36227, Handle a calloc returning NULL
  (CVE-2022-36227, bsc#1205629)
  * CVE-2022-36227.patch</changelog>
  <changelog author="dmueller@suse.com" date="1671796800">- update to 3.6.2 (bsc#1205629, CVE-2022-36227)
  * NULL pointer dereference vulnerability in archive_write.c
  * include ZSTD in Windows builds (#1688)
  * SSL fixes on Windows (#1714, #1723, #1724)
  * rar5 reader: fix possible garbled output with bsdtar -O (#1745)
  * mtree reader: support reading mtree files with tabs (#1783)
  * various small fixes for issues found by CodeQL
- Drop upstream merged CVE-2022-36227.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1690200000">- update to 3.7.0
  * bsdunzip port from FreeBSD
  * fix 2 year 2038 issues</changelog>
  <changelog author="dmueller@suse.com" date="1694952000">- update to 3.7.2:
  * Multiple vulnerabilities have been fixed in the PAX writer
  * bsdunzip(1) now correctly handles arguments following an
  - x after the zipfile
  * zstd filter now supports the "long" write option
  * SEGV and stack buffer overflow in verbose mode of cpio
  * bsdunzip updated to match latest upstream code
  * miscellaneous functional bugfixes</changelog>
  <changelog author="dmueller@suse.com" date="1703851200">- skip write tests on 32bit, they OOM</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1718193600">- Fix CVE-2024-20696, heap based out-of-bounds write
  (CVE-2024-20696, bsc#1225971)
  * CVE-2024-20696.patch
- Fix CVE-2024-20697, Out of bounds Remote Code Execution Vulnerability
  (CVE-2024-20697, bsc#1225972)
  * CVE-2024-20697.patch</changelog>
</package>
<package pkgid="c95117259e254e986622834d0f12a627b8676d5bbcb39b1d5ac7f39f1c8fa16b" name="bsdtar" arch="s390x">
  <version epoch="0" ver="3.7.2" rel="150600.3.3.1"/>
  <changelog author="idonmez@suse.com" date="1581508800">- Update to version 3.4.2
  New features:
  * support for atomic file extraction (bsdtar -x --safe-writes) (#1289)
  * support for mbed TLS (PolarSSL) (#1301)
  Important bugfixes:
  * security fixes in RAR5 reader (#1280 #1326)
  * compression buffer fix in XAR writer (#1317)
  * fix uname and gname longer than 32 characters in PAX writer (#1319)
  * fix segfault when archiving hard links in ISO9660 and XAR writers (#1325)
  * fix support for extracting 7z archive entries with Delta filter (#987)</changelog>
  <changelog author="idonmez@suse.com" date="1582027200">- Switch back to cmake build now that cmake-mini exists, this will
  no longer create a build-cycle.</changelog>
  <changelog author="idonmez@suse.com" date="1589976000">- Update to version 3.4.3
  * support for pzstd compressed files (#1357)
  * support for RHT.security.selinux tar extended attribute (#1348)
  * various zstd fixes and improvements (#1342 #1352 #1359)
  * child process handling fixes (#1372)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599480000">- fix build with binutils submitted to Factory, adding upstream
  libarchive-3.4.3-fix_test_write_disk_secure.patch</changelog>
  <changelog author="idonmez@suse.com" date="1606824000">- Update to version 3.5.0
  New features:
  * mtree digest reader support (#1347)
  * completed support for UTF-8 encoding conversion (#1389)
  * minor API enhancements (#1258, #1405)
  * support for system extended attributes (#1409)
  * support for decompression of symbolic links in zipx archives (#1435)
  Important bugfixes
  * fixed extraction of archives with hard links pointing to itself (#1381)
  * cpio fixes (#1387, #1388)
  * fixed uninitialized size in rar5_read_data (#1408)
  * fixed memory leaks in error case of archive_write_open() functions (#1456)
- Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream.</changelog>
  <changelog author="dmueller@suse.com" date="1609934400">- update to 3.5.1:
  * various compilation fixes (#1461, #1462, #1463, #1464)
  * fixed undefined behavior in a function in warc reader (#1465)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1631448000">- Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target
  (CVE-2021-23177, bsc#1192425)
  * CVE-2021-23177.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1634817600">- Fix CVE-2021-31566, modifies file flags of symlink target
  (CVE-2021-31566, bsc#1192426.patch)
  CVE-2021-31566.patch
- Fix bsc#1192427, processing fixup entries may follow symbolic links
  bsc1192427.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636286400">- update to 3.5.2:
  * CPIO: Support for PWB and v7 binary cpio formats
  * ZIP reader: Support of deflate algorithm in symbolic link decompression
  * security: fix handling of symbolic link ACLs on Linux (boo#1192425)
  * security: never follow symlinks when setting file flags on Linux (boo#1192426)
  * security: do not follow symlinks when processing the fixup list (boo#1192427)
  * fix extraction of hardlinks to symlinks
  * 7zip reader and writer fixes
  * RAR reader fixes
  * ZIP reader: fix excessive read for padded zip
  * CAB reader: fix double free
  * handle short writes from archive_write_callback
- Drop upstream mereged:
  * CVE-2021-23177.patch
  * CVE-2021-31566.patch
  * bsc1192427.patch</changelog>
  <changelog author="adrian@suse.de" date="1638187200">- fix permission settings on following symlinks (fix-following-symlinks.patch)
  this fixes also wrong permissions of /var/tmp in factory systems
  CVE-2021-31566</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645617600">- Fix CVE-2021-36976 use-after-free in copy_string
  (CVE-2021-36976, bsc#1188572)
  * fix-CVE-2021-36976.patch
- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  CVE-2017-5601, bsc#1022528, bsc#1189528</changelog>
  <changelog author="rpm@fthiessen.de" date="1645704000">- Update to 3.6.0
  * Fix use-after-free bug (CVE-2021-36976)
  * tar: new option "--no-read-sparse"
  * tar: threads support for zstd
  * RAR reader: filter support
  * RAR5 reader: self-extracting archive support
  * ZIP reader: zstd decompression support
  * tar: respect "--ignore-zeros" in c, r and u modes
  * reduced size of application binaries
  * internal code optimizations
- Drop upstream merged:
  * fix-following-symlinks.patch
  * fix-CVE-2021-36976.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649332800">- Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init
  (CVE-2022-26280, bsc#1197634)
  * fix-CVE-2022-26280.patch</changelog>
  <changelog author="dmueller@suse.com" date="1649419200">- update to 3.6.1:
  * 7zip reader: fix PPMD read beyond boundary (#1671)
  * ZIP reader: fix possible out of bounds read (OSS-Fuzz 38766 #1672)
  * ISO reader: fix possible heap buffer overflow in read_children() (OSS-Fuzz 38764, #1685)
  * RARv4 redaer: fix multiple issues in RARv4 filter code (introduced in libarchive 3.6.0)
  * fix heap use after free in archive_read_format_rar_read_data() (OSS-Fuzz 44547, 52efa50)
  * fix null dereference in read_data_compressed() (OSS-Fuzz 44843, 1271f77)
  * fix heap user after free in run_filters() (OSS-Fuzz 46279, #1715)
- Drop upstream merged fix-CVE-2022-26280.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1669118400">- Fix CVE-2022-36227, Handle a calloc returning NULL
  (CVE-2022-36227, bsc#1205629)
  * CVE-2022-36227.patch</changelog>
  <changelog author="dmueller@suse.com" date="1671796800">- update to 3.6.2 (bsc#1205629, CVE-2022-36227)
  * NULL pointer dereference vulnerability in archive_write.c
  * include ZSTD in Windows builds (#1688)
  * SSL fixes on Windows (#1714, #1723, #1724)
  * rar5 reader: fix possible garbled output with bsdtar -O (#1745)
  * mtree reader: support reading mtree files with tabs (#1783)
  * various small fixes for issues found by CodeQL
- Drop upstream merged CVE-2022-36227.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1690200000">- update to 3.7.0
  * bsdunzip port from FreeBSD
  * fix 2 year 2038 issues</changelog>
  <changelog author="dmueller@suse.com" date="1694952000">- update to 3.7.2:
  * Multiple vulnerabilities have been fixed in the PAX writer
  * bsdunzip(1) now correctly handles arguments following an
  - x after the zipfile
  * zstd filter now supports the "long" write option
  * SEGV and stack buffer overflow in verbose mode of cpio
  * bsdunzip updated to match latest upstream code
  * miscellaneous functional bugfixes</changelog>
  <changelog author="dmueller@suse.com" date="1703851200">- skip write tests on 32bit, they OOM</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1718193600">- Fix CVE-2024-20696, heap based out-of-bounds write
  (CVE-2024-20696, bsc#1225971)
  * CVE-2024-20696.patch
- Fix CVE-2024-20697, Out of bounds Remote Code Execution Vulnerability
  (CVE-2024-20697, bsc#1225972)
  * CVE-2024-20697.patch</changelog>
</package>
<package pkgid="8b600888f960721ddbcee096bc9e3783eee1f2954b96bc1de93ae7f8792d2e0d" name="bsdtar" arch="x86_64">
  <version epoch="0" ver="3.7.2" rel="150600.3.3.1"/>
  <changelog author="idonmez@suse.com" date="1581508800">- Update to version 3.4.2
  New features:
  * support for atomic file extraction (bsdtar -x --safe-writes) (#1289)
  * support for mbed TLS (PolarSSL) (#1301)
  Important bugfixes:
  * security fixes in RAR5 reader (#1280 #1326)
  * compression buffer fix in XAR writer (#1317)
  * fix uname and gname longer than 32 characters in PAX writer (#1319)
  * fix segfault when archiving hard links in ISO9660 and XAR writers (#1325)
  * fix support for extracting 7z archive entries with Delta filter (#987)</changelog>
  <changelog author="idonmez@suse.com" date="1582027200">- Switch back to cmake build now that cmake-mini exists, this will
  no longer create a build-cycle.</changelog>
  <changelog author="idonmez@suse.com" date="1589976000">- Update to version 3.4.3
  * support for pzstd compressed files (#1357)
  * support for RHT.security.selinux tar extended attribute (#1348)
  * various zstd fixes and improvements (#1342 #1352 #1359)
  * child process handling fixes (#1372)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599480000">- fix build with binutils submitted to Factory, adding upstream
  libarchive-3.4.3-fix_test_write_disk_secure.patch</changelog>
  <changelog author="idonmez@suse.com" date="1606824000">- Update to version 3.5.0
  New features:
  * mtree digest reader support (#1347)
  * completed support for UTF-8 encoding conversion (#1389)
  * minor API enhancements (#1258, #1405)
  * support for system extended attributes (#1409)
  * support for decompression of symbolic links in zipx archives (#1435)
  Important bugfixes
  * fixed extraction of archives with hard links pointing to itself (#1381)
  * cpio fixes (#1387, #1388)
  * fixed uninitialized size in rar5_read_data (#1408)
  * fixed memory leaks in error case of archive_write_open() functions (#1456)
- Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream.</changelog>
  <changelog author="dmueller@suse.com" date="1609934400">- update to 3.5.1:
  * various compilation fixes (#1461, #1462, #1463, #1464)
  * fixed undefined behavior in a function in warc reader (#1465)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1631448000">- Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target
  (CVE-2021-23177, bsc#1192425)
  * CVE-2021-23177.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1634817600">- Fix CVE-2021-31566, modifies file flags of symlink target
  (CVE-2021-31566, bsc#1192426.patch)
  CVE-2021-31566.patch
- Fix bsc#1192427, processing fixup entries may follow symbolic links
  bsc1192427.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636286400">- update to 3.5.2:
  * CPIO: Support for PWB and v7 binary cpio formats
  * ZIP reader: Support of deflate algorithm in symbolic link decompression
  * security: fix handling of symbolic link ACLs on Linux (boo#1192425)
  * security: never follow symlinks when setting file flags on Linux (boo#1192426)
  * security: do not follow symlinks when processing the fixup list (boo#1192427)
  * fix extraction of hardlinks to symlinks
  * 7zip reader and writer fixes
  * RAR reader fixes
  * ZIP reader: fix excessive read for padded zip
  * CAB reader: fix double free
  * handle short writes from archive_write_callback
- Drop upstream mereged:
  * CVE-2021-23177.patch
  * CVE-2021-31566.patch
  * bsc1192427.patch</changelog>
  <changelog author="adrian@suse.de" date="1638187200">- fix permission settings on following symlinks (fix-following-symlinks.patch)
  this fixes also wrong permissions of /var/tmp in factory systems
  CVE-2021-31566</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645617600">- Fix CVE-2021-36976 use-after-free in copy_string
  (CVE-2021-36976, bsc#1188572)
  * fix-CVE-2021-36976.patch
- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  CVE-2017-5601, bsc#1022528, bsc#1189528</changelog>
  <changelog author="rpm@fthiessen.de" date="1645704000">- Update to 3.6.0
  * Fix use-after-free bug (CVE-2021-36976)
  * tar: new option "--no-read-sparse"
  * tar: threads support for zstd
  * RAR reader: filter support
  * RAR5 reader: self-extracting archive support
  * ZIP reader: zstd decompression support
  * tar: respect "--ignore-zeros" in c, r and u modes
  * reduced size of application binaries
  * internal code optimizations
- Drop upstream merged:
  * fix-following-symlinks.patch
  * fix-CVE-2021-36976.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649332800">- Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init
  (CVE-2022-26280, bsc#1197634)
  * fix-CVE-2022-26280.patch</changelog>
  <changelog author="dmueller@suse.com" date="1649419200">- update to 3.6.1:
  * 7zip reader: fix PPMD read beyond boundary (#1671)
  * ZIP reader: fix possible out of bounds read (OSS-Fuzz 38766 #1672)
  * ISO reader: fix possible heap buffer overflow in read_children() (OSS-Fuzz 38764, #1685)
  * RARv4 redaer: fix multiple issues in RARv4 filter code (introduced in libarchive 3.6.0)
  * fix heap use after free in archive_read_format_rar_read_data() (OSS-Fuzz 44547, 52efa50)
  * fix null dereference in read_data_compressed() (OSS-Fuzz 44843, 1271f77)
  * fix heap user after free in run_filters() (OSS-Fuzz 46279, #1715)
- Drop upstream merged fix-CVE-2022-26280.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1669118400">- Fix CVE-2022-36227, Handle a calloc returning NULL
  (CVE-2022-36227, bsc#1205629)
  * CVE-2022-36227.patch</changelog>
  <changelog author="dmueller@suse.com" date="1671796800">- update to 3.6.2 (bsc#1205629, CVE-2022-36227)
  * NULL pointer dereference vulnerability in archive_write.c
  * include ZSTD in Windows builds (#1688)
  * SSL fixes on Windows (#1714, #1723, #1724)
  * rar5 reader: fix possible garbled output with bsdtar -O (#1745)
  * mtree reader: support reading mtree files with tabs (#1783)
  * various small fixes for issues found by CodeQL
- Drop upstream merged CVE-2022-36227.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1690200000">- update to 3.7.0
  * bsdunzip port from FreeBSD
  * fix 2 year 2038 issues</changelog>
  <changelog author="dmueller@suse.com" date="1694952000">- update to 3.7.2:
  * Multiple vulnerabilities have been fixed in the PAX writer
  * bsdunzip(1) now correctly handles arguments following an
  - x after the zipfile
  * zstd filter now supports the "long" write option
  * SEGV and stack buffer overflow in verbose mode of cpio
  * bsdunzip updated to match latest upstream code
  * miscellaneous functional bugfixes</changelog>
  <changelog author="dmueller@suse.com" date="1703851200">- skip write tests on 32bit, they OOM</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1718193600">- Fix CVE-2024-20696, heap based out-of-bounds write
  (CVE-2024-20696, bsc#1225971)
  * CVE-2024-20696.patch
- Fix CVE-2024-20697, Out of bounds Remote Code Execution Vulnerability
  (CVE-2024-20697, bsc#1225972)
  * CVE-2024-20697.patch</changelog>
</package>
<package pkgid="f26945b84deb5065fef47ed1d35dba271c32a69b0a20c933d12249c5dc673155" name="bsdtar" arch="aarch64">
  <version epoch="0" ver="3.7.2" rel="150600.3.6.1"/>
  <changelog author="idonmez@suse.com" date="1582027200">- Switch back to cmake build now that cmake-mini exists, this will
  no longer create a build-cycle.</changelog>
  <changelog author="idonmez@suse.com" date="1589976000">- Update to version 3.4.3
  * support for pzstd compressed files (#1357)
  * support for RHT.security.selinux tar extended attribute (#1348)
  * various zstd fixes and improvements (#1342 #1352 #1359)
  * child process handling fixes (#1372)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599480000">- fix build with binutils submitted to Factory, adding upstream
  libarchive-3.4.3-fix_test_write_disk_secure.patch</changelog>
  <changelog author="idonmez@suse.com" date="1606824000">- Update to version 3.5.0
  New features:
  * mtree digest reader support (#1347)
  * completed support for UTF-8 encoding conversion (#1389)
  * minor API enhancements (#1258, #1405)
  * support for system extended attributes (#1409)
  * support for decompression of symbolic links in zipx archives (#1435)
  Important bugfixes
  * fixed extraction of archives with hard links pointing to itself (#1381)
  * cpio fixes (#1387, #1388)
  * fixed uninitialized size in rar5_read_data (#1408)
  * fixed memory leaks in error case of archive_write_open() functions (#1456)
- Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream.</changelog>
  <changelog author="dmueller@suse.com" date="1609934400">- update to 3.5.1:
  * various compilation fixes (#1461, #1462, #1463, #1464)
  * fixed undefined behavior in a function in warc reader (#1465)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1631448000">- Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target
  (CVE-2021-23177, bsc#1192425)
  * CVE-2021-23177.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1634817600">- Fix CVE-2021-31566, modifies file flags of symlink target
  (CVE-2021-31566, bsc#1192426.patch)
  CVE-2021-31566.patch
- Fix bsc#1192427, processing fixup entries may follow symbolic links
  bsc1192427.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636286400">- update to 3.5.2:
  * CPIO: Support for PWB and v7 binary cpio formats
  * ZIP reader: Support of deflate algorithm in symbolic link decompression
  * security: fix handling of symbolic link ACLs on Linux (boo#1192425)
  * security: never follow symlinks when setting file flags on Linux (boo#1192426)
  * security: do not follow symlinks when processing the fixup list (boo#1192427)
  * fix extraction of hardlinks to symlinks
  * 7zip reader and writer fixes
  * RAR reader fixes
  * ZIP reader: fix excessive read for padded zip
  * CAB reader: fix double free
  * handle short writes from archive_write_callback
- Drop upstream mereged:
  * CVE-2021-23177.patch
  * CVE-2021-31566.patch
  * bsc1192427.patch</changelog>
  <changelog author="adrian@suse.de" date="1638187200">- fix permission settings on following symlinks (fix-following-symlinks.patch)
  this fixes also wrong permissions of /var/tmp in factory systems
  CVE-2021-31566</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645617600">- Fix CVE-2021-36976 use-after-free in copy_string
  (CVE-2021-36976, bsc#1188572)
  * fix-CVE-2021-36976.patch
- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  CVE-2017-5601, bsc#1022528, bsc#1189528</changelog>
  <changelog author="rpm@fthiessen.de" date="1645704000">- Update to 3.6.0
  * Fix use-after-free bug (CVE-2021-36976)
  * tar: new option "--no-read-sparse"
  * tar: threads support for zstd
  * RAR reader: filter support
  * RAR5 reader: self-extracting archive support
  * ZIP reader: zstd decompression support
  * tar: respect "--ignore-zeros" in c, r and u modes
  * reduced size of application binaries
  * internal code optimizations
- Drop upstream merged:
  * fix-following-symlinks.patch
  * fix-CVE-2021-36976.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649332800">- Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init
  (CVE-2022-26280, bsc#1197634)
  * fix-CVE-2022-26280.patch</changelog>
  <changelog author="dmueller@suse.com" date="1649419200">- update to 3.6.1:
  * 7zip reader: fix PPMD read beyond boundary (#1671)
  * ZIP reader: fix possible out of bounds read (OSS-Fuzz 38766 #1672)
  * ISO reader: fix possible heap buffer overflow in read_children() (OSS-Fuzz 38764, #1685)
  * RARv4 redaer: fix multiple issues in RARv4 filter code (introduced in libarchive 3.6.0)
  * fix heap use after free in archive_read_format_rar_read_data() (OSS-Fuzz 44547, 52efa50)
  * fix null dereference in read_data_compressed() (OSS-Fuzz 44843, 1271f77)
  * fix heap user after free in run_filters() (OSS-Fuzz 46279, #1715)
- Drop upstream merged fix-CVE-2022-26280.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1669118400">- Fix CVE-2022-36227, Handle a calloc returning NULL
  (CVE-2022-36227, bsc#1205629)
  * CVE-2022-36227.patch</changelog>
  <changelog author="dmueller@suse.com" date="1671796800">- update to 3.6.2 (bsc#1205629, CVE-2022-36227)
  * NULL pointer dereference vulnerability in archive_write.c
  * include ZSTD in Windows builds (#1688)
  * SSL fixes on Windows (#1714, #1723, #1724)
  * rar5 reader: fix possible garbled output with bsdtar -O (#1745)
  * mtree reader: support reading mtree files with tabs (#1783)
  * various small fixes for issues found by CodeQL
- Drop upstream merged CVE-2022-36227.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1690200000">- update to 3.7.0
  * bsdunzip port from FreeBSD
  * fix 2 year 2038 issues</changelog>
  <changelog author="dmueller@suse.com" date="1694952000">- update to 3.7.2:
  * Multiple vulnerabilities have been fixed in the PAX writer
  * bsdunzip(1) now correctly handles arguments following an
  - x after the zipfile
  * zstd filter now supports the "long" write option
  * SEGV and stack buffer overflow in verbose mode of cpio
  * bsdunzip updated to match latest upstream code
  * miscellaneous functional bugfixes</changelog>
  <changelog author="dmueller@suse.com" date="1703851200">- skip write tests on 32bit, they OOM</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1718193600">- Fix CVE-2024-20696, heap based out-of-bounds write
  (CVE-2024-20696, bsc#1225971)
  * CVE-2024-20696.patch
- Fix CVE-2024-20697, Out of bounds Remote Code Execution Vulnerability
  (CVE-2024-20697, bsc#1225972)
  * CVE-2024-20697.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1728648000">- Fix CVE-2024-48957, out-of-bounds access in execute_filter_audio
  (CVE-2024-48957, bsc#1231544)
  * CVE-2024-48957.patch</changelog>
</package>
<package pkgid="0bad552fd0b146ba667b3fdde09417b1923e9aad6539b837723d5f92d43df75f" name="bsdtar" arch="ppc64le">
  <version epoch="0" ver="3.7.2" rel="150600.3.6.1"/>
  <changelog author="idonmez@suse.com" date="1582027200">- Switch back to cmake build now that cmake-mini exists, this will
  no longer create a build-cycle.</changelog>
  <changelog author="idonmez@suse.com" date="1589976000">- Update to version 3.4.3
  * support for pzstd compressed files (#1357)
  * support for RHT.security.selinux tar extended attribute (#1348)
  * various zstd fixes and improvements (#1342 #1352 #1359)
  * child process handling fixes (#1372)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599480000">- fix build with binutils submitted to Factory, adding upstream
  libarchive-3.4.3-fix_test_write_disk_secure.patch</changelog>
  <changelog author="idonmez@suse.com" date="1606824000">- Update to version 3.5.0
  New features:
  * mtree digest reader support (#1347)
  * completed support for UTF-8 encoding conversion (#1389)
  * minor API enhancements (#1258, #1405)
  * support for system extended attributes (#1409)
  * support for decompression of symbolic links in zipx archives (#1435)
  Important bugfixes
  * fixed extraction of archives with hard links pointing to itself (#1381)
  * cpio fixes (#1387, #1388)
  * fixed uninitialized size in rar5_read_data (#1408)
  * fixed memory leaks in error case of archive_write_open() functions (#1456)
- Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream.</changelog>
  <changelog author="dmueller@suse.com" date="1609934400">- update to 3.5.1:
  * various compilation fixes (#1461, #1462, #1463, #1464)
  * fixed undefined behavior in a function in warc reader (#1465)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1631448000">- Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target
  (CVE-2021-23177, bsc#1192425)
  * CVE-2021-23177.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1634817600">- Fix CVE-2021-31566, modifies file flags of symlink target
  (CVE-2021-31566, bsc#1192426.patch)
  CVE-2021-31566.patch
- Fix bsc#1192427, processing fixup entries may follow symbolic links
  bsc1192427.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636286400">- update to 3.5.2:
  * CPIO: Support for PWB and v7 binary cpio formats
  * ZIP reader: Support of deflate algorithm in symbolic link decompression
  * security: fix handling of symbolic link ACLs on Linux (boo#1192425)
  * security: never follow symlinks when setting file flags on Linux (boo#1192426)
  * security: do not follow symlinks when processing the fixup list (boo#1192427)
  * fix extraction of hardlinks to symlinks
  * 7zip reader and writer fixes
  * RAR reader fixes
  * ZIP reader: fix excessive read for padded zip
  * CAB reader: fix double free
  * handle short writes from archive_write_callback
- Drop upstream mereged:
  * CVE-2021-23177.patch
  * CVE-2021-31566.patch
  * bsc1192427.patch</changelog>
  <changelog author="adrian@suse.de" date="1638187200">- fix permission settings on following symlinks (fix-following-symlinks.patch)
  this fixes also wrong permissions of /var/tmp in factory systems
  CVE-2021-31566</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645617600">- Fix CVE-2021-36976 use-after-free in copy_string
  (CVE-2021-36976, bsc#1188572)
  * fix-CVE-2021-36976.patch
- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  CVE-2017-5601, bsc#1022528, bsc#1189528</changelog>
  <changelog author="rpm@fthiessen.de" date="1645704000">- Update to 3.6.0
  * Fix use-after-free bug (CVE-2021-36976)
  * tar: new option "--no-read-sparse"
  * tar: threads support for zstd
  * RAR reader: filter support
  * RAR5 reader: self-extracting archive support
  * ZIP reader: zstd decompression support
  * tar: respect "--ignore-zeros" in c, r and u modes
  * reduced size of application binaries
  * internal code optimizations
- Drop upstream merged:
  * fix-following-symlinks.patch
  * fix-CVE-2021-36976.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649332800">- Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init
  (CVE-2022-26280, bsc#1197634)
  * fix-CVE-2022-26280.patch</changelog>
  <changelog author="dmueller@suse.com" date="1649419200">- update to 3.6.1:
  * 7zip reader: fix PPMD read beyond boundary (#1671)
  * ZIP reader: fix possible out of bounds read (OSS-Fuzz 38766 #1672)
  * ISO reader: fix possible heap buffer overflow in read_children() (OSS-Fuzz 38764, #1685)
  * RARv4 redaer: fix multiple issues in RARv4 filter code (introduced in libarchive 3.6.0)
  * fix heap use after free in archive_read_format_rar_read_data() (OSS-Fuzz 44547, 52efa50)
  * fix null dereference in read_data_compressed() (OSS-Fuzz 44843, 1271f77)
  * fix heap user after free in run_filters() (OSS-Fuzz 46279, #1715)
- Drop upstream merged fix-CVE-2022-26280.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1669118400">- Fix CVE-2022-36227, Handle a calloc returning NULL
  (CVE-2022-36227, bsc#1205629)
  * CVE-2022-36227.patch</changelog>
  <changelog author="dmueller@suse.com" date="1671796800">- update to 3.6.2 (bsc#1205629, CVE-2022-36227)
  * NULL pointer dereference vulnerability in archive_write.c
  * include ZSTD in Windows builds (#1688)
  * SSL fixes on Windows (#1714, #1723, #1724)
  * rar5 reader: fix possible garbled output with bsdtar -O (#1745)
  * mtree reader: support reading mtree files with tabs (#1783)
  * various small fixes for issues found by CodeQL
- Drop upstream merged CVE-2022-36227.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1690200000">- update to 3.7.0
  * bsdunzip port from FreeBSD
  * fix 2 year 2038 issues</changelog>
  <changelog author="dmueller@suse.com" date="1694952000">- update to 3.7.2:
  * Multiple vulnerabilities have been fixed in the PAX writer
  * bsdunzip(1) now correctly handles arguments following an
  - x after the zipfile
  * zstd filter now supports the "long" write option
  * SEGV and stack buffer overflow in verbose mode of cpio
  * bsdunzip updated to match latest upstream code
  * miscellaneous functional bugfixes</changelog>
  <changelog author="dmueller@suse.com" date="1703851200">- skip write tests on 32bit, they OOM</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1718193600">- Fix CVE-2024-20696, heap based out-of-bounds write
  (CVE-2024-20696, bsc#1225971)
  * CVE-2024-20696.patch
- Fix CVE-2024-20697, Out of bounds Remote Code Execution Vulnerability
  (CVE-2024-20697, bsc#1225972)
  * CVE-2024-20697.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1728648000">- Fix CVE-2024-48957, out-of-bounds access in execute_filter_audio
  (CVE-2024-48957, bsc#1231544)
  * CVE-2024-48957.patch</changelog>
</package>
<package pkgid="1f5a1cfa8324d3b26398ef81c06971ace43a18f59f382e5e0ddb54678c0f9106" name="bsdtar" arch="s390x">
  <version epoch="0" ver="3.7.2" rel="150600.3.6.1"/>
  <changelog author="idonmez@suse.com" date="1582027200">- Switch back to cmake build now that cmake-mini exists, this will
  no longer create a build-cycle.</changelog>
  <changelog author="idonmez@suse.com" date="1589976000">- Update to version 3.4.3
  * support for pzstd compressed files (#1357)
  * support for RHT.security.selinux tar extended attribute (#1348)
  * various zstd fixes and improvements (#1342 #1352 #1359)
  * child process handling fixes (#1372)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599480000">- fix build with binutils submitted to Factory, adding upstream
  libarchive-3.4.3-fix_test_write_disk_secure.patch</changelog>
  <changelog author="idonmez@suse.com" date="1606824000">- Update to version 3.5.0
  New features:
  * mtree digest reader support (#1347)
  * completed support for UTF-8 encoding conversion (#1389)
  * minor API enhancements (#1258, #1405)
  * support for system extended attributes (#1409)
  * support for decompression of symbolic links in zipx archives (#1435)
  Important bugfixes
  * fixed extraction of archives with hard links pointing to itself (#1381)
  * cpio fixes (#1387, #1388)
  * fixed uninitialized size in rar5_read_data (#1408)
  * fixed memory leaks in error case of archive_write_open() functions (#1456)
- Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream.</changelog>
  <changelog author="dmueller@suse.com" date="1609934400">- update to 3.5.1:
  * various compilation fixes (#1461, #1462, #1463, #1464)
  * fixed undefined behavior in a function in warc reader (#1465)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1631448000">- Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target
  (CVE-2021-23177, bsc#1192425)
  * CVE-2021-23177.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1634817600">- Fix CVE-2021-31566, modifies file flags of symlink target
  (CVE-2021-31566, bsc#1192426.patch)
  CVE-2021-31566.patch
- Fix bsc#1192427, processing fixup entries may follow symbolic links
  bsc1192427.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636286400">- update to 3.5.2:
  * CPIO: Support for PWB and v7 binary cpio formats
  * ZIP reader: Support of deflate algorithm in symbolic link decompression
  * security: fix handling of symbolic link ACLs on Linux (boo#1192425)
  * security: never follow symlinks when setting file flags on Linux (boo#1192426)
  * security: do not follow symlinks when processing the fixup list (boo#1192427)
  * fix extraction of hardlinks to symlinks
  * 7zip reader and writer fixes
  * RAR reader fixes
  * ZIP reader: fix excessive read for padded zip
  * CAB reader: fix double free
  * handle short writes from archive_write_callback
- Drop upstream mereged:
  * CVE-2021-23177.patch
  * CVE-2021-31566.patch
  * bsc1192427.patch</changelog>
  <changelog author="adrian@suse.de" date="1638187200">- fix permission settings on following symlinks (fix-following-symlinks.patch)
  this fixes also wrong permissions of /var/tmp in factory systems
  CVE-2021-31566</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645617600">- Fix CVE-2021-36976 use-after-free in copy_string
  (CVE-2021-36976, bsc#1188572)
  * fix-CVE-2021-36976.patch
- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  CVE-2017-5601, bsc#1022528, bsc#1189528</changelog>
  <changelog author="rpm@fthiessen.de" date="1645704000">- Update to 3.6.0
  * Fix use-after-free bug (CVE-2021-36976)
  * tar: new option "--no-read-sparse"
  * tar: threads support for zstd
  * RAR reader: filter support
  * RAR5 reader: self-extracting archive support
  * ZIP reader: zstd decompression support
  * tar: respect "--ignore-zeros" in c, r and u modes
  * reduced size of application binaries
  * internal code optimizations
- Drop upstream merged:
  * fix-following-symlinks.patch
  * fix-CVE-2021-36976.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649332800">- Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init
  (CVE-2022-26280, bsc#1197634)
  * fix-CVE-2022-26280.patch</changelog>
  <changelog author="dmueller@suse.com" date="1649419200">- update to 3.6.1:
  * 7zip reader: fix PPMD read beyond boundary (#1671)
  * ZIP reader: fix possible out of bounds read (OSS-Fuzz 38766 #1672)
  * ISO reader: fix possible heap buffer overflow in read_children() (OSS-Fuzz 38764, #1685)
  * RARv4 redaer: fix multiple issues in RARv4 filter code (introduced in libarchive 3.6.0)
  * fix heap use after free in archive_read_format_rar_read_data() (OSS-Fuzz 44547, 52efa50)
  * fix null dereference in read_data_compressed() (OSS-Fuzz 44843, 1271f77)
  * fix heap user after free in run_filters() (OSS-Fuzz 46279, #1715)
- Drop upstream merged fix-CVE-2022-26280.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1669118400">- Fix CVE-2022-36227, Handle a calloc returning NULL
  (CVE-2022-36227, bsc#1205629)
  * CVE-2022-36227.patch</changelog>
  <changelog author="dmueller@suse.com" date="1671796800">- update to 3.6.2 (bsc#1205629, CVE-2022-36227)
  * NULL pointer dereference vulnerability in archive_write.c
  * include ZSTD in Windows builds (#1688)
  * SSL fixes on Windows (#1714, #1723, #1724)
  * rar5 reader: fix possible garbled output with bsdtar -O (#1745)
  * mtree reader: support reading mtree files with tabs (#1783)
  * various small fixes for issues found by CodeQL
- Drop upstream merged CVE-2022-36227.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1690200000">- update to 3.7.0
  * bsdunzip port from FreeBSD
  * fix 2 year 2038 issues</changelog>
  <changelog author="dmueller@suse.com" date="1694952000">- update to 3.7.2:
  * Multiple vulnerabilities have been fixed in the PAX writer
  * bsdunzip(1) now correctly handles arguments following an
  - x after the zipfile
  * zstd filter now supports the "long" write option
  * SEGV and stack buffer overflow in verbose mode of cpio
  * bsdunzip updated to match latest upstream code
  * miscellaneous functional bugfixes</changelog>
  <changelog author="dmueller@suse.com" date="1703851200">- skip write tests on 32bit, they OOM</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1718193600">- Fix CVE-2024-20696, heap based out-of-bounds write
  (CVE-2024-20696, bsc#1225971)
  * CVE-2024-20696.patch
- Fix CVE-2024-20697, Out of bounds Remote Code Execution Vulnerability
  (CVE-2024-20697, bsc#1225972)
  * CVE-2024-20697.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1728648000">- Fix CVE-2024-48957, out-of-bounds access in execute_filter_audio
  (CVE-2024-48957, bsc#1231544)
  * CVE-2024-48957.patch</changelog>
</package>
<package pkgid="d27e5dc609d6b7398c4defec21ef018cef5bdfcbb765864e0b3a43686f0f0c81" name="bsdtar" arch="x86_64">
  <version epoch="0" ver="3.7.2" rel="150600.3.6.1"/>
  <changelog author="idonmez@suse.com" date="1582027200">- Switch back to cmake build now that cmake-mini exists, this will
  no longer create a build-cycle.</changelog>
  <changelog author="idonmez@suse.com" date="1589976000">- Update to version 3.4.3
  * support for pzstd compressed files (#1357)
  * support for RHT.security.selinux tar extended attribute (#1348)
  * various zstd fixes and improvements (#1342 #1352 #1359)
  * child process handling fixes (#1372)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599480000">- fix build with binutils submitted to Factory, adding upstream
  libarchive-3.4.3-fix_test_write_disk_secure.patch</changelog>
  <changelog author="idonmez@suse.com" date="1606824000">- Update to version 3.5.0
  New features:
  * mtree digest reader support (#1347)
  * completed support for UTF-8 encoding conversion (#1389)
  * minor API enhancements (#1258, #1405)
  * support for system extended attributes (#1409)
  * support for decompression of symbolic links in zipx archives (#1435)
  Important bugfixes
  * fixed extraction of archives with hard links pointing to itself (#1381)
  * cpio fixes (#1387, #1388)
  * fixed uninitialized size in rar5_read_data (#1408)
  * fixed memory leaks in error case of archive_write_open() functions (#1456)
- Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream.</changelog>
  <changelog author="dmueller@suse.com" date="1609934400">- update to 3.5.1:
  * various compilation fixes (#1461, #1462, #1463, #1464)
  * fixed undefined behavior in a function in warc reader (#1465)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1631448000">- Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target
  (CVE-2021-23177, bsc#1192425)
  * CVE-2021-23177.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1634817600">- Fix CVE-2021-31566, modifies file flags of symlink target
  (CVE-2021-31566, bsc#1192426.patch)
  CVE-2021-31566.patch
- Fix bsc#1192427, processing fixup entries may follow symbolic links
  bsc1192427.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636286400">- update to 3.5.2:
  * CPIO: Support for PWB and v7 binary cpio formats
  * ZIP reader: Support of deflate algorithm in symbolic link decompression
  * security: fix handling of symbolic link ACLs on Linux (boo#1192425)
  * security: never follow symlinks when setting file flags on Linux (boo#1192426)
  * security: do not follow symlinks when processing the fixup list (boo#1192427)
  * fix extraction of hardlinks to symlinks
  * 7zip reader and writer fixes
  * RAR reader fixes
  * ZIP reader: fix excessive read for padded zip
  * CAB reader: fix double free
  * handle short writes from archive_write_callback
- Drop upstream mereged:
  * CVE-2021-23177.patch
  * CVE-2021-31566.patch
  * bsc1192427.patch</changelog>
  <changelog author="adrian@suse.de" date="1638187200">- fix permission settings on following symlinks (fix-following-symlinks.patch)
  this fixes also wrong permissions of /var/tmp in factory systems
  CVE-2021-31566</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645617600">- Fix CVE-2021-36976 use-after-free in copy_string
  (CVE-2021-36976, bsc#1188572)
  * fix-CVE-2021-36976.patch
- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  CVE-2017-5601, bsc#1022528, bsc#1189528</changelog>
  <changelog author="rpm@fthiessen.de" date="1645704000">- Update to 3.6.0
  * Fix use-after-free bug (CVE-2021-36976)
  * tar: new option "--no-read-sparse"
  * tar: threads support for zstd
  * RAR reader: filter support
  * RAR5 reader: self-extracting archive support
  * ZIP reader: zstd decompression support
  * tar: respect "--ignore-zeros" in c, r and u modes
  * reduced size of application binaries
  * internal code optimizations
- Drop upstream merged:
  * fix-following-symlinks.patch
  * fix-CVE-2021-36976.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649332800">- Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init
  (CVE-2022-26280, bsc#1197634)
  * fix-CVE-2022-26280.patch</changelog>
  <changelog author="dmueller@suse.com" date="1649419200">- update to 3.6.1:
  * 7zip reader: fix PPMD read beyond boundary (#1671)
  * ZIP reader: fix possible out of bounds read (OSS-Fuzz 38766 #1672)
  * ISO reader: fix possible heap buffer overflow in read_children() (OSS-Fuzz 38764, #1685)
  * RARv4 redaer: fix multiple issues in RARv4 filter code (introduced in libarchive 3.6.0)
  * fix heap use after free in archive_read_format_rar_read_data() (OSS-Fuzz 44547, 52efa50)
  * fix null dereference in read_data_compressed() (OSS-Fuzz 44843, 1271f77)
  * fix heap user after free in run_filters() (OSS-Fuzz 46279, #1715)
- Drop upstream merged fix-CVE-2022-26280.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1669118400">- Fix CVE-2022-36227, Handle a calloc returning NULL
  (CVE-2022-36227, bsc#1205629)
  * CVE-2022-36227.patch</changelog>
  <changelog author="dmueller@suse.com" date="1671796800">- update to 3.6.2 (bsc#1205629, CVE-2022-36227)
  * NULL pointer dereference vulnerability in archive_write.c
  * include ZSTD in Windows builds (#1688)
  * SSL fixes on Windows (#1714, #1723, #1724)
  * rar5 reader: fix possible garbled output with bsdtar -O (#1745)
  * mtree reader: support reading mtree files with tabs (#1783)
  * various small fixes for issues found by CodeQL
- Drop upstream merged CVE-2022-36227.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1690200000">- update to 3.7.0
  * bsdunzip port from FreeBSD
  * fix 2 year 2038 issues</changelog>
  <changelog author="dmueller@suse.com" date="1694952000">- update to 3.7.2:
  * Multiple vulnerabilities have been fixed in the PAX writer
  * bsdunzip(1) now correctly handles arguments following an
  - x after the zipfile
  * zstd filter now supports the "long" write option
  * SEGV and stack buffer overflow in verbose mode of cpio
  * bsdunzip updated to match latest upstream code
  * miscellaneous functional bugfixes</changelog>
  <changelog author="dmueller@suse.com" date="1703851200">- skip write tests on 32bit, they OOM</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1718193600">- Fix CVE-2024-20696, heap based out-of-bounds write
  (CVE-2024-20696, bsc#1225971)
  * CVE-2024-20696.patch
- Fix CVE-2024-20697, Out of bounds Remote Code Execution Vulnerability
  (CVE-2024-20697, bsc#1225972)
  * CVE-2024-20697.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1728648000">- Fix CVE-2024-48957, out-of-bounds access in execute_filter_audio
  (CVE-2024-48957, bsc#1231544)
  * CVE-2024-48957.patch</changelog>
</package>
<package pkgid="6d94ece65d10a78ae122167bccec07e4c58f9cfac5e3f7b19e823cbceec9eec6" name="bsdtar" arch="aarch64">
  <version epoch="0" ver="3.7.2" rel="150600.3.9.1"/>
  <changelog author="idonmez@suse.com" date="1589976000">- Update to version 3.4.3
  * support for pzstd compressed files (#1357)
  * support for RHT.security.selinux tar extended attribute (#1348)
  * various zstd fixes and improvements (#1342 #1352 #1359)
  * child process handling fixes (#1372)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599480000">- fix build with binutils submitted to Factory, adding upstream
  libarchive-3.4.3-fix_test_write_disk_secure.patch</changelog>
  <changelog author="idonmez@suse.com" date="1606824000">- Update to version 3.5.0
  New features:
  * mtree digest reader support (#1347)
  * completed support for UTF-8 encoding conversion (#1389)
  * minor API enhancements (#1258, #1405)
  * support for system extended attributes (#1409)
  * support for decompression of symbolic links in zipx archives (#1435)
  Important bugfixes
  * fixed extraction of archives with hard links pointing to itself (#1381)
  * cpio fixes (#1387, #1388)
  * fixed uninitialized size in rar5_read_data (#1408)
  * fixed memory leaks in error case of archive_write_open() functions (#1456)
- Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream.</changelog>
  <changelog author="dmueller@suse.com" date="1609934400">- update to 3.5.1:
  * various compilation fixes (#1461, #1462, #1463, #1464)
  * fixed undefined behavior in a function in warc reader (#1465)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1631448000">- Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target
  (CVE-2021-23177, bsc#1192425)
  * CVE-2021-23177.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1634817600">- Fix CVE-2021-31566, modifies file flags of symlink target
  (CVE-2021-31566, bsc#1192426.patch)
  CVE-2021-31566.patch
- Fix bsc#1192427, processing fixup entries may follow symbolic links
  bsc1192427.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636286400">- update to 3.5.2:
  * CPIO: Support for PWB and v7 binary cpio formats
  * ZIP reader: Support of deflate algorithm in symbolic link decompression
  * security: fix handling of symbolic link ACLs on Linux (boo#1192425)
  * security: never follow symlinks when setting file flags on Linux (boo#1192426)
  * security: do not follow symlinks when processing the fixup list (boo#1192427)
  * fix extraction of hardlinks to symlinks
  * 7zip reader and writer fixes
  * RAR reader fixes
  * ZIP reader: fix excessive read for padded zip
  * CAB reader: fix double free
  * handle short writes from archive_write_callback
- Drop upstream mereged:
  * CVE-2021-23177.patch
  * CVE-2021-31566.patch
  * bsc1192427.patch</changelog>
  <changelog author="adrian@suse.de" date="1638187200">- fix permission settings on following symlinks (fix-following-symlinks.patch)
  this fixes also wrong permissions of /var/tmp in factory systems
  CVE-2021-31566</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645617600">- Fix CVE-2021-36976 use-after-free in copy_string
  (CVE-2021-36976, bsc#1188572)
  * fix-CVE-2021-36976.patch
- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  CVE-2017-5601, bsc#1022528, bsc#1189528</changelog>
  <changelog author="rpm@fthiessen.de" date="1645704000">- Update to 3.6.0
  * Fix use-after-free bug (CVE-2021-36976)
  * tar: new option "--no-read-sparse"
  * tar: threads support for zstd
  * RAR reader: filter support
  * RAR5 reader: self-extracting archive support
  * ZIP reader: zstd decompression support
  * tar: respect "--ignore-zeros" in c, r and u modes
  * reduced size of application binaries
  * internal code optimizations
- Drop upstream merged:
  * fix-following-symlinks.patch
  * fix-CVE-2021-36976.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649332800">- Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init
  (CVE-2022-26280, bsc#1197634)
  * fix-CVE-2022-26280.patch</changelog>
  <changelog author="dmueller@suse.com" date="1649419200">- update to 3.6.1:
  * 7zip reader: fix PPMD read beyond boundary (#1671)
  * ZIP reader: fix possible out of bounds read (OSS-Fuzz 38766 #1672)
  * ISO reader: fix possible heap buffer overflow in read_children() (OSS-Fuzz 38764, #1685)
  * RARv4 redaer: fix multiple issues in RARv4 filter code (introduced in libarchive 3.6.0)
  * fix heap use after free in archive_read_format_rar_read_data() (OSS-Fuzz 44547, 52efa50)
  * fix null dereference in read_data_compressed() (OSS-Fuzz 44843, 1271f77)
  * fix heap user after free in run_filters() (OSS-Fuzz 46279, #1715)
- Drop upstream merged fix-CVE-2022-26280.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1669118400">- Fix CVE-2022-36227, Handle a calloc returning NULL
  (CVE-2022-36227, bsc#1205629)
  * CVE-2022-36227.patch</changelog>
  <changelog author="dmueller@suse.com" date="1671796800">- update to 3.6.2 (bsc#1205629, CVE-2022-36227)
  * NULL pointer dereference vulnerability in archive_write.c
  * include ZSTD in Windows builds (#1688)
  * SSL fixes on Windows (#1714, #1723, #1724)
  * rar5 reader: fix possible garbled output with bsdtar -O (#1745)
  * mtree reader: support reading mtree files with tabs (#1783)
  * various small fixes for issues found by CodeQL
- Drop upstream merged CVE-2022-36227.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1690200000">- update to 3.7.0
  * bsdunzip port from FreeBSD
  * fix 2 year 2038 issues</changelog>
  <changelog author="dmueller@suse.com" date="1694952000">- update to 3.7.2:
  * Multiple vulnerabilities have been fixed in the PAX writer
  * bsdunzip(1) now correctly handles arguments following an
  - x after the zipfile
  * zstd filter now supports the "long" write option
  * SEGV and stack buffer overflow in verbose mode of cpio
  * bsdunzip updated to match latest upstream code
  * miscellaneous functional bugfixes</changelog>
  <changelog author="dmueller@suse.com" date="1703851200">- skip write tests on 32bit, they OOM</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1718193600">- Fix CVE-2024-20696, heap based out-of-bounds write
  (CVE-2024-20696, bsc#1225971)
  * CVE-2024-20696.patch
- Fix CVE-2024-20697, Out of bounds Remote Code Execution Vulnerability
  (CVE-2024-20697, bsc#1225972)
  * CVE-2024-20697.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1728648000">- Fix CVE-2024-48957, out-of-bounds access in execute_filter_audio
  (CVE-2024-48957, bsc#1231544)
  * CVE-2024-48957.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1730203200">- Fix CVE-2024-48958, out-of-bounds access in execute_filter_delta
  (CVE-2024-48958, bsc#1231624)
  * CVE-2024-48958.patch
- Additional patch to fix CVE-2024-20697 (also attributed CVE-2024-26256)
  (CVE-2024-20697, CVE-2024-26256, bsc#1225972)
  * CVE-2024-20697-2.patch</changelog>
</package>
<package pkgid="450eb9252499d9476d1115bd37f05c1b6384716187dd81f97b05224718edf2f1" name="bsdtar" arch="ppc64le">
  <version epoch="0" ver="3.7.2" rel="150600.3.9.1"/>
  <changelog author="idonmez@suse.com" date="1589976000">- Update to version 3.4.3
  * support for pzstd compressed files (#1357)
  * support for RHT.security.selinux tar extended attribute (#1348)
  * various zstd fixes and improvements (#1342 #1352 #1359)
  * child process handling fixes (#1372)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599480000">- fix build with binutils submitted to Factory, adding upstream
  libarchive-3.4.3-fix_test_write_disk_secure.patch</changelog>
  <changelog author="idonmez@suse.com" date="1606824000">- Update to version 3.5.0
  New features:
  * mtree digest reader support (#1347)
  * completed support for UTF-8 encoding conversion (#1389)
  * minor API enhancements (#1258, #1405)
  * support for system extended attributes (#1409)
  * support for decompression of symbolic links in zipx archives (#1435)
  Important bugfixes
  * fixed extraction of archives with hard links pointing to itself (#1381)
  * cpio fixes (#1387, #1388)
  * fixed uninitialized size in rar5_read_data (#1408)
  * fixed memory leaks in error case of archive_write_open() functions (#1456)
- Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream.</changelog>
  <changelog author="dmueller@suse.com" date="1609934400">- update to 3.5.1:
  * various compilation fixes (#1461, #1462, #1463, #1464)
  * fixed undefined behavior in a function in warc reader (#1465)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1631448000">- Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target
  (CVE-2021-23177, bsc#1192425)
  * CVE-2021-23177.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1634817600">- Fix CVE-2021-31566, modifies file flags of symlink target
  (CVE-2021-31566, bsc#1192426.patch)
  CVE-2021-31566.patch
- Fix bsc#1192427, processing fixup entries may follow symbolic links
  bsc1192427.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636286400">- update to 3.5.2:
  * CPIO: Support for PWB and v7 binary cpio formats
  * ZIP reader: Support of deflate algorithm in symbolic link decompression
  * security: fix handling of symbolic link ACLs on Linux (boo#1192425)
  * security: never follow symlinks when setting file flags on Linux (boo#1192426)
  * security: do not follow symlinks when processing the fixup list (boo#1192427)
  * fix extraction of hardlinks to symlinks
  * 7zip reader and writer fixes
  * RAR reader fixes
  * ZIP reader: fix excessive read for padded zip
  * CAB reader: fix double free
  * handle short writes from archive_write_callback
- Drop upstream mereged:
  * CVE-2021-23177.patch
  * CVE-2021-31566.patch
  * bsc1192427.patch</changelog>
  <changelog author="adrian@suse.de" date="1638187200">- fix permission settings on following symlinks (fix-following-symlinks.patch)
  this fixes also wrong permissions of /var/tmp in factory systems
  CVE-2021-31566</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645617600">- Fix CVE-2021-36976 use-after-free in copy_string
  (CVE-2021-36976, bsc#1188572)
  * fix-CVE-2021-36976.patch
- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  CVE-2017-5601, bsc#1022528, bsc#1189528</changelog>
  <changelog author="rpm@fthiessen.de" date="1645704000">- Update to 3.6.0
  * Fix use-after-free bug (CVE-2021-36976)
  * tar: new option "--no-read-sparse"
  * tar: threads support for zstd
  * RAR reader: filter support
  * RAR5 reader: self-extracting archive support
  * ZIP reader: zstd decompression support
  * tar: respect "--ignore-zeros" in c, r and u modes
  * reduced size of application binaries
  * internal code optimizations
- Drop upstream merged:
  * fix-following-symlinks.patch
  * fix-CVE-2021-36976.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649332800">- Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init
  (CVE-2022-26280, bsc#1197634)
  * fix-CVE-2022-26280.patch</changelog>
  <changelog author="dmueller@suse.com" date="1649419200">- update to 3.6.1:
  * 7zip reader: fix PPMD read beyond boundary (#1671)
  * ZIP reader: fix possible out of bounds read (OSS-Fuzz 38766 #1672)
  * ISO reader: fix possible heap buffer overflow in read_children() (OSS-Fuzz 38764, #1685)
  * RARv4 redaer: fix multiple issues in RARv4 filter code (introduced in libarchive 3.6.0)
  * fix heap use after free in archive_read_format_rar_read_data() (OSS-Fuzz 44547, 52efa50)
  * fix null dereference in read_data_compressed() (OSS-Fuzz 44843, 1271f77)
  * fix heap user after free in run_filters() (OSS-Fuzz 46279, #1715)
- Drop upstream merged fix-CVE-2022-26280.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1669118400">- Fix CVE-2022-36227, Handle a calloc returning NULL
  (CVE-2022-36227, bsc#1205629)
  * CVE-2022-36227.patch</changelog>
  <changelog author="dmueller@suse.com" date="1671796800">- update to 3.6.2 (bsc#1205629, CVE-2022-36227)
  * NULL pointer dereference vulnerability in archive_write.c
  * include ZSTD in Windows builds (#1688)
  * SSL fixes on Windows (#1714, #1723, #1724)
  * rar5 reader: fix possible garbled output with bsdtar -O (#1745)
  * mtree reader: support reading mtree files with tabs (#1783)
  * various small fixes for issues found by CodeQL
- Drop upstream merged CVE-2022-36227.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1690200000">- update to 3.7.0
  * bsdunzip port from FreeBSD
  * fix 2 year 2038 issues</changelog>
  <changelog author="dmueller@suse.com" date="1694952000">- update to 3.7.2:
  * Multiple vulnerabilities have been fixed in the PAX writer
  * bsdunzip(1) now correctly handles arguments following an
  - x after the zipfile
  * zstd filter now supports the "long" write option
  * SEGV and stack buffer overflow in verbose mode of cpio
  * bsdunzip updated to match latest upstream code
  * miscellaneous functional bugfixes</changelog>
  <changelog author="dmueller@suse.com" date="1703851200">- skip write tests on 32bit, they OOM</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1718193600">- Fix CVE-2024-20696, heap based out-of-bounds write
  (CVE-2024-20696, bsc#1225971)
  * CVE-2024-20696.patch
- Fix CVE-2024-20697, Out of bounds Remote Code Execution Vulnerability
  (CVE-2024-20697, bsc#1225972)
  * CVE-2024-20697.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1728648000">- Fix CVE-2024-48957, out-of-bounds access in execute_filter_audio
  (CVE-2024-48957, bsc#1231544)
  * CVE-2024-48957.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1730203200">- Fix CVE-2024-48958, out-of-bounds access in execute_filter_delta
  (CVE-2024-48958, bsc#1231624)
  * CVE-2024-48958.patch
- Additional patch to fix CVE-2024-20697 (also attributed CVE-2024-26256)
  (CVE-2024-20697, CVE-2024-26256, bsc#1225972)
  * CVE-2024-20697-2.patch</changelog>
</package>
<package pkgid="4878c59186d11d73db24ff6639193a2cf0aaec4253fb59409f4b5fed7918f6e9" name="bsdtar" arch="s390x">
  <version epoch="0" ver="3.7.2" rel="150600.3.9.1"/>
  <changelog author="idonmez@suse.com" date="1589976000">- Update to version 3.4.3
  * support for pzstd compressed files (#1357)
  * support for RHT.security.selinux tar extended attribute (#1348)
  * various zstd fixes and improvements (#1342 #1352 #1359)
  * child process handling fixes (#1372)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599480000">- fix build with binutils submitted to Factory, adding upstream
  libarchive-3.4.3-fix_test_write_disk_secure.patch</changelog>
  <changelog author="idonmez@suse.com" date="1606824000">- Update to version 3.5.0
  New features:
  * mtree digest reader support (#1347)
  * completed support for UTF-8 encoding conversion (#1389)
  * minor API enhancements (#1258, #1405)
  * support for system extended attributes (#1409)
  * support for decompression of symbolic links in zipx archives (#1435)
  Important bugfixes
  * fixed extraction of archives with hard links pointing to itself (#1381)
  * cpio fixes (#1387, #1388)
  * fixed uninitialized size in rar5_read_data (#1408)
  * fixed memory leaks in error case of archive_write_open() functions (#1456)
- Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream.</changelog>
  <changelog author="dmueller@suse.com" date="1609934400">- update to 3.5.1:
  * various compilation fixes (#1461, #1462, #1463, #1464)
  * fixed undefined behavior in a function in warc reader (#1465)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1631448000">- Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target
  (CVE-2021-23177, bsc#1192425)
  * CVE-2021-23177.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1634817600">- Fix CVE-2021-31566, modifies file flags of symlink target
  (CVE-2021-31566, bsc#1192426.patch)
  CVE-2021-31566.patch
- Fix bsc#1192427, processing fixup entries may follow symbolic links
  bsc1192427.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636286400">- update to 3.5.2:
  * CPIO: Support for PWB and v7 binary cpio formats
  * ZIP reader: Support of deflate algorithm in symbolic link decompression
  * security: fix handling of symbolic link ACLs on Linux (boo#1192425)
  * security: never follow symlinks when setting file flags on Linux (boo#1192426)
  * security: do not follow symlinks when processing the fixup list (boo#1192427)
  * fix extraction of hardlinks to symlinks
  * 7zip reader and writer fixes
  * RAR reader fixes
  * ZIP reader: fix excessive read for padded zip
  * CAB reader: fix double free
  * handle short writes from archive_write_callback
- Drop upstream mereged:
  * CVE-2021-23177.patch
  * CVE-2021-31566.patch
  * bsc1192427.patch</changelog>
  <changelog author="adrian@suse.de" date="1638187200">- fix permission settings on following symlinks (fix-following-symlinks.patch)
  this fixes also wrong permissions of /var/tmp in factory systems
  CVE-2021-31566</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645617600">- Fix CVE-2021-36976 use-after-free in copy_string
  (CVE-2021-36976, bsc#1188572)
  * fix-CVE-2021-36976.patch
- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  CVE-2017-5601, bsc#1022528, bsc#1189528</changelog>
  <changelog author="rpm@fthiessen.de" date="1645704000">- Update to 3.6.0
  * Fix use-after-free bug (CVE-2021-36976)
  * tar: new option "--no-read-sparse"
  * tar: threads support for zstd
  * RAR reader: filter support
  * RAR5 reader: self-extracting archive support
  * ZIP reader: zstd decompression support
  * tar: respect "--ignore-zeros" in c, r and u modes
  * reduced size of application binaries
  * internal code optimizations
- Drop upstream merged:
  * fix-following-symlinks.patch
  * fix-CVE-2021-36976.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649332800">- Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init
  (CVE-2022-26280, bsc#1197634)
  * fix-CVE-2022-26280.patch</changelog>
  <changelog author="dmueller@suse.com" date="1649419200">- update to 3.6.1:
  * 7zip reader: fix PPMD read beyond boundary (#1671)
  * ZIP reader: fix possible out of bounds read (OSS-Fuzz 38766 #1672)
  * ISO reader: fix possible heap buffer overflow in read_children() (OSS-Fuzz 38764, #1685)
  * RARv4 redaer: fix multiple issues in RARv4 filter code (introduced in libarchive 3.6.0)
  * fix heap use after free in archive_read_format_rar_read_data() (OSS-Fuzz 44547, 52efa50)
  * fix null dereference in read_data_compressed() (OSS-Fuzz 44843, 1271f77)
  * fix heap user after free in run_filters() (OSS-Fuzz 46279, #1715)
- Drop upstream merged fix-CVE-2022-26280.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1669118400">- Fix CVE-2022-36227, Handle a calloc returning NULL
  (CVE-2022-36227, bsc#1205629)
  * CVE-2022-36227.patch</changelog>
  <changelog author="dmueller@suse.com" date="1671796800">- update to 3.6.2 (bsc#1205629, CVE-2022-36227)
  * NULL pointer dereference vulnerability in archive_write.c
  * include ZSTD in Windows builds (#1688)
  * SSL fixes on Windows (#1714, #1723, #1724)
  * rar5 reader: fix possible garbled output with bsdtar -O (#1745)
  * mtree reader: support reading mtree files with tabs (#1783)
  * various small fixes for issues found by CodeQL
- Drop upstream merged CVE-2022-36227.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1690200000">- update to 3.7.0
  * bsdunzip port from FreeBSD
  * fix 2 year 2038 issues</changelog>
  <changelog author="dmueller@suse.com" date="1694952000">- update to 3.7.2:
  * Multiple vulnerabilities have been fixed in the PAX writer
  * bsdunzip(1) now correctly handles arguments following an
  - x after the zipfile
  * zstd filter now supports the "long" write option
  * SEGV and stack buffer overflow in verbose mode of cpio
  * bsdunzip updated to match latest upstream code
  * miscellaneous functional bugfixes</changelog>
  <changelog author="dmueller@suse.com" date="1703851200">- skip write tests on 32bit, they OOM</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1718193600">- Fix CVE-2024-20696, heap based out-of-bounds write
  (CVE-2024-20696, bsc#1225971)
  * CVE-2024-20696.patch
- Fix CVE-2024-20697, Out of bounds Remote Code Execution Vulnerability
  (CVE-2024-20697, bsc#1225972)
  * CVE-2024-20697.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1728648000">- Fix CVE-2024-48957, out-of-bounds access in execute_filter_audio
  (CVE-2024-48957, bsc#1231544)
  * CVE-2024-48957.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1730203200">- Fix CVE-2024-48958, out-of-bounds access in execute_filter_delta
  (CVE-2024-48958, bsc#1231624)
  * CVE-2024-48958.patch
- Additional patch to fix CVE-2024-20697 (also attributed CVE-2024-26256)
  (CVE-2024-20697, CVE-2024-26256, bsc#1225972)
  * CVE-2024-20697-2.patch</changelog>
</package>
<package pkgid="1a29d848bab4fd5843ebb151ce1b075cd8498dbc4f244a55cfd2bd32a5e867ae" name="bsdtar" arch="x86_64">
  <version epoch="0" ver="3.7.2" rel="150600.3.9.1"/>
  <changelog author="idonmez@suse.com" date="1589976000">- Update to version 3.4.3
  * support for pzstd compressed files (#1357)
  * support for RHT.security.selinux tar extended attribute (#1348)
  * various zstd fixes and improvements (#1342 #1352 #1359)
  * child process handling fixes (#1372)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599480000">- fix build with binutils submitted to Factory, adding upstream
  libarchive-3.4.3-fix_test_write_disk_secure.patch</changelog>
  <changelog author="idonmez@suse.com" date="1606824000">- Update to version 3.5.0
  New features:
  * mtree digest reader support (#1347)
  * completed support for UTF-8 encoding conversion (#1389)
  * minor API enhancements (#1258, #1405)
  * support for system extended attributes (#1409)
  * support for decompression of symbolic links in zipx archives (#1435)
  Important bugfixes
  * fixed extraction of archives with hard links pointing to itself (#1381)
  * cpio fixes (#1387, #1388)
  * fixed uninitialized size in rar5_read_data (#1408)
  * fixed memory leaks in error case of archive_write_open() functions (#1456)
- Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream.</changelog>
  <changelog author="dmueller@suse.com" date="1609934400">- update to 3.5.1:
  * various compilation fixes (#1461, #1462, #1463, #1464)
  * fixed undefined behavior in a function in warc reader (#1465)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1631448000">- Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target
  (CVE-2021-23177, bsc#1192425)
  * CVE-2021-23177.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1634817600">- Fix CVE-2021-31566, modifies file flags of symlink target
  (CVE-2021-31566, bsc#1192426.patch)
  CVE-2021-31566.patch
- Fix bsc#1192427, processing fixup entries may follow symbolic links
  bsc1192427.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636286400">- update to 3.5.2:
  * CPIO: Support for PWB and v7 binary cpio formats
  * ZIP reader: Support of deflate algorithm in symbolic link decompression
  * security: fix handling of symbolic link ACLs on Linux (boo#1192425)
  * security: never follow symlinks when setting file flags on Linux (boo#1192426)
  * security: do not follow symlinks when processing the fixup list (boo#1192427)
  * fix extraction of hardlinks to symlinks
  * 7zip reader and writer fixes
  * RAR reader fixes
  * ZIP reader: fix excessive read for padded zip
  * CAB reader: fix double free
  * handle short writes from archive_write_callback
- Drop upstream mereged:
  * CVE-2021-23177.patch
  * CVE-2021-31566.patch
  * bsc1192427.patch</changelog>
  <changelog author="adrian@suse.de" date="1638187200">- fix permission settings on following symlinks (fix-following-symlinks.patch)
  this fixes also wrong permissions of /var/tmp in factory systems
  CVE-2021-31566</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645617600">- Fix CVE-2021-36976 use-after-free in copy_string
  (CVE-2021-36976, bsc#1188572)
  * fix-CVE-2021-36976.patch
- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  CVE-2017-5601, bsc#1022528, bsc#1189528</changelog>
  <changelog author="rpm@fthiessen.de" date="1645704000">- Update to 3.6.0
  * Fix use-after-free bug (CVE-2021-36976)
  * tar: new option "--no-read-sparse"
  * tar: threads support for zstd
  * RAR reader: filter support
  * RAR5 reader: self-extracting archive support
  * ZIP reader: zstd decompression support
  * tar: respect "--ignore-zeros" in c, r and u modes
  * reduced size of application binaries
  * internal code optimizations
- Drop upstream merged:
  * fix-following-symlinks.patch
  * fix-CVE-2021-36976.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649332800">- Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init
  (CVE-2022-26280, bsc#1197634)
  * fix-CVE-2022-26280.patch</changelog>
  <changelog author="dmueller@suse.com" date="1649419200">- update to 3.6.1:
  * 7zip reader: fix PPMD read beyond boundary (#1671)
  * ZIP reader: fix possible out of bounds read (OSS-Fuzz 38766 #1672)
  * ISO reader: fix possible heap buffer overflow in read_children() (OSS-Fuzz 38764, #1685)
  * RARv4 redaer: fix multiple issues in RARv4 filter code (introduced in libarchive 3.6.0)
  * fix heap use after free in archive_read_format_rar_read_data() (OSS-Fuzz 44547, 52efa50)
  * fix null dereference in read_data_compressed() (OSS-Fuzz 44843, 1271f77)
  * fix heap user after free in run_filters() (OSS-Fuzz 46279, #1715)
- Drop upstream merged fix-CVE-2022-26280.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1669118400">- Fix CVE-2022-36227, Handle a calloc returning NULL
  (CVE-2022-36227, bsc#1205629)
  * CVE-2022-36227.patch</changelog>
  <changelog author="dmueller@suse.com" date="1671796800">- update to 3.6.2 (bsc#1205629, CVE-2022-36227)
  * NULL pointer dereference vulnerability in archive_write.c
  * include ZSTD in Windows builds (#1688)
  * SSL fixes on Windows (#1714, #1723, #1724)
  * rar5 reader: fix possible garbled output with bsdtar -O (#1745)
  * mtree reader: support reading mtree files with tabs (#1783)
  * various small fixes for issues found by CodeQL
- Drop upstream merged CVE-2022-36227.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1690200000">- update to 3.7.0
  * bsdunzip port from FreeBSD
  * fix 2 year 2038 issues</changelog>
  <changelog author="dmueller@suse.com" date="1694952000">- update to 3.7.2:
  * Multiple vulnerabilities have been fixed in the PAX writer
  * bsdunzip(1) now correctly handles arguments following an
  - x after the zipfile
  * zstd filter now supports the "long" write option
  * SEGV and stack buffer overflow in verbose mode of cpio
  * bsdunzip updated to match latest upstream code
  * miscellaneous functional bugfixes</changelog>
  <changelog author="dmueller@suse.com" date="1703851200">- skip write tests on 32bit, they OOM</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1718193600">- Fix CVE-2024-20696, heap based out-of-bounds write
  (CVE-2024-20696, bsc#1225971)
  * CVE-2024-20696.patch
- Fix CVE-2024-20697, Out of bounds Remote Code Execution Vulnerability
  (CVE-2024-20697, bsc#1225972)
  * CVE-2024-20697.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1728648000">- Fix CVE-2024-48957, out-of-bounds access in execute_filter_audio
  (CVE-2024-48957, bsc#1231544)
  * CVE-2024-48957.patch</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1730203200">- Fix CVE-2024-48958, out-of-bounds access in execute_filter_delta
  (CVE-2024-48958, bsc#1231624)
  * CVE-2024-48958.patch
- Additional patch to fix CVE-2024-20697 (also attributed CVE-2024-26256)
  (CVE-2024-20697, CVE-2024-26256, bsc#1225972)
  * CVE-2024-20697-2.patch</changelog>
</package>
<package pkgid="5276f5731a26485c4f5c45f9f4786ce0c965e365f5c6a204b6442771700d26e8" name="bubblewrap" arch="aarch64">
  <version epoch="0" ver="0.8.0" rel="150500.3.3.1"/>
  <changelog author="klember@redhat.com" date="1473681600">- Update to 0.1.2</changelog>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
</package>
<package pkgid="2f7daf41a36f9293c3db8a4d3c912ce5900ef9ca14076fa4c5aee1e87de733bc" name="bubblewrap" arch="ppc64le">
  <version epoch="0" ver="0.8.0" rel="150500.3.3.1"/>
  <changelog author="klember@redhat.com" date="1473681600">- Update to 0.1.2</changelog>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
</package>
<package pkgid="0b9fe124d48c0273b9eb2efeec8dd08784ce7f42f4b4a44e6de97aef2487b181" name="bubblewrap" arch="s390x">
  <version epoch="0" ver="0.8.0" rel="150500.3.3.1"/>
  <changelog author="klember@redhat.com" date="1473681600">- Update to 0.1.2</changelog>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
</package>
<package pkgid="0b969800f641af58d86e8ebd1bac6e19ea0cd0af538fe5dd150a13ae0cc010fc" name="bubblewrap" arch="src">
  <version epoch="0" ver="0.8.0" rel="150500.3.3.1"/>
  <changelog author="klember@redhat.com" date="1473681600">- Update to 0.1.2</changelog>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
</package>
<package pkgid="956c5d8498abc4c077421b5e4ad541e14673b103d12fe42da4c7bab0314ad278" name="bubblewrap" arch="x86_64">
  <version epoch="0" ver="0.8.0" rel="150500.3.3.1"/>
  <changelog author="klember@redhat.com" date="1473681600">- Update to 0.1.2</changelog>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
</package>
<package pkgid="2f878bc1f5178f1901dd414eb3921f0da4c18b67104f9ba30ecfbcc7e4cf87ed" name="bubblewrap" arch="aarch64">
  <version epoch="0" ver="0.8.0" rel="150500.3.6.1"/>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
  <changelog author="qzhao@suse.com" date="1724241600">- Add bubblewrap-CVE-2024-42472.patch:
  Backporting a253257c from upstream, Add --bind-fd and --ro-bind-fd
  to let you bind a O_PATH fd.
  (CVE-2024-42472, bsc#1229157)</changelog>
</package>
<package pkgid="60498e01c6e3ace4c16b2b92f9c3a47acc7240ea8f3c621de77cc6d667d3a961" name="bubblewrap" arch="ppc64le">
  <version epoch="0" ver="0.8.0" rel="150500.3.6.1"/>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
  <changelog author="qzhao@suse.com" date="1724241600">- Add bubblewrap-CVE-2024-42472.patch:
  Backporting a253257c from upstream, Add --bind-fd and --ro-bind-fd
  to let you bind a O_PATH fd.
  (CVE-2024-42472, bsc#1229157)</changelog>
</package>
<package pkgid="1cea970bb32a96b3c048d7536542e89d69365aef608baba4a7ab11028ef989b0" name="bubblewrap" arch="s390x">
  <version epoch="0" ver="0.8.0" rel="150500.3.6.1"/>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
  <changelog author="qzhao@suse.com" date="1724241600">- Add bubblewrap-CVE-2024-42472.patch:
  Backporting a253257c from upstream, Add --bind-fd and --ro-bind-fd
  to let you bind a O_PATH fd.
  (CVE-2024-42472, bsc#1229157)</changelog>
</package>
<package pkgid="80e27f069b01c9b36b442f72cdcc604ed5f6223cebd851647ec419f384f807bd" name="bubblewrap" arch="src">
  <version epoch="0" ver="0.8.0" rel="150500.3.6.1"/>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
  <changelog author="qzhao@suse.com" date="1724241600">- Add bubblewrap-CVE-2024-42472.patch:
  Backporting a253257c from upstream, Add --bind-fd and --ro-bind-fd
  to let you bind a O_PATH fd.
  (CVE-2024-42472, bsc#1229157)</changelog>
</package>
<package pkgid="c7d92fe8edd2a0fb0790bfc9f54c16ef29367c65ec598a040d8b2e3af299e973" name="bubblewrap" arch="x86_64">
  <version epoch="0" ver="0.8.0" rel="150500.3.6.1"/>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
  <changelog author="qzhao@suse.com" date="1724241600">- Add bubblewrap-CVE-2024-42472.patch:
  Backporting a253257c from upstream, Add --bind-fd and --ro-bind-fd
  to let you bind a O_PATH fd.
  (CVE-2024-42472, bsc#1229157)</changelog>
</package>
<package pkgid="c8de47ef307e255edd150260d2c6c252a07a4d80b26eed95eb81330e9ff4fe1a" name="bubblewrap-zsh-completion" arch="aarch64">
  <version epoch="0" ver="0.8.0" rel="150500.3.3.1"/>
  <changelog author="klember@redhat.com" date="1473681600">- Update to 0.1.2</changelog>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
</package>
<package pkgid="5f46c7f13eec0d403f29c1863ee48572d3d00890c14e6d32f05f84f75187a00d" name="bubblewrap-zsh-completion" arch="ppc64le">
  <version epoch="0" ver="0.8.0" rel="150500.3.3.1"/>
  <changelog author="klember@redhat.com" date="1473681600">- Update to 0.1.2</changelog>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
</package>
<package pkgid="b9ef684a283e5942ccccc6a73b99fd88982ad07042fab71ab52595dcbd196bbe" name="bubblewrap-zsh-completion" arch="s390x">
  <version epoch="0" ver="0.8.0" rel="150500.3.3.1"/>
  <changelog author="klember@redhat.com" date="1473681600">- Update to 0.1.2</changelog>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
</package>
<package pkgid="555f6e2eb276407c59429f08ad8dc2f125a89081e5a26e92768671c90aa7e2e7" name="bubblewrap-zsh-completion" arch="x86_64">
  <version epoch="0" ver="0.8.0" rel="150500.3.3.1"/>
  <changelog author="klember@redhat.com" date="1473681600">- Update to 0.1.2</changelog>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
</package>
<package pkgid="245d205402a6c11f4ed054a56cac09276636f539bb9fe0b52c5e0d96692c5ad9" name="bubblewrap-zsh-completion" arch="aarch64">
  <version epoch="0" ver="0.8.0" rel="150500.3.6.1"/>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
  <changelog author="qzhao@suse.com" date="1724241600">- Add bubblewrap-CVE-2024-42472.patch:
  Backporting a253257c from upstream, Add --bind-fd and --ro-bind-fd
  to let you bind a O_PATH fd.
  (CVE-2024-42472, bsc#1229157)</changelog>
</package>
<package pkgid="196518003681b01ec9675d68ba9cc8a1bcdd26ebe49b9f59804a0fd81f182b2f" name="bubblewrap-zsh-completion" arch="ppc64le">
  <version epoch="0" ver="0.8.0" rel="150500.3.6.1"/>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
  <changelog author="qzhao@suse.com" date="1724241600">- Add bubblewrap-CVE-2024-42472.patch:
  Backporting a253257c from upstream, Add --bind-fd and --ro-bind-fd
  to let you bind a O_PATH fd.
  (CVE-2024-42472, bsc#1229157)</changelog>
</package>
<package pkgid="2f06fa91c19e337a64170d85b45c6fc953f5bb83d8a01cc044f9c0b720c59196" name="bubblewrap-zsh-completion" arch="s390x">
  <version epoch="0" ver="0.8.0" rel="150500.3.6.1"/>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
  <changelog author="qzhao@suse.com" date="1724241600">- Add bubblewrap-CVE-2024-42472.patch:
  Backporting a253257c from upstream, Add --bind-fd and --ro-bind-fd
  to let you bind a O_PATH fd.
  (CVE-2024-42472, bsc#1229157)</changelog>
</package>
<package pkgid="6eaa36f66830210ba2f83416435fca22a399ed1d7bb57e04b3c86f746e01acb4" name="bubblewrap-zsh-completion" arch="x86_64">
  <version epoch="0" ver="0.8.0" rel="150500.3.6.1"/>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
  <changelog author="qzhao@suse.com" date="1724241600">- Add bubblewrap-CVE-2024-42472.patch:
  Backporting a253257c from upstream, Add --bind-fd and --ro-bind-fd
  to let you bind a O_PATH fd.
  (CVE-2024-42472, bsc#1229157)</changelog>
</package>
<package pkgid="0dab325bdcde7c4c4d3a3bb5f0fed521a9ef1744bff7cbac117f822e5b3e2f92" name="buildah" arch="aarch64">
  <version epoch="0" ver="1.35.4" rel="150500.3.10.1"/>
  <changelog author="danish.prakash@suse.com" date="1691755200">- Update to version 1.31.2:
  * [release-1.31] Bump to v1.31.2
  * [release-1.31] Bump to v1.31.2-dev
  * [release-1.31] Bump to v1.31.1
  * [release-1.31] Remove zstd:chunked from man, bump c/common to v0.55.3
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * [CI:BUILD] Packit: remove pre-sync action
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream</changelog>
  <changelog author="danish.prakash@suse.com" date="1694606400">- Update to version 1.31.3:
  * [release-1.31] Bump to v1.31.3
  * [release-1.31] Bump c/common 0.55.4, c/image 5.26.2, c/storage 1.48.1
  * rpm: spdx compatible license field
  * RPM: fix buildtags
  * [release-1.31] Bump to v1.31.3-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1695816000">- Update to version 1.32.0:
  * Tag v1.32.0
  * GetTmpDir is not using ImageCopyTmpdir correctly
  * Run codespell on code
  * Bump vendor containers/(common, storage, image)
  * Cirrus: Remove multi-arch buildah image builds
  * fix(deps): update module github.com/containerd/containerd to v1.7.6
  * Split GetTempDir from internal/util
  * Move most of internal/parse to internal/volumes
  * copier: remove libimage dependency via util package
  * Add some docs for `build --cw`, `commit --cw`, and `mkcw`
  * Add `buildah mkcw`, add `--cw` to `buildah commit` and `buildah build`
  * Make sure that pathnames picked up from the environment are absolute
  * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4
  * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible
  * Don't try to look up names when committing images
  * fix(deps): update module golang.org/x/crypto to v0.13.0
  * docs: use valid github repo
  * fix(deps): update module golang.org/x/sys to v0.12.0
  * vendor containers/common@12405381ff45
  * push: --force-compression should be true with --compression-format
  * Update module github.com/containerd/containerd to v1.7.5
  * [skip-ci] Update tim-actions/commit-message-checker-with-regex action to v0.3.2
  * docs: add reference to oci-hooks
  * Support passing of ULimits as -1 to mean max
  * GHA: Attempt to fix discussion_lock workflow
  * Fixing the owner of the storage.conf.
  * pkg/chrootuser: Ignore comments when parsing /etc/group on FreeBSD
  * Use buildah repo rather then podman repo
  * GHA: Closed issue/PR comment-lock test
  * fix(deps): update module github.com/containers/storage to v1.49.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * Replace troff code with markdown in buildah-{copy,add}.1.md
  * [CI:BUILD] rpm: spdx compatible license field
  * executor: build-arg warnings must honor global args
  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8
  * chroot: `setSeccomp` add support for `ArchPARISC(64)` and `ArchRISCV64`
  * make,cross: restore loong64
  * Clear CommonBuildOpts when loading Builder status
  * buildah/push/manifest-push: add support for --force-compression
  * vendor: bump c/common to v0.55.1-0.20230811093040-524b4d5c12f9
  * chore(deps): update dependency containers/automation_images to v20230809
  * [CI:BUILD] RPM: fix buildtags
  * fix(deps): update module github.com/opencontainers/runc to v1.1.9
  * chore(deps): update dependency ubuntu to v22
  * chore(deps): update dependency containers/automation_images to v20230807
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * Update install.md
  * Update install.md changes current Debian stable version name
  * fix(deps): update module golang.org/x/term to v0.11.0
  * fix(deps): update module golang.org/x/crypto to v0.12.0
  * tests: fix layer-label tests
  * buildah: add --layer-label for setting labels on layers
  * Cirrus: container/rootless env. var. passthrough
  * Cirrus: Remove duplicate env. var. definitions
  * fix(deps): update github.com/containers/storage digest to c3da76f
  * Add a missing .Close() call on an ImageSource
  * Create only a reference when that's all we need
  * Add a missing .Close() call on an ImageDestination
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream
  * manifest/push: add support for --add-compression
  * manifest/inspect: add support for tls-verify and authfile
  * vendor: bump c/common to v0.55.1-0.20230727095721-647ed1d4d79a
  * vendor: bump c/image to v5.26.1-0.20230726142307-8c387a14f4ac
  * fix(deps): update module github.com/containerd/containerd to v1.7.3
  * fix(deps): update module github.com/onsi/gomega to v1.27.10
  * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible
  * fix(deps): update module github.com/containers/image/v5 to v5.26.1
  * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0
  * Update vendor of containers/(storage,image,common)
  * fix(deps): update module github.com/opencontainers/runc to v1.1.8
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update module github.com/containers/common to v0.55.2
  * [CI:BUILD] Packit: downstream task script needs GOPATH
  * Vendor in containers/(common, image, storage)
  * fix(deps): update module golang.org/x/term to v0.10.0
  * [CI:BUILD] Packit: fix pre-sync action for downstream tasks
  * contrib/buildahimage: set config correctly for rootless build user
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4
  * Bump to v1.32.0-dev
  * Update debian install instructions
  * pkg/overlay: add limited support for FreeBSD</changelog>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
</package>
<package pkgid="edef3df84574c782e0a1c8bd0ede6302b24238ed6584ff199cb2a377c08f6a92" name="buildah" arch="ppc64le">
  <version epoch="0" ver="1.35.4" rel="150500.3.10.1"/>
  <changelog author="danish.prakash@suse.com" date="1691755200">- Update to version 1.31.2:
  * [release-1.31] Bump to v1.31.2
  * [release-1.31] Bump to v1.31.2-dev
  * [release-1.31] Bump to v1.31.1
  * [release-1.31] Remove zstd:chunked from man, bump c/common to v0.55.3
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * [CI:BUILD] Packit: remove pre-sync action
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream</changelog>
  <changelog author="danish.prakash@suse.com" date="1694606400">- Update to version 1.31.3:
  * [release-1.31] Bump to v1.31.3
  * [release-1.31] Bump c/common 0.55.4, c/image 5.26.2, c/storage 1.48.1
  * rpm: spdx compatible license field
  * RPM: fix buildtags
  * [release-1.31] Bump to v1.31.3-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1695816000">- Update to version 1.32.0:
  * Tag v1.32.0
  * GetTmpDir is not using ImageCopyTmpdir correctly
  * Run codespell on code
  * Bump vendor containers/(common, storage, image)
  * Cirrus: Remove multi-arch buildah image builds
  * fix(deps): update module github.com/containerd/containerd to v1.7.6
  * Split GetTempDir from internal/util
  * Move most of internal/parse to internal/volumes
  * copier: remove libimage dependency via util package
  * Add some docs for `build --cw`, `commit --cw`, and `mkcw`
  * Add `buildah mkcw`, add `--cw` to `buildah commit` and `buildah build`
  * Make sure that pathnames picked up from the environment are absolute
  * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4
  * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible
  * Don't try to look up names when committing images
  * fix(deps): update module golang.org/x/crypto to v0.13.0
  * docs: use valid github repo
  * fix(deps): update module golang.org/x/sys to v0.12.0
  * vendor containers/common@12405381ff45
  * push: --force-compression should be true with --compression-format
  * Update module github.com/containerd/containerd to v1.7.5
  * [skip-ci] Update tim-actions/commit-message-checker-with-regex action to v0.3.2
  * docs: add reference to oci-hooks
  * Support passing of ULimits as -1 to mean max
  * GHA: Attempt to fix discussion_lock workflow
  * Fixing the owner of the storage.conf.
  * pkg/chrootuser: Ignore comments when parsing /etc/group on FreeBSD
  * Use buildah repo rather then podman repo
  * GHA: Closed issue/PR comment-lock test
  * fix(deps): update module github.com/containers/storage to v1.49.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * Replace troff code with markdown in buildah-{copy,add}.1.md
  * [CI:BUILD] rpm: spdx compatible license field
  * executor: build-arg warnings must honor global args
  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8
  * chroot: `setSeccomp` add support for `ArchPARISC(64)` and `ArchRISCV64`
  * make,cross: restore loong64
  * Clear CommonBuildOpts when loading Builder status
  * buildah/push/manifest-push: add support for --force-compression
  * vendor: bump c/common to v0.55.1-0.20230811093040-524b4d5c12f9
  * chore(deps): update dependency containers/automation_images to v20230809
  * [CI:BUILD] RPM: fix buildtags
  * fix(deps): update module github.com/opencontainers/runc to v1.1.9
  * chore(deps): update dependency ubuntu to v22
  * chore(deps): update dependency containers/automation_images to v20230807
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * Update install.md
  * Update install.md changes current Debian stable version name
  * fix(deps): update module golang.org/x/term to v0.11.0
  * fix(deps): update module golang.org/x/crypto to v0.12.0
  * tests: fix layer-label tests
  * buildah: add --layer-label for setting labels on layers
  * Cirrus: container/rootless env. var. passthrough
  * Cirrus: Remove duplicate env. var. definitions
  * fix(deps): update github.com/containers/storage digest to c3da76f
  * Add a missing .Close() call on an ImageSource
  * Create only a reference when that's all we need
  * Add a missing .Close() call on an ImageDestination
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream
  * manifest/push: add support for --add-compression
  * manifest/inspect: add support for tls-verify and authfile
  * vendor: bump c/common to v0.55.1-0.20230727095721-647ed1d4d79a
  * vendor: bump c/image to v5.26.1-0.20230726142307-8c387a14f4ac
  * fix(deps): update module github.com/containerd/containerd to v1.7.3
  * fix(deps): update module github.com/onsi/gomega to v1.27.10
  * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible
  * fix(deps): update module github.com/containers/image/v5 to v5.26.1
  * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0
  * Update vendor of containers/(storage,image,common)
  * fix(deps): update module github.com/opencontainers/runc to v1.1.8
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update module github.com/containers/common to v0.55.2
  * [CI:BUILD] Packit: downstream task script needs GOPATH
  * Vendor in containers/(common, image, storage)
  * fix(deps): update module golang.org/x/term to v0.10.0
  * [CI:BUILD] Packit: fix pre-sync action for downstream tasks
  * contrib/buildahimage: set config correctly for rootless build user
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4
  * Bump to v1.32.0-dev
  * Update debian install instructions
  * pkg/overlay: add limited support for FreeBSD</changelog>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
</package>
<package pkgid="83208ed2ffee7c39b4e614f0ed5d76512a015f5db7b2b1fea566bfaad862a118" name="buildah" arch="s390x">
  <version epoch="0" ver="1.35.4" rel="150500.3.10.1"/>
  <changelog author="danish.prakash@suse.com" date="1691755200">- Update to version 1.31.2:
  * [release-1.31] Bump to v1.31.2
  * [release-1.31] Bump to v1.31.2-dev
  * [release-1.31] Bump to v1.31.1
  * [release-1.31] Remove zstd:chunked from man, bump c/common to v0.55.3
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * [CI:BUILD] Packit: remove pre-sync action
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream</changelog>
  <changelog author="danish.prakash@suse.com" date="1694606400">- Update to version 1.31.3:
  * [release-1.31] Bump to v1.31.3
  * [release-1.31] Bump c/common 0.55.4, c/image 5.26.2, c/storage 1.48.1
  * rpm: spdx compatible license field
  * RPM: fix buildtags
  * [release-1.31] Bump to v1.31.3-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1695816000">- Update to version 1.32.0:
  * Tag v1.32.0
  * GetTmpDir is not using ImageCopyTmpdir correctly
  * Run codespell on code
  * Bump vendor containers/(common, storage, image)
  * Cirrus: Remove multi-arch buildah image builds
  * fix(deps): update module github.com/containerd/containerd to v1.7.6
  * Split GetTempDir from internal/util
  * Move most of internal/parse to internal/volumes
  * copier: remove libimage dependency via util package
  * Add some docs for `build --cw`, `commit --cw`, and `mkcw`
  * Add `buildah mkcw`, add `--cw` to `buildah commit` and `buildah build`
  * Make sure that pathnames picked up from the environment are absolute
  * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4
  * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible
  * Don't try to look up names when committing images
  * fix(deps): update module golang.org/x/crypto to v0.13.0
  * docs: use valid github repo
  * fix(deps): update module golang.org/x/sys to v0.12.0
  * vendor containers/common@12405381ff45
  * push: --force-compression should be true with --compression-format
  * Update module github.com/containerd/containerd to v1.7.5
  * [skip-ci] Update tim-actions/commit-message-checker-with-regex action to v0.3.2
  * docs: add reference to oci-hooks
  * Support passing of ULimits as -1 to mean max
  * GHA: Attempt to fix discussion_lock workflow
  * Fixing the owner of the storage.conf.
  * pkg/chrootuser: Ignore comments when parsing /etc/group on FreeBSD
  * Use buildah repo rather then podman repo
  * GHA: Closed issue/PR comment-lock test
  * fix(deps): update module github.com/containers/storage to v1.49.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * Replace troff code with markdown in buildah-{copy,add}.1.md
  * [CI:BUILD] rpm: spdx compatible license field
  * executor: build-arg warnings must honor global args
  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8
  * chroot: `setSeccomp` add support for `ArchPARISC(64)` and `ArchRISCV64`
  * make,cross: restore loong64
  * Clear CommonBuildOpts when loading Builder status
  * buildah/push/manifest-push: add support for --force-compression
  * vendor: bump c/common to v0.55.1-0.20230811093040-524b4d5c12f9
  * chore(deps): update dependency containers/automation_images to v20230809
  * [CI:BUILD] RPM: fix buildtags
  * fix(deps): update module github.com/opencontainers/runc to v1.1.9
  * chore(deps): update dependency ubuntu to v22
  * chore(deps): update dependency containers/automation_images to v20230807
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * Update install.md
  * Update install.md changes current Debian stable version name
  * fix(deps): update module golang.org/x/term to v0.11.0
  * fix(deps): update module golang.org/x/crypto to v0.12.0
  * tests: fix layer-label tests
  * buildah: add --layer-label for setting labels on layers
  * Cirrus: container/rootless env. var. passthrough
  * Cirrus: Remove duplicate env. var. definitions
  * fix(deps): update github.com/containers/storage digest to c3da76f
  * Add a missing .Close() call on an ImageSource
  * Create only a reference when that's all we need
  * Add a missing .Close() call on an ImageDestination
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream
  * manifest/push: add support for --add-compression
  * manifest/inspect: add support for tls-verify and authfile
  * vendor: bump c/common to v0.55.1-0.20230727095721-647ed1d4d79a
  * vendor: bump c/image to v5.26.1-0.20230726142307-8c387a14f4ac
  * fix(deps): update module github.com/containerd/containerd to v1.7.3
  * fix(deps): update module github.com/onsi/gomega to v1.27.10
  * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible
  * fix(deps): update module github.com/containers/image/v5 to v5.26.1
  * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0
  * Update vendor of containers/(storage,image,common)
  * fix(deps): update module github.com/opencontainers/runc to v1.1.8
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update module github.com/containers/common to v0.55.2
  * [CI:BUILD] Packit: downstream task script needs GOPATH
  * Vendor in containers/(common, image, storage)
  * fix(deps): update module golang.org/x/term to v0.10.0
  * [CI:BUILD] Packit: fix pre-sync action for downstream tasks
  * contrib/buildahimage: set config correctly for rootless build user
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4
  * Bump to v1.32.0-dev
  * Update debian install instructions
  * pkg/overlay: add limited support for FreeBSD</changelog>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
</package>
<package pkgid="0731f7656a6bad43c53ed87974f06ad12bbdaac7a7bf620aa393fee865151ae0" name="buildah" arch="src">
  <version epoch="0" ver="1.35.4" rel="150500.3.10.1"/>
  <changelog author="danish.prakash@suse.com" date="1691755200">- Update to version 1.31.2:
  * [release-1.31] Bump to v1.31.2
  * [release-1.31] Bump to v1.31.2-dev
  * [release-1.31] Bump to v1.31.1
  * [release-1.31] Remove zstd:chunked from man, bump c/common to v0.55.3
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * [CI:BUILD] Packit: remove pre-sync action
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream</changelog>
  <changelog author="danish.prakash@suse.com" date="1694606400">- Update to version 1.31.3:
  * [release-1.31] Bump to v1.31.3
  * [release-1.31] Bump c/common 0.55.4, c/image 5.26.2, c/storage 1.48.1
  * rpm: spdx compatible license field
  * RPM: fix buildtags
  * [release-1.31] Bump to v1.31.3-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1695816000">- Update to version 1.32.0:
  * Tag v1.32.0
  * GetTmpDir is not using ImageCopyTmpdir correctly
  * Run codespell on code
  * Bump vendor containers/(common, storage, image)
  * Cirrus: Remove multi-arch buildah image builds
  * fix(deps): update module github.com/containerd/containerd to v1.7.6
  * Split GetTempDir from internal/util
  * Move most of internal/parse to internal/volumes
  * copier: remove libimage dependency via util package
  * Add some docs for `build --cw`, `commit --cw`, and `mkcw`
  * Add `buildah mkcw`, add `--cw` to `buildah commit` and `buildah build`
  * Make sure that pathnames picked up from the environment are absolute
  * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4
  * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible
  * Don't try to look up names when committing images
  * fix(deps): update module golang.org/x/crypto to v0.13.0
  * docs: use valid github repo
  * fix(deps): update module golang.org/x/sys to v0.12.0
  * vendor containers/common@12405381ff45
  * push: --force-compression should be true with --compression-format
  * Update module github.com/containerd/containerd to v1.7.5
  * [skip-ci] Update tim-actions/commit-message-checker-with-regex action to v0.3.2
  * docs: add reference to oci-hooks
  * Support passing of ULimits as -1 to mean max
  * GHA: Attempt to fix discussion_lock workflow
  * Fixing the owner of the storage.conf.
  * pkg/chrootuser: Ignore comments when parsing /etc/group on FreeBSD
  * Use buildah repo rather then podman repo
  * GHA: Closed issue/PR comment-lock test
  * fix(deps): update module github.com/containers/storage to v1.49.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * Replace troff code with markdown in buildah-{copy,add}.1.md
  * [CI:BUILD] rpm: spdx compatible license field
  * executor: build-arg warnings must honor global args
  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8
  * chroot: `setSeccomp` add support for `ArchPARISC(64)` and `ArchRISCV64`
  * make,cross: restore loong64
  * Clear CommonBuildOpts when loading Builder status
  * buildah/push/manifest-push: add support for --force-compression
  * vendor: bump c/common to v0.55.1-0.20230811093040-524b4d5c12f9
  * chore(deps): update dependency containers/automation_images to v20230809
  * [CI:BUILD] RPM: fix buildtags
  * fix(deps): update module github.com/opencontainers/runc to v1.1.9
  * chore(deps): update dependency ubuntu to v22
  * chore(deps): update dependency containers/automation_images to v20230807
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * Update install.md
  * Update install.md changes current Debian stable version name
  * fix(deps): update module golang.org/x/term to v0.11.0
  * fix(deps): update module golang.org/x/crypto to v0.12.0
  * tests: fix layer-label tests
  * buildah: add --layer-label for setting labels on layers
  * Cirrus: container/rootless env. var. passthrough
  * Cirrus: Remove duplicate env. var. definitions
  * fix(deps): update github.com/containers/storage digest to c3da76f
  * Add a missing .Close() call on an ImageSource
  * Create only a reference when that's all we need
  * Add a missing .Close() call on an ImageDestination
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream
  * manifest/push: add support for --add-compression
  * manifest/inspect: add support for tls-verify and authfile
  * vendor: bump c/common to v0.55.1-0.20230727095721-647ed1d4d79a
  * vendor: bump c/image to v5.26.1-0.20230726142307-8c387a14f4ac
  * fix(deps): update module github.com/containerd/containerd to v1.7.3
  * fix(deps): update module github.com/onsi/gomega to v1.27.10
  * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible
  * fix(deps): update module github.com/containers/image/v5 to v5.26.1
  * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0
  * Update vendor of containers/(storage,image,common)
  * fix(deps): update module github.com/opencontainers/runc to v1.1.8
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update module github.com/containers/common to v0.55.2
  * [CI:BUILD] Packit: downstream task script needs GOPATH
  * Vendor in containers/(common, image, storage)
  * fix(deps): update module golang.org/x/term to v0.10.0
  * [CI:BUILD] Packit: fix pre-sync action for downstream tasks
  * contrib/buildahimage: set config correctly for rootless build user
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4
  * Bump to v1.32.0-dev
  * Update debian install instructions
  * pkg/overlay: add limited support for FreeBSD</changelog>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
</package>
<package pkgid="4e3131a78244c771bab165885542708af7e509a4652ce153187f5d2eeb3bc0af" name="buildah" arch="x86_64">
  <version epoch="0" ver="1.35.4" rel="150500.3.10.1"/>
  <changelog author="danish.prakash@suse.com" date="1691755200">- Update to version 1.31.2:
  * [release-1.31] Bump to v1.31.2
  * [release-1.31] Bump to v1.31.2-dev
  * [release-1.31] Bump to v1.31.1
  * [release-1.31] Remove zstd:chunked from man, bump c/common to v0.55.3
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * [CI:BUILD] Packit: remove pre-sync action
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream</changelog>
  <changelog author="danish.prakash@suse.com" date="1694606400">- Update to version 1.31.3:
  * [release-1.31] Bump to v1.31.3
  * [release-1.31] Bump c/common 0.55.4, c/image 5.26.2, c/storage 1.48.1
  * rpm: spdx compatible license field
  * RPM: fix buildtags
  * [release-1.31] Bump to v1.31.3-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1695816000">- Update to version 1.32.0:
  * Tag v1.32.0
  * GetTmpDir is not using ImageCopyTmpdir correctly
  * Run codespell on code
  * Bump vendor containers/(common, storage, image)
  * Cirrus: Remove multi-arch buildah image builds
  * fix(deps): update module github.com/containerd/containerd to v1.7.6
  * Split GetTempDir from internal/util
  * Move most of internal/parse to internal/volumes
  * copier: remove libimage dependency via util package
  * Add some docs for `build --cw`, `commit --cw`, and `mkcw`
  * Add `buildah mkcw`, add `--cw` to `buildah commit` and `buildah build`
  * Make sure that pathnames picked up from the environment are absolute
  * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4
  * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible
  * Don't try to look up names when committing images
  * fix(deps): update module golang.org/x/crypto to v0.13.0
  * docs: use valid github repo
  * fix(deps): update module golang.org/x/sys to v0.12.0
  * vendor containers/common@12405381ff45
  * push: --force-compression should be true with --compression-format
  * Update module github.com/containerd/containerd to v1.7.5
  * [skip-ci] Update tim-actions/commit-message-checker-with-regex action to v0.3.2
  * docs: add reference to oci-hooks
  * Support passing of ULimits as -1 to mean max
  * GHA: Attempt to fix discussion_lock workflow
  * Fixing the owner of the storage.conf.
  * pkg/chrootuser: Ignore comments when parsing /etc/group on FreeBSD
  * Use buildah repo rather then podman repo
  * GHA: Closed issue/PR comment-lock test
  * fix(deps): update module github.com/containers/storage to v1.49.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * Replace troff code with markdown in buildah-{copy,add}.1.md
  * [CI:BUILD] rpm: spdx compatible license field
  * executor: build-arg warnings must honor global args
  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8
  * chroot: `setSeccomp` add support for `ArchPARISC(64)` and `ArchRISCV64`
  * make,cross: restore loong64
  * Clear CommonBuildOpts when loading Builder status
  * buildah/push/manifest-push: add support for --force-compression
  * vendor: bump c/common to v0.55.1-0.20230811093040-524b4d5c12f9
  * chore(deps): update dependency containers/automation_images to v20230809
  * [CI:BUILD] RPM: fix buildtags
  * fix(deps): update module github.com/opencontainers/runc to v1.1.9
  * chore(deps): update dependency ubuntu to v22
  * chore(deps): update dependency containers/automation_images to v20230807
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * Update install.md
  * Update install.md changes current Debian stable version name
  * fix(deps): update module golang.org/x/term to v0.11.0
  * fix(deps): update module golang.org/x/crypto to v0.12.0
  * tests: fix layer-label tests
  * buildah: add --layer-label for setting labels on layers
  * Cirrus: container/rootless env. var. passthrough
  * Cirrus: Remove duplicate env. var. definitions
  * fix(deps): update github.com/containers/storage digest to c3da76f
  * Add a missing .Close() call on an ImageSource
  * Create only a reference when that's all we need
  * Add a missing .Close() call on an ImageDestination
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream
  * manifest/push: add support for --add-compression
  * manifest/inspect: add support for tls-verify and authfile
  * vendor: bump c/common to v0.55.1-0.20230727095721-647ed1d4d79a
  * vendor: bump c/image to v5.26.1-0.20230726142307-8c387a14f4ac
  * fix(deps): update module github.com/containerd/containerd to v1.7.3
  * fix(deps): update module github.com/onsi/gomega to v1.27.10
  * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible
  * fix(deps): update module github.com/containers/image/v5 to v5.26.1
  * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0
  * Update vendor of containers/(storage,image,common)
  * fix(deps): update module github.com/opencontainers/runc to v1.1.8
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update module github.com/containers/common to v0.55.2
  * [CI:BUILD] Packit: downstream task script needs GOPATH
  * Vendor in containers/(common, image, storage)
  * fix(deps): update module golang.org/x/term to v0.10.0
  * [CI:BUILD] Packit: fix pre-sync action for downstream tasks
  * contrib/buildahimage: set config correctly for rootless build user
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4
  * Bump to v1.32.0-dev
  * Update debian install instructions
  * pkg/overlay: add limited support for FreeBSD</changelog>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
</package>
<package pkgid="4efa01b1c56c884959567367f7d2da4d0ca89d6188cc433a9d85e1c4922d09b9" name="buildah" arch="aarch64">
  <version epoch="0" ver="1.35.4" rel="150500.3.13.1"/>
  <changelog author="danish.prakash@suse.com" date="1694606400">- Update to version 1.31.3:
  * [release-1.31] Bump to v1.31.3
  * [release-1.31] Bump c/common 0.55.4, c/image 5.26.2, c/storage 1.48.1
  * rpm: spdx compatible license field
  * RPM: fix buildtags
  * [release-1.31] Bump to v1.31.3-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1695816000">- Update to version 1.32.0:
  * Tag v1.32.0
  * GetTmpDir is not using ImageCopyTmpdir correctly
  * Run codespell on code
  * Bump vendor containers/(common, storage, image)
  * Cirrus: Remove multi-arch buildah image builds
  * fix(deps): update module github.com/containerd/containerd to v1.7.6
  * Split GetTempDir from internal/util
  * Move most of internal/parse to internal/volumes
  * copier: remove libimage dependency via util package
  * Add some docs for `build --cw`, `commit --cw`, and `mkcw`
  * Add `buildah mkcw`, add `--cw` to `buildah commit` and `buildah build`
  * Make sure that pathnames picked up from the environment are absolute
  * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4
  * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible
  * Don't try to look up names when committing images
  * fix(deps): update module golang.org/x/crypto to v0.13.0
  * docs: use valid github repo
  * fix(deps): update module golang.org/x/sys to v0.12.0
  * vendor containers/common@12405381ff45
  * push: --force-compression should be true with --compression-format
  * Update module github.com/containerd/containerd to v1.7.5
  * [skip-ci] Update tim-actions/commit-message-checker-with-regex action to v0.3.2
  * docs: add reference to oci-hooks
  * Support passing of ULimits as -1 to mean max
  * GHA: Attempt to fix discussion_lock workflow
  * Fixing the owner of the storage.conf.
  * pkg/chrootuser: Ignore comments when parsing /etc/group on FreeBSD
  * Use buildah repo rather then podman repo
  * GHA: Closed issue/PR comment-lock test
  * fix(deps): update module github.com/containers/storage to v1.49.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * Replace troff code with markdown in buildah-{copy,add}.1.md
  * [CI:BUILD] rpm: spdx compatible license field
  * executor: build-arg warnings must honor global args
  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8
  * chroot: `setSeccomp` add support for `ArchPARISC(64)` and `ArchRISCV64`
  * make,cross: restore loong64
  * Clear CommonBuildOpts when loading Builder status
  * buildah/push/manifest-push: add support for --force-compression
  * vendor: bump c/common to v0.55.1-0.20230811093040-524b4d5c12f9
  * chore(deps): update dependency containers/automation_images to v20230809
  * [CI:BUILD] RPM: fix buildtags
  * fix(deps): update module github.com/opencontainers/runc to v1.1.9
  * chore(deps): update dependency ubuntu to v22
  * chore(deps): update dependency containers/automation_images to v20230807
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * Update install.md
  * Update install.md changes current Debian stable version name
  * fix(deps): update module golang.org/x/term to v0.11.0
  * fix(deps): update module golang.org/x/crypto to v0.12.0
  * tests: fix layer-label tests
  * buildah: add --layer-label for setting labels on layers
  * Cirrus: container/rootless env. var. passthrough
  * Cirrus: Remove duplicate env. var. definitions
  * fix(deps): update github.com/containers/storage digest to c3da76f
  * Add a missing .Close() call on an ImageSource
  * Create only a reference when that's all we need
  * Add a missing .Close() call on an ImageDestination
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream
  * manifest/push: add support for --add-compression
  * manifest/inspect: add support for tls-verify and authfile
  * vendor: bump c/common to v0.55.1-0.20230727095721-647ed1d4d79a
  * vendor: bump c/image to v5.26.1-0.20230726142307-8c387a14f4ac
  * fix(deps): update module github.com/containerd/containerd to v1.7.3
  * fix(deps): update module github.com/onsi/gomega to v1.27.10
  * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible
  * fix(deps): update module github.com/containers/image/v5 to v5.26.1
  * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0
  * Update vendor of containers/(storage,image,common)
  * fix(deps): update module github.com/opencontainers/runc to v1.1.8
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update module github.com/containers/common to v0.55.2
  * [CI:BUILD] Packit: downstream task script needs GOPATH
  * Vendor in containers/(common, image, storage)
  * fix(deps): update module golang.org/x/term to v0.10.0
  * [CI:BUILD] Packit: fix pre-sync action for downstream tasks
  * contrib/buildahimage: set config correctly for rootless build user
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4
  * Bump to v1.32.0-dev
  * Update debian install instructions
  * pkg/overlay: add limited support for FreeBSD</changelog>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
  <changelog author="dcermak@suse.com" date="1727870400">- Add patches for CVE-2024-9407 and CVE-2024-9341:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch (bsc#1231208
    aka CVE-2024-9407)
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch (bsc#1231230
    aka CVE-2024-9341)</changelog>
</package>
<package pkgid="341d6d897920c39e89447b64c48e1cdd41fa3370b07a74c2d1595098980ddf26" name="buildah" arch="ppc64le">
  <version epoch="0" ver="1.35.4" rel="150500.3.13.1"/>
  <changelog author="danish.prakash@suse.com" date="1694606400">- Update to version 1.31.3:
  * [release-1.31] Bump to v1.31.3
  * [release-1.31] Bump c/common 0.55.4, c/image 5.26.2, c/storage 1.48.1
  * rpm: spdx compatible license field
  * RPM: fix buildtags
  * [release-1.31] Bump to v1.31.3-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1695816000">- Update to version 1.32.0:
  * Tag v1.32.0
  * GetTmpDir is not using ImageCopyTmpdir correctly
  * Run codespell on code
  * Bump vendor containers/(common, storage, image)
  * Cirrus: Remove multi-arch buildah image builds
  * fix(deps): update module github.com/containerd/containerd to v1.7.6
  * Split GetTempDir from internal/util
  * Move most of internal/parse to internal/volumes
  * copier: remove libimage dependency via util package
  * Add some docs for `build --cw`, `commit --cw`, and `mkcw`
  * Add `buildah mkcw`, add `--cw` to `buildah commit` and `buildah build`
  * Make sure that pathnames picked up from the environment are absolute
  * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4
  * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible
  * Don't try to look up names when committing images
  * fix(deps): update module golang.org/x/crypto to v0.13.0
  * docs: use valid github repo
  * fix(deps): update module golang.org/x/sys to v0.12.0
  * vendor containers/common@12405381ff45
  * push: --force-compression should be true with --compression-format
  * Update module github.com/containerd/containerd to v1.7.5
  * [skip-ci] Update tim-actions/commit-message-checker-with-regex action to v0.3.2
  * docs: add reference to oci-hooks
  * Support passing of ULimits as -1 to mean max
  * GHA: Attempt to fix discussion_lock workflow
  * Fixing the owner of the storage.conf.
  * pkg/chrootuser: Ignore comments when parsing /etc/group on FreeBSD
  * Use buildah repo rather then podman repo
  * GHA: Closed issue/PR comment-lock test
  * fix(deps): update module github.com/containers/storage to v1.49.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * Replace troff code with markdown in buildah-{copy,add}.1.md
  * [CI:BUILD] rpm: spdx compatible license field
  * executor: build-arg warnings must honor global args
  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8
  * chroot: `setSeccomp` add support for `ArchPARISC(64)` and `ArchRISCV64`
  * make,cross: restore loong64
  * Clear CommonBuildOpts when loading Builder status
  * buildah/push/manifest-push: add support for --force-compression
  * vendor: bump c/common to v0.55.1-0.20230811093040-524b4d5c12f9
  * chore(deps): update dependency containers/automation_images to v20230809
  * [CI:BUILD] RPM: fix buildtags
  * fix(deps): update module github.com/opencontainers/runc to v1.1.9
  * chore(deps): update dependency ubuntu to v22
  * chore(deps): update dependency containers/automation_images to v20230807
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * Update install.md
  * Update install.md changes current Debian stable version name
  * fix(deps): update module golang.org/x/term to v0.11.0
  * fix(deps): update module golang.org/x/crypto to v0.12.0
  * tests: fix layer-label tests
  * buildah: add --layer-label for setting labels on layers
  * Cirrus: container/rootless env. var. passthrough
  * Cirrus: Remove duplicate env. var. definitions
  * fix(deps): update github.com/containers/storage digest to c3da76f
  * Add a missing .Close() call on an ImageSource
  * Create only a reference when that's all we need
  * Add a missing .Close() call on an ImageDestination
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream
  * manifest/push: add support for --add-compression
  * manifest/inspect: add support for tls-verify and authfile
  * vendor: bump c/common to v0.55.1-0.20230727095721-647ed1d4d79a
  * vendor: bump c/image to v5.26.1-0.20230726142307-8c387a14f4ac
  * fix(deps): update module github.com/containerd/containerd to v1.7.3
  * fix(deps): update module github.com/onsi/gomega to v1.27.10
  * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible
  * fix(deps): update module github.com/containers/image/v5 to v5.26.1
  * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0
  * Update vendor of containers/(storage,image,common)
  * fix(deps): update module github.com/opencontainers/runc to v1.1.8
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update module github.com/containers/common to v0.55.2
  * [CI:BUILD] Packit: downstream task script needs GOPATH
  * Vendor in containers/(common, image, storage)
  * fix(deps): update module golang.org/x/term to v0.10.0
  * [CI:BUILD] Packit: fix pre-sync action for downstream tasks
  * contrib/buildahimage: set config correctly for rootless build user
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4
  * Bump to v1.32.0-dev
  * Update debian install instructions
  * pkg/overlay: add limited support for FreeBSD</changelog>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
  <changelog author="dcermak@suse.com" date="1727870400">- Add patches for CVE-2024-9407 and CVE-2024-9341:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch (bsc#1231208
    aka CVE-2024-9407)
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch (bsc#1231230
    aka CVE-2024-9341)</changelog>
</package>
<package pkgid="645d251f427f7223cea1ad3155b11954cc84ee5d529e6b341e9a0b1d3552f3f5" name="buildah" arch="s390x">
  <version epoch="0" ver="1.35.4" rel="150500.3.13.1"/>
  <changelog author="danish.prakash@suse.com" date="1694606400">- Update to version 1.31.3:
  * [release-1.31] Bump to v1.31.3
  * [release-1.31] Bump c/common 0.55.4, c/image 5.26.2, c/storage 1.48.1
  * rpm: spdx compatible license field
  * RPM: fix buildtags
  * [release-1.31] Bump to v1.31.3-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1695816000">- Update to version 1.32.0:
  * Tag v1.32.0
  * GetTmpDir is not using ImageCopyTmpdir correctly
  * Run codespell on code
  * Bump vendor containers/(common, storage, image)
  * Cirrus: Remove multi-arch buildah image builds
  * fix(deps): update module github.com/containerd/containerd to v1.7.6
  * Split GetTempDir from internal/util
  * Move most of internal/parse to internal/volumes
  * copier: remove libimage dependency via util package
  * Add some docs for `build --cw`, `commit --cw`, and `mkcw`
  * Add `buildah mkcw`, add `--cw` to `buildah commit` and `buildah build`
  * Make sure that pathnames picked up from the environment are absolute
  * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4
  * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible
  * Don't try to look up names when committing images
  * fix(deps): update module golang.org/x/crypto to v0.13.0
  * docs: use valid github repo
  * fix(deps): update module golang.org/x/sys to v0.12.0
  * vendor containers/common@12405381ff45
  * push: --force-compression should be true with --compression-format
  * Update module github.com/containerd/containerd to v1.7.5
  * [skip-ci] Update tim-actions/commit-message-checker-with-regex action to v0.3.2
  * docs: add reference to oci-hooks
  * Support passing of ULimits as -1 to mean max
  * GHA: Attempt to fix discussion_lock workflow
  * Fixing the owner of the storage.conf.
  * pkg/chrootuser: Ignore comments when parsing /etc/group on FreeBSD
  * Use buildah repo rather then podman repo
  * GHA: Closed issue/PR comment-lock test
  * fix(deps): update module github.com/containers/storage to v1.49.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * Replace troff code with markdown in buildah-{copy,add}.1.md
  * [CI:BUILD] rpm: spdx compatible license field
  * executor: build-arg warnings must honor global args
  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8
  * chroot: `setSeccomp` add support for `ArchPARISC(64)` and `ArchRISCV64`
  * make,cross: restore loong64
  * Clear CommonBuildOpts when loading Builder status
  * buildah/push/manifest-push: add support for --force-compression
  * vendor: bump c/common to v0.55.1-0.20230811093040-524b4d5c12f9
  * chore(deps): update dependency containers/automation_images to v20230809
  * [CI:BUILD] RPM: fix buildtags
  * fix(deps): update module github.com/opencontainers/runc to v1.1.9
  * chore(deps): update dependency ubuntu to v22
  * chore(deps): update dependency containers/automation_images to v20230807
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * Update install.md
  * Update install.md changes current Debian stable version name
  * fix(deps): update module golang.org/x/term to v0.11.0
  * fix(deps): update module golang.org/x/crypto to v0.12.0
  * tests: fix layer-label tests
  * buildah: add --layer-label for setting labels on layers
  * Cirrus: container/rootless env. var. passthrough
  * Cirrus: Remove duplicate env. var. definitions
  * fix(deps): update github.com/containers/storage digest to c3da76f
  * Add a missing .Close() call on an ImageSource
  * Create only a reference when that's all we need
  * Add a missing .Close() call on an ImageDestination
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream
  * manifest/push: add support for --add-compression
  * manifest/inspect: add support for tls-verify and authfile
  * vendor: bump c/common to v0.55.1-0.20230727095721-647ed1d4d79a
  * vendor: bump c/image to v5.26.1-0.20230726142307-8c387a14f4ac
  * fix(deps): update module github.com/containerd/containerd to v1.7.3
  * fix(deps): update module github.com/onsi/gomega to v1.27.10
  * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible
  * fix(deps): update module github.com/containers/image/v5 to v5.26.1
  * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0
  * Update vendor of containers/(storage,image,common)
  * fix(deps): update module github.com/opencontainers/runc to v1.1.8
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update module github.com/containers/common to v0.55.2
  * [CI:BUILD] Packit: downstream task script needs GOPATH
  * Vendor in containers/(common, image, storage)
  * fix(deps): update module golang.org/x/term to v0.10.0
  * [CI:BUILD] Packit: fix pre-sync action for downstream tasks
  * contrib/buildahimage: set config correctly for rootless build user
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4
  * Bump to v1.32.0-dev
  * Update debian install instructions
  * pkg/overlay: add limited support for FreeBSD</changelog>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
  <changelog author="dcermak@suse.com" date="1727870400">- Add patches for CVE-2024-9407 and CVE-2024-9341:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch (bsc#1231208
    aka CVE-2024-9407)
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch (bsc#1231230
    aka CVE-2024-9341)</changelog>
</package>
<package pkgid="566b48a7639de320946e64f68561bdd199a26e5208d3c99217961dde581cbb5c" name="buildah" arch="src">
  <version epoch="0" ver="1.35.4" rel="150500.3.13.1"/>
  <changelog author="danish.prakash@suse.com" date="1694606400">- Update to version 1.31.3:
  * [release-1.31] Bump to v1.31.3
  * [release-1.31] Bump c/common 0.55.4, c/image 5.26.2, c/storage 1.48.1
  * rpm: spdx compatible license field
  * RPM: fix buildtags
  * [release-1.31] Bump to v1.31.3-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1695816000">- Update to version 1.32.0:
  * Tag v1.32.0
  * GetTmpDir is not using ImageCopyTmpdir correctly
  * Run codespell on code
  * Bump vendor containers/(common, storage, image)
  * Cirrus: Remove multi-arch buildah image builds
  * fix(deps): update module github.com/containerd/containerd to v1.7.6
  * Split GetTempDir from internal/util
  * Move most of internal/parse to internal/volumes
  * copier: remove libimage dependency via util package
  * Add some docs for `build --cw`, `commit --cw`, and `mkcw`
  * Add `buildah mkcw`, add `--cw` to `buildah commit` and `buildah build`
  * Make sure that pathnames picked up from the environment are absolute
  * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4
  * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible
  * Don't try to look up names when committing images
  * fix(deps): update module golang.org/x/crypto to v0.13.0
  * docs: use valid github repo
  * fix(deps): update module golang.org/x/sys to v0.12.0
  * vendor containers/common@12405381ff45
  * push: --force-compression should be true with --compression-format
  * Update module github.com/containerd/containerd to v1.7.5
  * [skip-ci] Update tim-actions/commit-message-checker-with-regex action to v0.3.2
  * docs: add reference to oci-hooks
  * Support passing of ULimits as -1 to mean max
  * GHA: Attempt to fix discussion_lock workflow
  * Fixing the owner of the storage.conf.
  * pkg/chrootuser: Ignore comments when parsing /etc/group on FreeBSD
  * Use buildah repo rather then podman repo
  * GHA: Closed issue/PR comment-lock test
  * fix(deps): update module github.com/containers/storage to v1.49.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * Replace troff code with markdown in buildah-{copy,add}.1.md
  * [CI:BUILD] rpm: spdx compatible license field
  * executor: build-arg warnings must honor global args
  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8
  * chroot: `setSeccomp` add support for `ArchPARISC(64)` and `ArchRISCV64`
  * make,cross: restore loong64
  * Clear CommonBuildOpts when loading Builder status
  * buildah/push/manifest-push: add support for --force-compression
  * vendor: bump c/common to v0.55.1-0.20230811093040-524b4d5c12f9
  * chore(deps): update dependency containers/automation_images to v20230809
  * [CI:BUILD] RPM: fix buildtags
  * fix(deps): update module github.com/opencontainers/runc to v1.1.9
  * chore(deps): update dependency ubuntu to v22
  * chore(deps): update dependency containers/automation_images to v20230807
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * Update install.md
  * Update install.md changes current Debian stable version name
  * fix(deps): update module golang.org/x/term to v0.11.0
  * fix(deps): update module golang.org/x/crypto to v0.12.0
  * tests: fix layer-label tests
  * buildah: add --layer-label for setting labels on layers
  * Cirrus: container/rootless env. var. passthrough
  * Cirrus: Remove duplicate env. var. definitions
  * fix(deps): update github.com/containers/storage digest to c3da76f
  * Add a missing .Close() call on an ImageSource
  * Create only a reference when that's all we need
  * Add a missing .Close() call on an ImageDestination
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream
  * manifest/push: add support for --add-compression
  * manifest/inspect: add support for tls-verify and authfile
  * vendor: bump c/common to v0.55.1-0.20230727095721-647ed1d4d79a
  * vendor: bump c/image to v5.26.1-0.20230726142307-8c387a14f4ac
  * fix(deps): update module github.com/containerd/containerd to v1.7.3
  * fix(deps): update module github.com/onsi/gomega to v1.27.10
  * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible
  * fix(deps): update module github.com/containers/image/v5 to v5.26.1
  * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0
  * Update vendor of containers/(storage,image,common)
  * fix(deps): update module github.com/opencontainers/runc to v1.1.8
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update module github.com/containers/common to v0.55.2
  * [CI:BUILD] Packit: downstream task script needs GOPATH
  * Vendor in containers/(common, image, storage)
  * fix(deps): update module golang.org/x/term to v0.10.0
  * [CI:BUILD] Packit: fix pre-sync action for downstream tasks
  * contrib/buildahimage: set config correctly for rootless build user
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4
  * Bump to v1.32.0-dev
  * Update debian install instructions
  * pkg/overlay: add limited support for FreeBSD</changelog>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
  <changelog author="dcermak@suse.com" date="1727870400">- Add patches for CVE-2024-9407 and CVE-2024-9341:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch (bsc#1231208
    aka CVE-2024-9407)
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch (bsc#1231230
    aka CVE-2024-9341)</changelog>
</package>
<package pkgid="fd6ddb7ae8fe294afda24eee56731be7658ff070c22a69396f38a7c4754e4315" name="buildah" arch="x86_64">
  <version epoch="0" ver="1.35.4" rel="150500.3.13.1"/>
  <changelog author="danish.prakash@suse.com" date="1694606400">- Update to version 1.31.3:
  * [release-1.31] Bump to v1.31.3
  * [release-1.31] Bump c/common 0.55.4, c/image 5.26.2, c/storage 1.48.1
  * rpm: spdx compatible license field
  * RPM: fix buildtags
  * [release-1.31] Bump to v1.31.3-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1695816000">- Update to version 1.32.0:
  * Tag v1.32.0
  * GetTmpDir is not using ImageCopyTmpdir correctly
  * Run codespell on code
  * Bump vendor containers/(common, storage, image)
  * Cirrus: Remove multi-arch buildah image builds
  * fix(deps): update module github.com/containerd/containerd to v1.7.6
  * Split GetTempDir from internal/util
  * Move most of internal/parse to internal/volumes
  * copier: remove libimage dependency via util package
  * Add some docs for `build --cw`, `commit --cw`, and `mkcw`
  * Add `buildah mkcw`, add `--cw` to `buildah commit` and `buildah build`
  * Make sure that pathnames picked up from the environment are absolute
  * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4
  * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible
  * Don't try to look up names when committing images
  * fix(deps): update module golang.org/x/crypto to v0.13.0
  * docs: use valid github repo
  * fix(deps): update module golang.org/x/sys to v0.12.0
  * vendor containers/common@12405381ff45
  * push: --force-compression should be true with --compression-format
  * Update module github.com/containerd/containerd to v1.7.5
  * [skip-ci] Update tim-actions/commit-message-checker-with-regex action to v0.3.2
  * docs: add reference to oci-hooks
  * Support passing of ULimits as -1 to mean max
  * GHA: Attempt to fix discussion_lock workflow
  * Fixing the owner of the storage.conf.
  * pkg/chrootuser: Ignore comments when parsing /etc/group on FreeBSD
  * Use buildah repo rather then podman repo
  * GHA: Closed issue/PR comment-lock test
  * fix(deps): update module github.com/containers/storage to v1.49.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * Replace troff code with markdown in buildah-{copy,add}.1.md
  * [CI:BUILD] rpm: spdx compatible license field
  * executor: build-arg warnings must honor global args
  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8
  * chroot: `setSeccomp` add support for `ArchPARISC(64)` and `ArchRISCV64`
  * make,cross: restore loong64
  * Clear CommonBuildOpts when loading Builder status
  * buildah/push/manifest-push: add support for --force-compression
  * vendor: bump c/common to v0.55.1-0.20230811093040-524b4d5c12f9
  * chore(deps): update dependency containers/automation_images to v20230809
  * [CI:BUILD] RPM: fix buildtags
  * fix(deps): update module github.com/opencontainers/runc to v1.1.9
  * chore(deps): update dependency ubuntu to v22
  * chore(deps): update dependency containers/automation_images to v20230807
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * Update install.md
  * Update install.md changes current Debian stable version name
  * fix(deps): update module golang.org/x/term to v0.11.0
  * fix(deps): update module golang.org/x/crypto to v0.12.0
  * tests: fix layer-label tests
  * buildah: add --layer-label for setting labels on layers
  * Cirrus: container/rootless env. var. passthrough
  * Cirrus: Remove duplicate env. var. definitions
  * fix(deps): update github.com/containers/storage digest to c3da76f
  * Add a missing .Close() call on an ImageSource
  * Create only a reference when that's all we need
  * Add a missing .Close() call on an ImageDestination
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream
  * manifest/push: add support for --add-compression
  * manifest/inspect: add support for tls-verify and authfile
  * vendor: bump c/common to v0.55.1-0.20230727095721-647ed1d4d79a
  * vendor: bump c/image to v5.26.1-0.20230726142307-8c387a14f4ac
  * fix(deps): update module github.com/containerd/containerd to v1.7.3
  * fix(deps): update module github.com/onsi/gomega to v1.27.10
  * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible
  * fix(deps): update module github.com/containers/image/v5 to v5.26.1
  * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0
  * Update vendor of containers/(storage,image,common)
  * fix(deps): update module github.com/opencontainers/runc to v1.1.8
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update module github.com/containers/common to v0.55.2
  * [CI:BUILD] Packit: downstream task script needs GOPATH
  * Vendor in containers/(common, image, storage)
  * fix(deps): update module golang.org/x/term to v0.10.0
  * [CI:BUILD] Packit: fix pre-sync action for downstream tasks
  * contrib/buildahimage: set config correctly for rootless build user
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4
  * Bump to v1.32.0-dev
  * Update debian install instructions
  * pkg/overlay: add limited support for FreeBSD</changelog>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
  <changelog author="dcermak@suse.com" date="1727870400">- Add patches for CVE-2024-9407 and CVE-2024-9341:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch (bsc#1231208
    aka CVE-2024-9407)
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch (bsc#1231230
    aka CVE-2024-9341)</changelog>
</package>
<package pkgid="aa71e9e8b940cf7d5b785dbe8544132e324e72a638ab97725b7f1e63767fd265" name="buildah" arch="aarch64">
  <version epoch="0" ver="1.35.4" rel="150500.3.16.1"/>
  <changelog author="danish.prakash@suse.com" date="1695816000">- Update to version 1.32.0:
  * Tag v1.32.0
  * GetTmpDir is not using ImageCopyTmpdir correctly
  * Run codespell on code
  * Bump vendor containers/(common, storage, image)
  * Cirrus: Remove multi-arch buildah image builds
  * fix(deps): update module github.com/containerd/containerd to v1.7.6
  * Split GetTempDir from internal/util
  * Move most of internal/parse to internal/volumes
  * copier: remove libimage dependency via util package
  * Add some docs for `build --cw`, `commit --cw`, and `mkcw`
  * Add `buildah mkcw`, add `--cw` to `buildah commit` and `buildah build`
  * Make sure that pathnames picked up from the environment are absolute
  * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4
  * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible
  * Don't try to look up names when committing images
  * fix(deps): update module golang.org/x/crypto to v0.13.0
  * docs: use valid github repo
  * fix(deps): update module golang.org/x/sys to v0.12.0
  * vendor containers/common@12405381ff45
  * push: --force-compression should be true with --compression-format
  * Update module github.com/containerd/containerd to v1.7.5
  * [skip-ci] Update tim-actions/commit-message-checker-with-regex action to v0.3.2
  * docs: add reference to oci-hooks
  * Support passing of ULimits as -1 to mean max
  * GHA: Attempt to fix discussion_lock workflow
  * Fixing the owner of the storage.conf.
  * pkg/chrootuser: Ignore comments when parsing /etc/group on FreeBSD
  * Use buildah repo rather then podman repo
  * GHA: Closed issue/PR comment-lock test
  * fix(deps): update module github.com/containers/storage to v1.49.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * Replace troff code with markdown in buildah-{copy,add}.1.md
  * [CI:BUILD] rpm: spdx compatible license field
  * executor: build-arg warnings must honor global args
  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8
  * chroot: `setSeccomp` add support for `ArchPARISC(64)` and `ArchRISCV64`
  * make,cross: restore loong64
  * Clear CommonBuildOpts when loading Builder status
  * buildah/push/manifest-push: add support for --force-compression
  * vendor: bump c/common to v0.55.1-0.20230811093040-524b4d5c12f9
  * chore(deps): update dependency containers/automation_images to v20230809
  * [CI:BUILD] RPM: fix buildtags
  * fix(deps): update module github.com/opencontainers/runc to v1.1.9
  * chore(deps): update dependency ubuntu to v22
  * chore(deps): update dependency containers/automation_images to v20230807
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * Update install.md
  * Update install.md changes current Debian stable version name
  * fix(deps): update module golang.org/x/term to v0.11.0
  * fix(deps): update module golang.org/x/crypto to v0.12.0
  * tests: fix layer-label tests
  * buildah: add --layer-label for setting labels on layers
  * Cirrus: container/rootless env. var. passthrough
  * Cirrus: Remove duplicate env. var. definitions
  * fix(deps): update github.com/containers/storage digest to c3da76f
  * Add a missing .Close() call on an ImageSource
  * Create only a reference when that's all we need
  * Add a missing .Close() call on an ImageDestination
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream
  * manifest/push: add support for --add-compression
  * manifest/inspect: add support for tls-verify and authfile
  * vendor: bump c/common to v0.55.1-0.20230727095721-647ed1d4d79a
  * vendor: bump c/image to v5.26.1-0.20230726142307-8c387a14f4ac
  * fix(deps): update module github.com/containerd/containerd to v1.7.3
  * fix(deps): update module github.com/onsi/gomega to v1.27.10
  * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible
  * fix(deps): update module github.com/containers/image/v5 to v5.26.1
  * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0
  * Update vendor of containers/(storage,image,common)
  * fix(deps): update module github.com/opencontainers/runc to v1.1.8
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update module github.com/containers/common to v0.55.2
  * [CI:BUILD] Packit: downstream task script needs GOPATH
  * Vendor in containers/(common, image, storage)
  * fix(deps): update module golang.org/x/term to v0.10.0
  * [CI:BUILD] Packit: fix pre-sync action for downstream tasks
  * contrib/buildahimage: set config correctly for rootless build user
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4
  * Bump to v1.32.0-dev
  * Update debian install instructions
  * pkg/overlay: add limited support for FreeBSD</changelog>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
  <changelog author="dcermak@suse.com" date="1727870400">- Add patches for CVE-2024-9407 and CVE-2024-9341:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch (bsc#1231208
    aka CVE-2024-9407)
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch (bsc#1231230
    aka CVE-2024-9341)</changelog>
  <changelog author="danish.prakash@suse.com" date="1728993600">- Add patch for CVE-2024-9675 (bsc#1231499):
  * 0003-Properly-validate-cache-IDs-and-sources.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch</changelog>
</package>
<package pkgid="78da65535677193c8bfaa5413a3563a6a80e5fc37804500979e4e229d18e786a" name="buildah" arch="ppc64le">
  <version epoch="0" ver="1.35.4" rel="150500.3.16.1"/>
  <changelog author="danish.prakash@suse.com" date="1695816000">- Update to version 1.32.0:
  * Tag v1.32.0
  * GetTmpDir is not using ImageCopyTmpdir correctly
  * Run codespell on code
  * Bump vendor containers/(common, storage, image)
  * Cirrus: Remove multi-arch buildah image builds
  * fix(deps): update module github.com/containerd/containerd to v1.7.6
  * Split GetTempDir from internal/util
  * Move most of internal/parse to internal/volumes
  * copier: remove libimage dependency via util package
  * Add some docs for `build --cw`, `commit --cw`, and `mkcw`
  * Add `buildah mkcw`, add `--cw` to `buildah commit` and `buildah build`
  * Make sure that pathnames picked up from the environment are absolute
  * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4
  * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible
  * Don't try to look up names when committing images
  * fix(deps): update module golang.org/x/crypto to v0.13.0
  * docs: use valid github repo
  * fix(deps): update module golang.org/x/sys to v0.12.0
  * vendor containers/common@12405381ff45
  * push: --force-compression should be true with --compression-format
  * Update module github.com/containerd/containerd to v1.7.5
  * [skip-ci] Update tim-actions/commit-message-checker-with-regex action to v0.3.2
  * docs: add reference to oci-hooks
  * Support passing of ULimits as -1 to mean max
  * GHA: Attempt to fix discussion_lock workflow
  * Fixing the owner of the storage.conf.
  * pkg/chrootuser: Ignore comments when parsing /etc/group on FreeBSD
  * Use buildah repo rather then podman repo
  * GHA: Closed issue/PR comment-lock test
  * fix(deps): update module github.com/containers/storage to v1.49.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * Replace troff code with markdown in buildah-{copy,add}.1.md
  * [CI:BUILD] rpm: spdx compatible license field
  * executor: build-arg warnings must honor global args
  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8
  * chroot: `setSeccomp` add support for `ArchPARISC(64)` and `ArchRISCV64`
  * make,cross: restore loong64
  * Clear CommonBuildOpts when loading Builder status
  * buildah/push/manifest-push: add support for --force-compression
  * vendor: bump c/common to v0.55.1-0.20230811093040-524b4d5c12f9
  * chore(deps): update dependency containers/automation_images to v20230809
  * [CI:BUILD] RPM: fix buildtags
  * fix(deps): update module github.com/opencontainers/runc to v1.1.9
  * chore(deps): update dependency ubuntu to v22
  * chore(deps): update dependency containers/automation_images to v20230807
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * Update install.md
  * Update install.md changes current Debian stable version name
  * fix(deps): update module golang.org/x/term to v0.11.0
  * fix(deps): update module golang.org/x/crypto to v0.12.0
  * tests: fix layer-label tests
  * buildah: add --layer-label for setting labels on layers
  * Cirrus: container/rootless env. var. passthrough
  * Cirrus: Remove duplicate env. var. definitions
  * fix(deps): update github.com/containers/storage digest to c3da76f
  * Add a missing .Close() call on an ImageSource
  * Create only a reference when that's all we need
  * Add a missing .Close() call on an ImageDestination
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream
  * manifest/push: add support for --add-compression
  * manifest/inspect: add support for tls-verify and authfile
  * vendor: bump c/common to v0.55.1-0.20230727095721-647ed1d4d79a
  * vendor: bump c/image to v5.26.1-0.20230726142307-8c387a14f4ac
  * fix(deps): update module github.com/containerd/containerd to v1.7.3
  * fix(deps): update module github.com/onsi/gomega to v1.27.10
  * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible
  * fix(deps): update module github.com/containers/image/v5 to v5.26.1
  * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0
  * Update vendor of containers/(storage,image,common)
  * fix(deps): update module github.com/opencontainers/runc to v1.1.8
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update module github.com/containers/common to v0.55.2
  * [CI:BUILD] Packit: downstream task script needs GOPATH
  * Vendor in containers/(common, image, storage)
  * fix(deps): update module golang.org/x/term to v0.10.0
  * [CI:BUILD] Packit: fix pre-sync action for downstream tasks
  * contrib/buildahimage: set config correctly for rootless build user
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4
  * Bump to v1.32.0-dev
  * Update debian install instructions
  * pkg/overlay: add limited support for FreeBSD</changelog>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
  <changelog author="dcermak@suse.com" date="1727870400">- Add patches for CVE-2024-9407 and CVE-2024-9341:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch (bsc#1231208
    aka CVE-2024-9407)
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch (bsc#1231230
    aka CVE-2024-9341)</changelog>
  <changelog author="danish.prakash@suse.com" date="1728993600">- Add patch for CVE-2024-9675 (bsc#1231499):
  * 0003-Properly-validate-cache-IDs-and-sources.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch</changelog>
</package>
<package pkgid="df13a603e8f289d9d15dd63e238e416779be78abcd39c6f8485956e7eb19b0d3" name="buildah" arch="s390x">
  <version epoch="0" ver="1.35.4" rel="150500.3.16.1"/>
  <changelog author="danish.prakash@suse.com" date="1695816000">- Update to version 1.32.0:
  * Tag v1.32.0
  * GetTmpDir is not using ImageCopyTmpdir correctly
  * Run codespell on code
  * Bump vendor containers/(common, storage, image)
  * Cirrus: Remove multi-arch buildah image builds
  * fix(deps): update module github.com/containerd/containerd to v1.7.6
  * Split GetTempDir from internal/util
  * Move most of internal/parse to internal/volumes
  * copier: remove libimage dependency via util package
  * Add some docs for `build --cw`, `commit --cw`, and `mkcw`
  * Add `buildah mkcw`, add `--cw` to `buildah commit` and `buildah build`
  * Make sure that pathnames picked up from the environment are absolute
  * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4
  * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible
  * Don't try to look up names when committing images
  * fix(deps): update module golang.org/x/crypto to v0.13.0
  * docs: use valid github repo
  * fix(deps): update module golang.org/x/sys to v0.12.0
  * vendor containers/common@12405381ff45
  * push: --force-compression should be true with --compression-format
  * Update module github.com/containerd/containerd to v1.7.5
  * [skip-ci] Update tim-actions/commit-message-checker-with-regex action to v0.3.2
  * docs: add reference to oci-hooks
  * Support passing of ULimits as -1 to mean max
  * GHA: Attempt to fix discussion_lock workflow
  * Fixing the owner of the storage.conf.
  * pkg/chrootuser: Ignore comments when parsing /etc/group on FreeBSD
  * Use buildah repo rather then podman repo
  * GHA: Closed issue/PR comment-lock test
  * fix(deps): update module github.com/containers/storage to v1.49.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * Replace troff code with markdown in buildah-{copy,add}.1.md
  * [CI:BUILD] rpm: spdx compatible license field
  * executor: build-arg warnings must honor global args
  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8
  * chroot: `setSeccomp` add support for `ArchPARISC(64)` and `ArchRISCV64`
  * make,cross: restore loong64
  * Clear CommonBuildOpts when loading Builder status
  * buildah/push/manifest-push: add support for --force-compression
  * vendor: bump c/common to v0.55.1-0.20230811093040-524b4d5c12f9
  * chore(deps): update dependency containers/automation_images to v20230809
  * [CI:BUILD] RPM: fix buildtags
  * fix(deps): update module github.com/opencontainers/runc to v1.1.9
  * chore(deps): update dependency ubuntu to v22
  * chore(deps): update dependency containers/automation_images to v20230807
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * Update install.md
  * Update install.md changes current Debian stable version name
  * fix(deps): update module golang.org/x/term to v0.11.0
  * fix(deps): update module golang.org/x/crypto to v0.12.0
  * tests: fix layer-label tests
  * buildah: add --layer-label for setting labels on layers
  * Cirrus: container/rootless env. var. passthrough
  * Cirrus: Remove duplicate env. var. definitions
  * fix(deps): update github.com/containers/storage digest to c3da76f
  * Add a missing .Close() call on an ImageSource
  * Create only a reference when that's all we need
  * Add a missing .Close() call on an ImageDestination
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream
  * manifest/push: add support for --add-compression
  * manifest/inspect: add support for tls-verify and authfile
  * vendor: bump c/common to v0.55.1-0.20230727095721-647ed1d4d79a
  * vendor: bump c/image to v5.26.1-0.20230726142307-8c387a14f4ac
  * fix(deps): update module github.com/containerd/containerd to v1.7.3
  * fix(deps): update module github.com/onsi/gomega to v1.27.10
  * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible
  * fix(deps): update module github.com/containers/image/v5 to v5.26.1
  * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0
  * Update vendor of containers/(storage,image,common)
  * fix(deps): update module github.com/opencontainers/runc to v1.1.8
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update module github.com/containers/common to v0.55.2
  * [CI:BUILD] Packit: downstream task script needs GOPATH
  * Vendor in containers/(common, image, storage)
  * fix(deps): update module golang.org/x/term to v0.10.0
  * [CI:BUILD] Packit: fix pre-sync action for downstream tasks
  * contrib/buildahimage: set config correctly for rootless build user
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4
  * Bump to v1.32.0-dev
  * Update debian install instructions
  * pkg/overlay: add limited support for FreeBSD</changelog>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
  <changelog author="dcermak@suse.com" date="1727870400">- Add patches for CVE-2024-9407 and CVE-2024-9341:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch (bsc#1231208
    aka CVE-2024-9407)
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch (bsc#1231230
    aka CVE-2024-9341)</changelog>
  <changelog author="danish.prakash@suse.com" date="1728993600">- Add patch for CVE-2024-9675 (bsc#1231499):
  * 0003-Properly-validate-cache-IDs-and-sources.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch</changelog>
</package>
<package pkgid="024ec5865436df8df851a5d9492bf6bbd50dfe4d2de22e811b2c8cfabac25c96" name="buildah" arch="src">
  <version epoch="0" ver="1.35.4" rel="150500.3.16.1"/>
  <changelog author="danish.prakash@suse.com" date="1695816000">- Update to version 1.32.0:
  * Tag v1.32.0
  * GetTmpDir is not using ImageCopyTmpdir correctly
  * Run codespell on code
  * Bump vendor containers/(common, storage, image)
  * Cirrus: Remove multi-arch buildah image builds
  * fix(deps): update module github.com/containerd/containerd to v1.7.6
  * Split GetTempDir from internal/util
  * Move most of internal/parse to internal/volumes
  * copier: remove libimage dependency via util package
  * Add some docs for `build --cw`, `commit --cw`, and `mkcw`
  * Add `buildah mkcw`, add `--cw` to `buildah commit` and `buildah build`
  * Make sure that pathnames picked up from the environment are absolute
  * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4
  * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible
  * Don't try to look up names when committing images
  * fix(deps): update module golang.org/x/crypto to v0.13.0
  * docs: use valid github repo
  * fix(deps): update module golang.org/x/sys to v0.12.0
  * vendor containers/common@12405381ff45
  * push: --force-compression should be true with --compression-format
  * Update module github.com/containerd/containerd to v1.7.5
  * [skip-ci] Update tim-actions/commit-message-checker-with-regex action to v0.3.2
  * docs: add reference to oci-hooks
  * Support passing of ULimits as -1 to mean max
  * GHA: Attempt to fix discussion_lock workflow
  * Fixing the owner of the storage.conf.
  * pkg/chrootuser: Ignore comments when parsing /etc/group on FreeBSD
  * Use buildah repo rather then podman repo
  * GHA: Closed issue/PR comment-lock test
  * fix(deps): update module github.com/containers/storage to v1.49.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * Replace troff code with markdown in buildah-{copy,add}.1.md
  * [CI:BUILD] rpm: spdx compatible license field
  * executor: build-arg warnings must honor global args
  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8
  * chroot: `setSeccomp` add support for `ArchPARISC(64)` and `ArchRISCV64`
  * make,cross: restore loong64
  * Clear CommonBuildOpts when loading Builder status
  * buildah/push/manifest-push: add support for --force-compression
  * vendor: bump c/common to v0.55.1-0.20230811093040-524b4d5c12f9
  * chore(deps): update dependency containers/automation_images to v20230809
  * [CI:BUILD] RPM: fix buildtags
  * fix(deps): update module github.com/opencontainers/runc to v1.1.9
  * chore(deps): update dependency ubuntu to v22
  * chore(deps): update dependency containers/automation_images to v20230807
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * Update install.md
  * Update install.md changes current Debian stable version name
  * fix(deps): update module golang.org/x/term to v0.11.0
  * fix(deps): update module golang.org/x/crypto to v0.12.0
  * tests: fix layer-label tests
  * buildah: add --layer-label for setting labels on layers
  * Cirrus: container/rootless env. var. passthrough
  * Cirrus: Remove duplicate env. var. definitions
  * fix(deps): update github.com/containers/storage digest to c3da76f
  * Add a missing .Close() call on an ImageSource
  * Create only a reference when that's all we need
  * Add a missing .Close() call on an ImageDestination
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream
  * manifest/push: add support for --add-compression
  * manifest/inspect: add support for tls-verify and authfile
  * vendor: bump c/common to v0.55.1-0.20230727095721-647ed1d4d79a
  * vendor: bump c/image to v5.26.1-0.20230726142307-8c387a14f4ac
  * fix(deps): update module github.com/containerd/containerd to v1.7.3
  * fix(deps): update module github.com/onsi/gomega to v1.27.10
  * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible
  * fix(deps): update module github.com/containers/image/v5 to v5.26.1
  * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0
  * Update vendor of containers/(storage,image,common)
  * fix(deps): update module github.com/opencontainers/runc to v1.1.8
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update module github.com/containers/common to v0.55.2
  * [CI:BUILD] Packit: downstream task script needs GOPATH
  * Vendor in containers/(common, image, storage)
  * fix(deps): update module golang.org/x/term to v0.10.0
  * [CI:BUILD] Packit: fix pre-sync action for downstream tasks
  * contrib/buildahimage: set config correctly for rootless build user
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4
  * Bump to v1.32.0-dev
  * Update debian install instructions
  * pkg/overlay: add limited support for FreeBSD</changelog>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
  <changelog author="dcermak@suse.com" date="1727870400">- Add patches for CVE-2024-9407 and CVE-2024-9341:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch (bsc#1231208
    aka CVE-2024-9407)
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch (bsc#1231230
    aka CVE-2024-9341)</changelog>
  <changelog author="danish.prakash@suse.com" date="1728993600">- Add patch for CVE-2024-9675 (bsc#1231499):
  * 0003-Properly-validate-cache-IDs-and-sources.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch</changelog>
</package>
<package pkgid="873e5486806c0bb1bec45f330c3b9274f0698135f3656e47e0d56e4ed552cb9f" name="buildah" arch="x86_64">
  <version epoch="0" ver="1.35.4" rel="150500.3.16.1"/>
  <changelog author="danish.prakash@suse.com" date="1695816000">- Update to version 1.32.0:
  * Tag v1.32.0
  * GetTmpDir is not using ImageCopyTmpdir correctly
  * Run codespell on code
  * Bump vendor containers/(common, storage, image)
  * Cirrus: Remove multi-arch buildah image builds
  * fix(deps): update module github.com/containerd/containerd to v1.7.6
  * Split GetTempDir from internal/util
  * Move most of internal/parse to internal/volumes
  * copier: remove libimage dependency via util package
  * Add some docs for `build --cw`, `commit --cw`, and `mkcw`
  * Add `buildah mkcw`, add `--cw` to `buildah commit` and `buildah build`
  * Make sure that pathnames picked up from the environment are absolute
  * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4
  * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible
  * Don't try to look up names when committing images
  * fix(deps): update module golang.org/x/crypto to v0.13.0
  * docs: use valid github repo
  * fix(deps): update module golang.org/x/sys to v0.12.0
  * vendor containers/common@12405381ff45
  * push: --force-compression should be true with --compression-format
  * Update module github.com/containerd/containerd to v1.7.5
  * [skip-ci] Update tim-actions/commit-message-checker-with-regex action to v0.3.2
  * docs: add reference to oci-hooks
  * Support passing of ULimits as -1 to mean max
  * GHA: Attempt to fix discussion_lock workflow
  * Fixing the owner of the storage.conf.
  * pkg/chrootuser: Ignore comments when parsing /etc/group on FreeBSD
  * Use buildah repo rather then podman repo
  * GHA: Closed issue/PR comment-lock test
  * fix(deps): update module github.com/containers/storage to v1.49.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * Replace troff code with markdown in buildah-{copy,add}.1.md
  * [CI:BUILD] rpm: spdx compatible license field
  * executor: build-arg warnings must honor global args
  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8
  * chroot: `setSeccomp` add support for `ArchPARISC(64)` and `ArchRISCV64`
  * make,cross: restore loong64
  * Clear CommonBuildOpts when loading Builder status
  * buildah/push/manifest-push: add support for --force-compression
  * vendor: bump c/common to v0.55.1-0.20230811093040-524b4d5c12f9
  * chore(deps): update dependency containers/automation_images to v20230809
  * [CI:BUILD] RPM: fix buildtags
  * fix(deps): update module github.com/opencontainers/runc to v1.1.9
  * chore(deps): update dependency ubuntu to v22
  * chore(deps): update dependency containers/automation_images to v20230807
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * Update install.md
  * Update install.md changes current Debian stable version name
  * fix(deps): update module golang.org/x/term to v0.11.0
  * fix(deps): update module golang.org/x/crypto to v0.12.0
  * tests: fix layer-label tests
  * buildah: add --layer-label for setting labels on layers
  * Cirrus: container/rootless env. var. passthrough
  * Cirrus: Remove duplicate env. var. definitions
  * fix(deps): update github.com/containers/storage digest to c3da76f
  * Add a missing .Close() call on an ImageSource
  * Create only a reference when that's all we need
  * Add a missing .Close() call on an ImageDestination
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream
  * manifest/push: add support for --add-compression
  * manifest/inspect: add support for tls-verify and authfile
  * vendor: bump c/common to v0.55.1-0.20230727095721-647ed1d4d79a
  * vendor: bump c/image to v5.26.1-0.20230726142307-8c387a14f4ac
  * fix(deps): update module github.com/containerd/containerd to v1.7.3
  * fix(deps): update module github.com/onsi/gomega to v1.27.10
  * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible
  * fix(deps): update module github.com/containers/image/v5 to v5.26.1
  * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0
  * Update vendor of containers/(storage,image,common)
  * fix(deps): update module github.com/opencontainers/runc to v1.1.8
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update module github.com/containers/common to v0.55.2
  * [CI:BUILD] Packit: downstream task script needs GOPATH
  * Vendor in containers/(common, image, storage)
  * fix(deps): update module golang.org/x/term to v0.10.0
  * [CI:BUILD] Packit: fix pre-sync action for downstream tasks
  * contrib/buildahimage: set config correctly for rootless build user
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4
  * Bump to v1.32.0-dev
  * Update debian install instructions
  * pkg/overlay: add limited support for FreeBSD</changelog>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
  <changelog author="dcermak@suse.com" date="1727870400">- Add patches for CVE-2024-9407 and CVE-2024-9341:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch (bsc#1231208
    aka CVE-2024-9407)
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch (bsc#1231230
    aka CVE-2024-9341)</changelog>
  <changelog author="danish.prakash@suse.com" date="1728993600">- Add patch for CVE-2024-9675 (bsc#1231499):
  * 0003-Properly-validate-cache-IDs-and-sources.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch</changelog>
</package>
<package pkgid="f6fb7dbab03b8575baa3a63ef49f3cb98375e47701db46f52ff16c063358c2c8" name="buildah" arch="aarch64">
  <version epoch="0" ver="1.35.4" rel="150500.3.19.1"/>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
  <changelog author="dcermak@suse.com" date="1727870400">- Add patches for CVE-2024-9407 and CVE-2024-9341:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch (bsc#1231208
    aka CVE-2024-9407)
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch (bsc#1231230
    aka CVE-2024-9341)</changelog>
  <changelog author="danish.prakash@suse.com" date="1728993600">- Add patch for CVE-2024-9675 (bsc#1231499):
  * 0003-Properly-validate-cache-IDs-and-sources.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1729598400">- Add patch for CVE-2024-9676 (bsc#1231698):
  * 0004-Use-securejoin.SecureJoin-when-forming-userns-paths.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch
  * 0003-Properly-validate-cache-IDs-and-sources.patch</changelog>
</package>
<package pkgid="453c2735376d6dfd2f38d61827c56da82adc4bf9814cceae190c4285652d684d" name="buildah" arch="ppc64le">
  <version epoch="0" ver="1.35.4" rel="150500.3.19.1"/>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
  <changelog author="dcermak@suse.com" date="1727870400">- Add patches for CVE-2024-9407 and CVE-2024-9341:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch (bsc#1231208
    aka CVE-2024-9407)
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch (bsc#1231230
    aka CVE-2024-9341)</changelog>
  <changelog author="danish.prakash@suse.com" date="1728993600">- Add patch for CVE-2024-9675 (bsc#1231499):
  * 0003-Properly-validate-cache-IDs-and-sources.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1729598400">- Add patch for CVE-2024-9676 (bsc#1231698):
  * 0004-Use-securejoin.SecureJoin-when-forming-userns-paths.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch
  * 0003-Properly-validate-cache-IDs-and-sources.patch</changelog>
</package>
<package pkgid="984c02f33f88eafba09a0a2117bc964a5078618fec2dd52915b70d50594ce694" name="buildah" arch="s390x">
  <version epoch="0" ver="1.35.4" rel="150500.3.19.1"/>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
  <changelog author="dcermak@suse.com" date="1727870400">- Add patches for CVE-2024-9407 and CVE-2024-9341:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch (bsc#1231208
    aka CVE-2024-9407)
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch (bsc#1231230
    aka CVE-2024-9341)</changelog>
  <changelog author="danish.prakash@suse.com" date="1728993600">- Add patch for CVE-2024-9675 (bsc#1231499):
  * 0003-Properly-validate-cache-IDs-and-sources.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1729598400">- Add patch for CVE-2024-9676 (bsc#1231698):
  * 0004-Use-securejoin.SecureJoin-when-forming-userns-paths.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch
  * 0003-Properly-validate-cache-IDs-and-sources.patch</changelog>
</package>
<package pkgid="08901f869b04a5dc64aaa927e193ca2d4481ffc3c4db82abd6ebf40580b4740f" name="buildah" arch="src">
  <version epoch="0" ver="1.35.4" rel="150500.3.19.1"/>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
  <changelog author="dcermak@suse.com" date="1727870400">- Add patches for CVE-2024-9407 and CVE-2024-9341:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch (bsc#1231208
    aka CVE-2024-9407)
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch (bsc#1231230
    aka CVE-2024-9341)</changelog>
  <changelog author="danish.prakash@suse.com" date="1728993600">- Add patch for CVE-2024-9675 (bsc#1231499):
  * 0003-Properly-validate-cache-IDs-and-sources.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1729598400">- Add patch for CVE-2024-9676 (bsc#1231698):
  * 0004-Use-securejoin.SecureJoin-when-forming-userns-paths.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch
  * 0003-Properly-validate-cache-IDs-and-sources.patch</changelog>
</package>
<package pkgid="9ed2a8321ddae80f5bb5d999b34f31ba0c8e7e1a2265598c864b572819ce4baa" name="buildah" arch="x86_64">
  <version epoch="0" ver="1.35.4" rel="150500.3.19.1"/>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
  <changelog author="dcermak@suse.com" date="1727870400">- Add patches for CVE-2024-9407 and CVE-2024-9341:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch (bsc#1231208
    aka CVE-2024-9407)
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch (bsc#1231230
    aka CVE-2024-9341)</changelog>
  <changelog author="danish.prakash@suse.com" date="1728993600">- Add patch for CVE-2024-9675 (bsc#1231499):
  * 0003-Properly-validate-cache-IDs-and-sources.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1729598400">- Add patch for CVE-2024-9676 (bsc#1231698):
  * 0004-Use-securejoin.SecureJoin-when-forming-userns-paths.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch
  * 0003-Properly-validate-cache-IDs-and-sources.patch</changelog>
</package>
<package pkgid="79407629d56cd7b19eb885d77a110b8246b14cc90a56c086a4949b77a5bbc490" name="buildah" arch="aarch64">
  <version epoch="0" ver="1.35.4" rel="150500.3.22.2"/>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
  <changelog author="dcermak@suse.com" date="1727870400">- Add patches for CVE-2024-9407 and CVE-2024-9341:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch (bsc#1231208
    aka CVE-2024-9407)
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch (bsc#1231230
    aka CVE-2024-9341)</changelog>
  <changelog author="danish.prakash@suse.com" date="1728993600">- Add patch for CVE-2024-9675 (bsc#1231499):
  * 0003-Properly-validate-cache-IDs-and-sources.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1729598400">- Add patch for CVE-2024-9676 (bsc#1231698):
  * 0004-Use-securejoin.SecureJoin-when-forming-userns-paths.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch
  * 0003-Properly-validate-cache-IDs-and-sources.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1730289600">- Add patch for bsc#1232522; default to slirp4netns on SLE instead of pasta:
  * 0005-c-common-default-to-slirp4netns-as-the-rootless-netw.patch</changelog>
</package>
<package pkgid="d9a03c79837b28f401d666b08c399f339751baed2015b507584e6fb09b0319ce" name="buildah" arch="ppc64le">
  <version epoch="0" ver="1.35.4" rel="150500.3.22.2"/>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
  <changelog author="dcermak@suse.com" date="1727870400">- Add patches for CVE-2024-9407 and CVE-2024-9341:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch (bsc#1231208
    aka CVE-2024-9407)
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch (bsc#1231230
    aka CVE-2024-9341)</changelog>
  <changelog author="danish.prakash@suse.com" date="1728993600">- Add patch for CVE-2024-9675 (bsc#1231499):
  * 0003-Properly-validate-cache-IDs-and-sources.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1729598400">- Add patch for CVE-2024-9676 (bsc#1231698):
  * 0004-Use-securejoin.SecureJoin-when-forming-userns-paths.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch
  * 0003-Properly-validate-cache-IDs-and-sources.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1730289600">- Add patch for bsc#1232522; default to slirp4netns on SLE instead of pasta:
  * 0005-c-common-default-to-slirp4netns-as-the-rootless-netw.patch</changelog>
</package>
<package pkgid="a6e97ba60317587c4029dcf0fda989dcdf09fef3af67e8b374b4ad82b06f62b7" name="buildah" arch="s390x">
  <version epoch="0" ver="1.35.4" rel="150500.3.22.2"/>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
  <changelog author="dcermak@suse.com" date="1727870400">- Add patches for CVE-2024-9407 and CVE-2024-9341:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch (bsc#1231208
    aka CVE-2024-9407)
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch (bsc#1231230
    aka CVE-2024-9341)</changelog>
  <changelog author="danish.prakash@suse.com" date="1728993600">- Add patch for CVE-2024-9675 (bsc#1231499):
  * 0003-Properly-validate-cache-IDs-and-sources.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1729598400">- Add patch for CVE-2024-9676 (bsc#1231698):
  * 0004-Use-securejoin.SecureJoin-when-forming-userns-paths.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch
  * 0003-Properly-validate-cache-IDs-and-sources.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1730289600">- Add patch for bsc#1232522; default to slirp4netns on SLE instead of pasta:
  * 0005-c-common-default-to-slirp4netns-as-the-rootless-netw.patch</changelog>
</package>
<package pkgid="e235ddfaf961aa1cfe1acc452973b64cc5f98566ab4e5174eafcaa1969194901" name="buildah" arch="src">
  <version epoch="0" ver="1.35.4" rel="150500.3.22.2"/>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
  <changelog author="dcermak@suse.com" date="1727870400">- Add patches for CVE-2024-9407 and CVE-2024-9341:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch (bsc#1231208
    aka CVE-2024-9407)
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch (bsc#1231230
    aka CVE-2024-9341)</changelog>
  <changelog author="danish.prakash@suse.com" date="1728993600">- Add patch for CVE-2024-9675 (bsc#1231499):
  * 0003-Properly-validate-cache-IDs-and-sources.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1729598400">- Add patch for CVE-2024-9676 (bsc#1231698):
  * 0004-Use-securejoin.SecureJoin-when-forming-userns-paths.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch
  * 0003-Properly-validate-cache-IDs-and-sources.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1730289600">- Add patch for bsc#1232522; default to slirp4netns on SLE instead of pasta:
  * 0005-c-common-default-to-slirp4netns-as-the-rootless-netw.patch</changelog>
</package>
<package pkgid="a780eed6a1bcbcf4ae1d2aaaf4dad10dc256219e27749155e33a0ef52406b4be" name="buildah" arch="x86_64">
  <version epoch="0" ver="1.35.4" rel="150500.3.22.2"/>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
  <changelog author="dcermak@suse.com" date="1727870400">- Add patches for CVE-2024-9407 and CVE-2024-9341:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch (bsc#1231208
    aka CVE-2024-9407)
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch (bsc#1231230
    aka CVE-2024-9341)</changelog>
  <changelog author="danish.prakash@suse.com" date="1728993600">- Add patch for CVE-2024-9675 (bsc#1231499):
  * 0003-Properly-validate-cache-IDs-and-sources.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1729598400">- Add patch for CVE-2024-9676 (bsc#1231698):
  * 0004-Use-securejoin.SecureJoin-when-forming-userns-paths.patch
- Rebase patches:
  * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch
  * 0003-Properly-validate-cache-IDs-and-sources.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1730289600">- Add patch for bsc#1232522; default to slirp4netns on SLE instead of pasta:
  * 0005-c-common-default-to-slirp4netns-as-the-rootless-netw.patch</changelog>
</package>
<package pkgid="20fe22671c5376cef3be4895fb1889e455ebfcec49e4b7228c183f178c3a2a22" name="byte-buddy" arch="noarch">
  <version epoch="0" ver="1.14.16" rel="150200.5.7.1"/>
  <changelog author="shvetz.anton@gmail.com" date="1678276800">- Initial packaging with v1.14.0
- Add patch:
  * 00-asm5.patch
    ~ asm5 does not support the Opcodes.V20 constant</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1679313600">- Update to v1.14.2
  * Changes of v1.14.2
    + Fix offset mapping for local variable array remapping in
    Advice.
    + Add possibility to specify an index for skipOn and repeatOn
    which resolves the checked value from a returned array.
  * Changes of 1.14.1
    + Add extended scope for Maven Byte Buddy plugin to include all
    non-test-dependencies.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1680436800">- Update to v1.14.3
  * Changes of v1.14.3
    + Make MethodGraph.Compiler failsafe when processing incomplete
    methods.
    + Update ASM.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1680523200">- Remove patch:
  * 00-asm5.patch - not needed due to update of objectweb-asm</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1681387200">- Update to v1.14.4
  * Changes of v1.14.4
    + Include instrumented type and auxiliary types in TypePool
    that is passed to TypeWriter.</changelog>
  <changelog author="fstrba@suse.com" date="1683288000">- Do not bootstrap using downloaded binaries, but build the
  minimal bootstrap package from sources</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1686398400">- Update to v1.14.5
  * Changes of v1.14.5
    + Avoid use of location if agent argument separator is
    contained.
    + Allow failure of member substitution if no element is
    separated.
    + Allow retry in case of parallel class injection.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1692100800">- Update to v1.14.6
  * Changes of v1.14.6
    + Add PatchMode.SUBSTITUTE and
    ResettableClassFileTransformer.Substitutable for in-order
    patching.
    + Allow for explicit specification og differential matcher when
    patching an AgentBuilder.
    + Add platform loader to locator for build plugins.
    + Correctly resolve accessors for fields with capitalized first
    letter.
    + Make jars for Android read-only as newer versions require it.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1693483200">- Update to v1.14.7
  * Changes of v1.14.7
    + Correctly read minor version from class file.
    + Catch type resolution errors when applying Plugin.Engine.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1694692800">- Update to v1.14.8
  * Changes of v1.14.8
    + Correctly read versions from class file that would use both
    bytes.
    + Fix Byte Buddy Gradle plugin for Gradle 8.3+.
    + Correct field and static method access on subtypes in
    MemberSubstitution.
    + Support APK 7.4+ versions in Byte Buddy Gradle for Android
    plugin.
- Reproducible builds: use SOURCE_DATE_EPOCH for timestamp</changelog>
  <changelog author="fstrba@suse.com" date="1695816000">- Remove dependency on findbugs
- Do not produce bootstrap package</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1697544000">- Update to v1.14.9
  * Changes of v1.14.9
    + Update ASM to version 9.6
    + Support Android plugin to support APG version 7.4</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1703073600">- Update to v1.14.10
  * Changes of v1.14.10
    + Add lazy facade to default TypePool in AgentBuilder to avoid
    parsing of types ignored by name.
    + Avoid module info classes in Android plugin.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1703160000">- Update to v1.14.11
  * Changes of v1.14.11
    + Adjusts Gradle plugin to support Gradle 8.4 without warnings.
    + Avoid blurry exception on build plugin for fail fast.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1708171200">- Update to v1.14.12
  * Changes of v1.14.12
    + Pin proxy class file version to avoid implicit changes when
    using Graal native image.
    + Add support for Java 23.
    + Add missing @MaybeNull annotation.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1711627200">- Update to v1.14.13
  * Changes of v1.14.13
    + Avoid resolving type variables when generic type processing
    is disabled.
    + Improve error message for Byte Buddy agent external attach.
    + Fix build for modular jars when using later version than Java
    8.</changelog>
  <changelog author="fstrba@suse.com" date="1713441600">- Split the whole package into sub-packages
- Added patch:
  * 0001-Avoid-bundling-asm.patch
    + Do not bundle asm, but use external artifact
  * 0002-Remove-dependencies.patch
    + Remove optional dependency on jna</changelog>
  <changelog author="fstrba@suse.com" date="1716292800">- Upgrade to v1.14.15
  * Changes of v1.14.15
    + Allow attaching from root on J9.
  * Changes of v1.14.14
    + Adjust type validation to accept additional names that are
    legal in the class file format.
    + Fix dynamic attach on Windows when a service user is active.
    + Avoid failure when using Android's strict mode.
- Removed patch:
  * 0002-Remove-dependencies.patch
    + not needed since we have jna packaged</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1716465600">- Update to v1.14.16
  * Changes of v1.14.16
    + Update ASM and introduce support for Java 23.</changelog>
</package>
<package pkgid="9eb5a8b2307fbcff380790e6af19453458c223d6ab266adfd6582d9d5fb13f61" name="byte-buddy" arch="src">
  <version epoch="0" ver="1.14.16" rel="150200.5.7.1"/>
  <changelog author="shvetz.anton@gmail.com" date="1678276800">- Initial packaging with v1.14.0
- Add patch:
  * 00-asm5.patch
    ~ asm5 does not support the Opcodes.V20 constant</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1679313600">- Update to v1.14.2
  * Changes of v1.14.2
    + Fix offset mapping for local variable array remapping in
    Advice.
    + Add possibility to specify an index for skipOn and repeatOn
    which resolves the checked value from a returned array.
  * Changes of 1.14.1
    + Add extended scope for Maven Byte Buddy plugin to include all
    non-test-dependencies.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1680436800">- Update to v1.14.3
  * Changes of v1.14.3
    + Make MethodGraph.Compiler failsafe when processing incomplete
    methods.
    + Update ASM.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1680523200">- Remove patch:
  * 00-asm5.patch - not needed due to update of objectweb-asm</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1681387200">- Update to v1.14.4
  * Changes of v1.14.4
    + Include instrumented type and auxiliary types in TypePool
    that is passed to TypeWriter.</changelog>
  <changelog author="fstrba@suse.com" date="1683288000">- Do not bootstrap using downloaded binaries, but build the
  minimal bootstrap package from sources</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1686398400">- Update to v1.14.5
  * Changes of v1.14.5
    + Avoid use of location if agent argument separator is
    contained.
    + Allow failure of member substitution if no element is
    separated.
    + Allow retry in case of parallel class injection.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1692100800">- Update to v1.14.6
  * Changes of v1.14.6
    + Add PatchMode.SUBSTITUTE and
    ResettableClassFileTransformer.Substitutable for in-order
    patching.
    + Allow for explicit specification og differential matcher when
    patching an AgentBuilder.
    + Add platform loader to locator for build plugins.
    + Correctly resolve accessors for fields with capitalized first
    letter.
    + Make jars for Android read-only as newer versions require it.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1693483200">- Update to v1.14.7
  * Changes of v1.14.7
    + Correctly read minor version from class file.
    + Catch type resolution errors when applying Plugin.Engine.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1694692800">- Update to v1.14.8
  * Changes of v1.14.8
    + Correctly read versions from class file that would use both
    bytes.
    + Fix Byte Buddy Gradle plugin for Gradle 8.3+.
    + Correct field and static method access on subtypes in
    MemberSubstitution.
    + Support APK 7.4+ versions in Byte Buddy Gradle for Android
    plugin.
- Reproducible builds: use SOURCE_DATE_EPOCH for timestamp</changelog>
  <changelog author="fstrba@suse.com" date="1695816000">- Remove dependency on findbugs
- Do not produce bootstrap package</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1697544000">- Update to v1.14.9
  * Changes of v1.14.9
    + Update ASM to version 9.6
    + Support Android plugin to support APG version 7.4</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1703073600">- Update to v1.14.10
  * Changes of v1.14.10
    + Add lazy facade to default TypePool in AgentBuilder to avoid
    parsing of types ignored by name.
    + Avoid module info classes in Android plugin.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1703160000">- Update to v1.14.11
  * Changes of v1.14.11
    + Adjusts Gradle plugin to support Gradle 8.4 without warnings.
    + Avoid blurry exception on build plugin for fail fast.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1708171200">- Update to v1.14.12
  * Changes of v1.14.12
    + Pin proxy class file version to avoid implicit changes when
    using Graal native image.
    + Add support for Java 23.
    + Add missing @MaybeNull annotation.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1711627200">- Update to v1.14.13
  * Changes of v1.14.13
    + Avoid resolving type variables when generic type processing
    is disabled.
    + Improve error message for Byte Buddy agent external attach.
    + Fix build for modular jars when using later version than Java
    8.</changelog>
  <changelog author="fstrba@suse.com" date="1713441600">- Split the whole package into sub-packages
- Added patch:
  * 0001-Avoid-bundling-asm.patch
    + Do not bundle asm, but use external artifact
  * 0002-Remove-dependencies.patch
    + Remove optional dependency on jna</changelog>
  <changelog author="fstrba@suse.com" date="1716292800">- Upgrade to v1.14.15
  * Changes of v1.14.15
    + Allow attaching from root on J9.
  * Changes of v1.14.14
    + Adjust type validation to accept additional names that are
    legal in the class file format.
    + Fix dynamic attach on Windows when a service user is active.
    + Avoid failure when using Android's strict mode.
- Removed patch:
  * 0002-Remove-dependencies.patch
    + not needed since we have jna packaged</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1716465600">- Update to v1.14.16
  * Changes of v1.14.16
    + Update ASM and introduce support for Java 23.</changelog>
</package>
<package pkgid="0fb3621efd78440cf1c03ae58e92810a0060ea3177daa54f0f67c74984a71e99" name="ca-certificates-mozilla" arch="noarch">
  <version epoch="0" ver="2.68" rel="150200.33.1"/>
  <changelog author="kukuk@suse.de" date="1521547200">-  Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="meissner@suse.com" date="1530878400">- Updated to 2.24 state of the Mozilla NSS Certificate store. (bsc#1100415)
- Removed CAs:
  * S-TRUST_Universal_Root_CA:2.16.96.86.197.75.35.64.91.100.212.237.37.218.217.214.30.30.crt
  * TC_TrustCenter_Class_3_CA_II:2.14.74.71.0.1.0.2.229.160.93.214.63.0.81.191.crt
  * TÜRKTRUST_Elektronik_Sertifika_Hizmet_Sağlayıcısı_H5:2.7.0.142.23.254.36.32.129.crt</changelog>
  <changelog author="meissner@suse.com" date="1534420800">- updated to 2.26 state of the Mozilla NSS Certificate store. (bsc#1104780)
  - removed server auth
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - remove CA
  - ComSign CA
  - added new CA
  - GlobalSign</changelog>
  <changelog author="meissner@suse.com" date="1547726400">- updated to 2.30 state of the Mozilla NSS Certificate store. (bsc#1121446)
- Removed CAs:
  - AC Raiz Certicamara S.A.
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - Visa eCommerce Root
- Added Root CAs:
  - Certigna Root CA (email and server auth)
  - GTS Root R1 (server auth)
  - GTS Root R2 (server auth)
  - GTS Root R3 (server auth)
  - GTS Root R4 (server auth)
  - OISTE WISeKey Global Root GC CA (email and server auth)
  - UCA Extended Validation Root (server auth)
  - UCA Global G2 Root (email and server auth)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1564920000">- update to 2.34 state of the Mozilla NSS Certificate store (bsc#1144169)
- Removed CAs:
  - Certinomis - Root CA
- includes added root CAs from the 2.32 version:
  - emSign ECC Root CA - C3 (email and server auth)
  - emSign ECC Root CA - G3 (email and server auth)
  - emSign Root CA - C1 (email and server auth)
  - emSign Root CA - G1 (email and server auth)
  - Hongkong Post Root CA 3 (server auth)</changelog>
  <changelog author="lnussel@suse.de" date="1573560000">- export correct p11kit trust attributes so Firefox detects built in
  certificates (boo#1154871). Courtesy of Fedora.</changelog>
  <changelog author="lnussel@suse.de" date="1576670400">- make sure p11-kit with patches is installed on SLE (boo#1154871)</changelog>
  <changelog author="meissner@suse.com" date="1579003200">- update to 2.40 state of the Mozilla NSS Certificate store (bsc#1160160)
- removed:
  - Certplus Class 2 Primary CA
  - Deutsche Telekom Root CA 2
  - CN=Swisscom Root CA 2
  - UTN-USERFirst-Client Authentication and Email
- added:
  - Entrust Root Certification Authority - G4</changelog>
  <changelog author="meissner@suse.com" date="1585224000">- also run update-ca-certificates in %posttrans</changelog>
  <changelog author="meissner@suse.com" date="1596024000">- update to 2.42 state of the Mozilla NSS Certificate store (bsc#1174673)
  Removed CAs:
  - AddTrust External CA Root
  - AddTrust Class 1 CA Root
  - LuxTrust Global Root 2
  - Staat der Nederlanden Root CA - G2
  - Symantec Class 1 Public Primary Certification Authority - G4
  - Symantec Class 2 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G3
  Added CAs:
  - certSIGN Root CA G2
  - e-Szigno Root CA 2017
  - Microsoft ECC Root Certificate Authority 2017
  - Microsoft RSA Root Certificate Authority 2017</changelog>
  <changelog author="meissner@suse.com" date="1603108800">- Updated to 2.44 state of the Mozilla NSS Certificate store (bsc#1177864)
- Removed CAs:
  - EE Certification Centre Root CA
  - Taiwan GRCA
- Added CAs:
  - Trustwave Global Certification Authority
  - Trustwave Global ECC P256 Certification Authority
  - Trustwave Global ECC P384 Certification Authority</changelog>
  <changelog author="meissner@suse.com" date="1612872000">- Updated to 2.46 state of the Mozilla NSS Certificate store (bsc#1181994)
- Added new root CAs:
  - NAVER Global Root Certification Authority
- Removed old root CA:
  - GeoTrust Global CA
  - GeoTrust Primary Certification Authority
  - GeoTrust Primary Certification Authority - G3
  - GeoTrust Universal CA
  - GeoTrust Universal CA 2
  - thawte Primary Root CA
  - thawte Primary Root CA - G2
  - thawte Primary Root CA - G3
  - VeriSign Class 3 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G5</changelog>
  <changelog author="meissner@suse.com" date="1632484800">- remove the DST_Root_CA_X3.pem trust, as it expires september 30th 2021.
  (bsc#1190858)</changelog>
  <changelog author="meissner@suse.com" date="1633176000">- updated to 2.50 state of the Mozilla NSS Certificate store (bsc#1188006)
- Added CAs:
  + HARICA Client ECC Root CA 2021
  + HARICA Client RSA Root CA 2021
  + HARICA TLS ECC Root CA 2021
  + HARICA TLS RSA Root CA 2021
  + TunTrust Root CA</changelog>
  <changelog author="meissner@suse.com" date="1651492800">- Updated to 2.54 state of Mozilla SSL root CAs (bsc#1199079)
  Added:
  - Autoridad de Certificacion Firmaprofesional CIF A62634068
  - D-TRUST BR Root CA 1 2020
  - D-TRUST EV Root CA 1 2020
  - GlobalSign ECC Root CA R4
  - GTS Root R1
  - GTS Root R2
  - GTS Root R3
  - GTS Root R4
  - HiPKI Root CA - G1
  - ISRG Root X2
  - Telia Root CA v2
  - vTrus ECC Root CA
  - vTrus Root CA
  Removed:
  - Cybertrust Global Root
  - DST Root CA X3
  - DigiNotar PKIoverheid CA Organisatie - G2
  - GlobalSign ECC Root CA R4
  - GlobalSign Root CA R2
  - GTS Root R1
  - GTS Root R2
  - GTS Root R3
  - GTS Root R4</changelog>
  <changelog author="meissner@suse.com" date="1661774400">- Updated to 2.56 state of Mozilla SSL root CAs (bsc#1202868)
  Added:
  - Certainly Root E1
  - Certainly Root R1
  - DigiCert SMIME ECC P384 Root G5
  - DigiCert SMIME RSA4096 Root G5
  - DigiCert TLS ECC P384 Root G5
  - DigiCert TLS RSA4096 Root G5
  - E-Tugra Global Root CA ECC v3
  - E-Tugra Global Root CA RSA v3
  Removed:
  - Hellenic Academic and Research Institutions RootCA 2011</changelog>
  <changelog author="meissner@suse.com" date="1671710400">- Updated to 2.60 state of Mozilla SSL root CAs (bsc#1206622)
  Removed CAs:
  - Global Chambersign Root
  - EC-ACC
  - Network Solutions Certificate Authority
  - Staat der Nederlanden EV Root CA
  - SwissSign Platinum CA - G2
  Added CAs:
  - DIGITALSIGN GLOBAL ROOT ECDSA CA
  - DIGITALSIGN GLOBAL ROOT RSA CA
  - Security Communication ECC RootCA1
  - Security Communication RootCA3
  Changed trust:
  - TrustCor certificates only trusted up to Nov 30 (bsc#1206212)
- Removed CAs (bsc#1206212) as most code does not handle "valid before nov 30 2022"
  and it is not clear how many certs were issued for SSL middleware by TrustCor:
  - TrustCor RootCert CA-1
  - TrustCor RootCert CA-2
  - TrustCor ECA-1
  Patch: remove-trustcor.patch</changelog>
  <changelog author="meissner@suse.com" date="1692014400">- Updated to 2.62 state of Mozilla SSL root CAs (bsc#1214248)
  Added:
  - Atos TrustedRoot Root CA ECC G2 2020
  - Atos TrustedRoot Root CA ECC TLS 2021
  - Atos TrustedRoot Root CA RSA G2 2020
  - Atos TrustedRoot Root CA RSA TLS 2021
  - BJCA Global Root CA1
  - BJCA Global Root CA2
  - LAWtrust Root CA2 (4096)
  - Sectigo Public Email Protection Root E46
  - Sectigo Public Email Protection Root R46
  - Sectigo Public Server Authentication Root E46
  - Sectigo Public Server Authentication Root R46
  - SSL.com Client ECC Root CA 2022
  - SSL.com Client RSA Root CA 2022
  - SSL.com TLS ECC Root CA 2022
  - SSL.com TLS RSA Root CA 2022
  Removed CAs:
  - Chambers of Commerce Root
  - E-Tugra Certification Authority
  - E-Tugra Global Root CA ECC v3
  - E-Tugra Global Root CA RSA v3
  - Hongkong Post Root CA 1</changelog>
  <changelog author="meissner@suse.com" date="1708948800">- Updated to 2.66 state of Mozilla SSL root CAs (bsc#1220356)
  Added:
  - CommScope Public Trust ECC Root-01
  - CommScope Public Trust ECC Root-02
  - CommScope Public Trust RSA Root-01
  - CommScope Public Trust RSA Root-02
  - D-Trust SBR Root CA 1 2022
  - D-Trust SBR Root CA 2 2022
  - Telekom Security SMIME ECC Root 2021
  - Telekom Security SMIME RSA Root 2023
  - Telekom Security TLS ECC Root 2020
  - Telekom Security TLS RSA Root 2023
  - TrustAsia Global Root CA G3
  - TrustAsia Global Root CA G4
  Removed:
  - Autoridad de Certificacion Firmaprofesional CIF A62634068
  - Chambers of Commerce Root - 2008
  - Global Chambersign Root - 2008
  - Security Communication Root CA
  - Symantec Class 1 Public Primary Certification Authority - G6
  - Symantec Class 2 Public Primary Certification Authority - G6
  - TrustCor ECA-1
  - TrustCor RootCert CA-1
  - TrustCor RootCert CA-2
  - VeriSign Class 1 Public Primary Certification Authority - G3
  - VeriSign Class 2 Public Primary Certification Authority - G3
- remove-trustcor.patch: removed, now upstream
- do a versioned obsoletes of "openssl-certs".</changelog>
  <changelog author="meissner@suse.com" date="1720440000">- Updated to 2.68 state of Mozilla SSL root CAs (bsc#1227525)
  - Added: FIRMAPROFESIONAL CA ROOT-A WEB
  - Distrust: GLOBALTRUST 2020</changelog>
</package>
<package pkgid="8a132b673f0e7590cb1fe65521f13822c9ccefc8ef3b0b9878f67280670d21af" name="ca-certificates-mozilla" arch="src">
  <version epoch="0" ver="2.68" rel="150200.33.1"/>
  <changelog author="kukuk@suse.de" date="1521547200">-  Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="meissner@suse.com" date="1530878400">- Updated to 2.24 state of the Mozilla NSS Certificate store. (bsc#1100415)
- Removed CAs:
  * S-TRUST_Universal_Root_CA:2.16.96.86.197.75.35.64.91.100.212.237.37.218.217.214.30.30.crt
  * TC_TrustCenter_Class_3_CA_II:2.14.74.71.0.1.0.2.229.160.93.214.63.0.81.191.crt
  * TÜRKTRUST_Elektronik_Sertifika_Hizmet_Sağlayıcısı_H5:2.7.0.142.23.254.36.32.129.crt</changelog>
  <changelog author="meissner@suse.com" date="1534420800">- updated to 2.26 state of the Mozilla NSS Certificate store. (bsc#1104780)
  - removed server auth
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - remove CA
  - ComSign CA
  - added new CA
  - GlobalSign</changelog>
  <changelog author="meissner@suse.com" date="1547726400">- updated to 2.30 state of the Mozilla NSS Certificate store. (bsc#1121446)
- Removed CAs:
  - AC Raiz Certicamara S.A.
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - Visa eCommerce Root
- Added Root CAs:
  - Certigna Root CA (email and server auth)
  - GTS Root R1 (server auth)
  - GTS Root R2 (server auth)
  - GTS Root R3 (server auth)
  - GTS Root R4 (server auth)
  - OISTE WISeKey Global Root GC CA (email and server auth)
  - UCA Extended Validation Root (server auth)
  - UCA Global G2 Root (email and server auth)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1564920000">- update to 2.34 state of the Mozilla NSS Certificate store (bsc#1144169)
- Removed CAs:
  - Certinomis - Root CA
- includes added root CAs from the 2.32 version:
  - emSign ECC Root CA - C3 (email and server auth)
  - emSign ECC Root CA - G3 (email and server auth)
  - emSign Root CA - C1 (email and server auth)
  - emSign Root CA - G1 (email and server auth)
  - Hongkong Post Root CA 3 (server auth)</changelog>
  <changelog author="lnussel@suse.de" date="1573560000">- export correct p11kit trust attributes so Firefox detects built in
  certificates (boo#1154871). Courtesy of Fedora.</changelog>
  <changelog author="lnussel@suse.de" date="1576670400">- make sure p11-kit with patches is installed on SLE (boo#1154871)</changelog>
  <changelog author="meissner@suse.com" date="1579003200">- update to 2.40 state of the Mozilla NSS Certificate store (bsc#1160160)
- removed:
  - Certplus Class 2 Primary CA
  - Deutsche Telekom Root CA 2
  - CN=Swisscom Root CA 2
  - UTN-USERFirst-Client Authentication and Email
- added:
  - Entrust Root Certification Authority - G4</changelog>
  <changelog author="meissner@suse.com" date="1585224000">- also run update-ca-certificates in %posttrans</changelog>
  <changelog author="meissner@suse.com" date="1596024000">- update to 2.42 state of the Mozilla NSS Certificate store (bsc#1174673)
  Removed CAs:
  - AddTrust External CA Root
  - AddTrust Class 1 CA Root
  - LuxTrust Global Root 2
  - Staat der Nederlanden Root CA - G2
  - Symantec Class 1 Public Primary Certification Authority - G4
  - Symantec Class 2 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G3
  Added CAs:
  - certSIGN Root CA G2
  - e-Szigno Root CA 2017
  - Microsoft ECC Root Certificate Authority 2017
  - Microsoft RSA Root Certificate Authority 2017</changelog>
  <changelog author="meissner@suse.com" date="1603108800">- Updated to 2.44 state of the Mozilla NSS Certificate store (bsc#1177864)
- Removed CAs:
  - EE Certification Centre Root CA
  - Taiwan GRCA
- Added CAs:
  - Trustwave Global Certification Authority
  - Trustwave Global ECC P256 Certification Authority
  - Trustwave Global ECC P384 Certification Authority</changelog>
  <changelog author="meissner@suse.com" date="1612872000">- Updated to 2.46 state of the Mozilla NSS Certificate store (bsc#1181994)
- Added new root CAs:
  - NAVER Global Root Certification Authority
- Removed old root CA:
  - GeoTrust Global CA
  - GeoTrust Primary Certification Authority
  - GeoTrust Primary Certification Authority - G3
  - GeoTrust Universal CA
  - GeoTrust Universal CA 2
  - thawte Primary Root CA
  - thawte Primary Root CA - G2
  - thawte Primary Root CA - G3
  - VeriSign Class 3 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G5</changelog>
  <changelog author="meissner@suse.com" date="1632484800">- remove the DST_Root_CA_X3.pem trust, as it expires september 30th 2021.
  (bsc#1190858)</changelog>
  <changelog author="meissner@suse.com" date="1633176000">- updated to 2.50 state of the Mozilla NSS Certificate store (bsc#1188006)
- Added CAs:
  + HARICA Client ECC Root CA 2021
  + HARICA Client RSA Root CA 2021
  + HARICA TLS ECC Root CA 2021
  + HARICA TLS RSA Root CA 2021
  + TunTrust Root CA</changelog>
  <changelog author="meissner@suse.com" date="1651492800">- Updated to 2.54 state of Mozilla SSL root CAs (bsc#1199079)
  Added:
  - Autoridad de Certificacion Firmaprofesional CIF A62634068
  - D-TRUST BR Root CA 1 2020
  - D-TRUST EV Root CA 1 2020
  - GlobalSign ECC Root CA R4
  - GTS Root R1
  - GTS Root R2
  - GTS Root R3
  - GTS Root R4
  - HiPKI Root CA - G1
  - ISRG Root X2
  - Telia Root CA v2
  - vTrus ECC Root CA
  - vTrus Root CA
  Removed:
  - Cybertrust Global Root
  - DST Root CA X3
  - DigiNotar PKIoverheid CA Organisatie - G2
  - GlobalSign ECC Root CA R4
  - GlobalSign Root CA R2
  - GTS Root R1
  - GTS Root R2
  - GTS Root R3
  - GTS Root R4</changelog>
  <changelog author="meissner@suse.com" date="1661774400">- Updated to 2.56 state of Mozilla SSL root CAs (bsc#1202868)
  Added:
  - Certainly Root E1
  - Certainly Root R1
  - DigiCert SMIME ECC P384 Root G5
  - DigiCert SMIME RSA4096 Root G5
  - DigiCert TLS ECC P384 Root G5
  - DigiCert TLS RSA4096 Root G5
  - E-Tugra Global Root CA ECC v3
  - E-Tugra Global Root CA RSA v3
  Removed:
  - Hellenic Academic and Research Institutions RootCA 2011</changelog>
  <changelog author="meissner@suse.com" date="1671710400">- Updated to 2.60 state of Mozilla SSL root CAs (bsc#1206622)
  Removed CAs:
  - Global Chambersign Root
  - EC-ACC
  - Network Solutions Certificate Authority
  - Staat der Nederlanden EV Root CA
  - SwissSign Platinum CA - G2
  Added CAs:
  - DIGITALSIGN GLOBAL ROOT ECDSA CA
  - DIGITALSIGN GLOBAL ROOT RSA CA
  - Security Communication ECC RootCA1
  - Security Communication RootCA3
  Changed trust:
  - TrustCor certificates only trusted up to Nov 30 (bsc#1206212)
- Removed CAs (bsc#1206212) as most code does not handle "valid before nov 30 2022"
  and it is not clear how many certs were issued for SSL middleware by TrustCor:
  - TrustCor RootCert CA-1
  - TrustCor RootCert CA-2
  - TrustCor ECA-1
  Patch: remove-trustcor.patch</changelog>
  <changelog author="meissner@suse.com" date="1692014400">- Updated to 2.62 state of Mozilla SSL root CAs (bsc#1214248)
  Added:
  - Atos TrustedRoot Root CA ECC G2 2020
  - Atos TrustedRoot Root CA ECC TLS 2021
  - Atos TrustedRoot Root CA RSA G2 2020
  - Atos TrustedRoot Root CA RSA TLS 2021
  - BJCA Global Root CA1
  - BJCA Global Root CA2
  - LAWtrust Root CA2 (4096)
  - Sectigo Public Email Protection Root E46
  - Sectigo Public Email Protection Root R46
  - Sectigo Public Server Authentication Root E46
  - Sectigo Public Server Authentication Root R46
  - SSL.com Client ECC Root CA 2022
  - SSL.com Client RSA Root CA 2022
  - SSL.com TLS ECC Root CA 2022
  - SSL.com TLS RSA Root CA 2022
  Removed CAs:
  - Chambers of Commerce Root
  - E-Tugra Certification Authority
  - E-Tugra Global Root CA ECC v3
  - E-Tugra Global Root CA RSA v3
  - Hongkong Post Root CA 1</changelog>
  <changelog author="meissner@suse.com" date="1708948800">- Updated to 2.66 state of Mozilla SSL root CAs (bsc#1220356)
  Added:
  - CommScope Public Trust ECC Root-01
  - CommScope Public Trust ECC Root-02
  - CommScope Public Trust RSA Root-01
  - CommScope Public Trust RSA Root-02
  - D-Trust SBR Root CA 1 2022
  - D-Trust SBR Root CA 2 2022
  - Telekom Security SMIME ECC Root 2021
  - Telekom Security SMIME RSA Root 2023
  - Telekom Security TLS ECC Root 2020
  - Telekom Security TLS RSA Root 2023
  - TrustAsia Global Root CA G3
  - TrustAsia Global Root CA G4
  Removed:
  - Autoridad de Certificacion Firmaprofesional CIF A62634068
  - Chambers of Commerce Root - 2008
  - Global Chambersign Root - 2008
  - Security Communication Root CA
  - Symantec Class 1 Public Primary Certification Authority - G6
  - Symantec Class 2 Public Primary Certification Authority - G6
  - TrustCor ECA-1
  - TrustCor RootCert CA-1
  - TrustCor RootCert CA-2
  - VeriSign Class 1 Public Primary Certification Authority - G3
  - VeriSign Class 2 Public Primary Certification Authority - G3
- remove-trustcor.patch: removed, now upstream
- do a versioned obsoletes of "openssl-certs".</changelog>
  <changelog author="meissner@suse.com" date="1720440000">- Updated to 2.68 state of Mozilla SSL root CAs (bsc#1227525)
  - Added: FIRMAPROFESIONAL CA ROOT-A WEB
  - Distrust: GLOBALTRUST 2020</changelog>
</package>
<package pkgid="ce3720749be8068c55eb1943cafd08362d975cad54060a5d610f5f29cbce2e75" name="ca-certificates-mozilla-prebuilt" arch="noarch">
  <version epoch="0" ver="2.68" rel="150200.33.1"/>
  <changelog author="lnussel@suse.de" date="1633348800">- new package for minimal base containers (jsc#SLE-22162)</changelog>
</package>
<package pkgid="17dbcfa7b246afad6d8fe5514c41998d3df30dbe3fbcfa6088822e40e5db6cb2" name="ca-certificates-mozilla-prebuilt" arch="src">
  <version epoch="0" ver="2.68" rel="150200.33.1"/>
  <changelog author="lnussel@suse.de" date="1633348800">- new package for minimal base containers (jsc#SLE-22162)</changelog>
</package>
<package pkgid="f8b513e54e4436f50e79eefd7aacf5e4be476049ca857aff811e5485ad8088e8" name="cargo" arch="aarch64">
  <version epoch="0" ver="1.78.0" rel="150500.27.12.1"/>
  <changelog author="william.brown@suse.com" date="1653048000">- Update to version 1.61.0 - for details see the rust1.61 package</changelog>
  <changelog author="william.brown@suse.com" date="1656936000">- Update to version 1.62.0 - for details see the rust1.62 package</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
</package>
<package pkgid="7bb204c9964d0932be24d1c0b734023e403ed22dce4a3396e73a5c2f721d9638" name="cargo" arch="ppc64le">
  <version epoch="0" ver="1.78.0" rel="150500.27.12.1"/>
  <changelog author="william.brown@suse.com" date="1653048000">- Update to version 1.61.0 - for details see the rust1.61 package</changelog>
  <changelog author="william.brown@suse.com" date="1656936000">- Update to version 1.62.0 - for details see the rust1.62 package</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
</package>
<package pkgid="bf71a7ba837ae745728821957915cbde45ae7c3ef410da4e27e9e17d976c0c52" name="cargo" arch="s390x">
  <version epoch="0" ver="1.78.0" rel="150500.27.12.1"/>
  <changelog author="william.brown@suse.com" date="1653048000">- Update to version 1.61.0 - for details see the rust1.61 package</changelog>
  <changelog author="william.brown@suse.com" date="1656936000">- Update to version 1.62.0 - for details see the rust1.62 package</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
</package>
<package pkgid="9bc1ed8d92dde938c344cae9101eda90f4c7ed7b6874b6237287c96ed3f27234" name="cargo" arch="x86_64">
  <version epoch="0" ver="1.78.0" rel="150500.27.12.1"/>
  <changelog author="william.brown@suse.com" date="1653048000">- Update to version 1.61.0 - for details see the rust1.61 package</changelog>
  <changelog author="william.brown@suse.com" date="1656936000">- Update to version 1.62.0 - for details see the rust1.62 package</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
</package>
<package pkgid="ed457baf46e3c3cb05cef2075c290f544b5b752f5f9ad14f2ba8314714b014e3" name="cargo" arch="aarch64">
  <version epoch="0" ver="1.79.0" rel="150500.27.15.1"/>
  <changelog author="william.brown@suse.com" date="1656936000">- Update to version 1.62.0 - for details see the rust1.62 package</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
</package>
<package pkgid="bab8b7c5d7bf93459d87b27826ba2d39d56ca665e8b4fb0808b32c4bce62fe74" name="cargo" arch="ppc64le">
  <version epoch="0" ver="1.79.0" rel="150500.27.15.1"/>
  <changelog author="william.brown@suse.com" date="1656936000">- Update to version 1.62.0 - for details see the rust1.62 package</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
</package>
<package pkgid="75e318859e4ef1f27d12f882209c6b8462068092b08a797fef945f529e7afa4a" name="cargo" arch="s390x">
  <version epoch="0" ver="1.79.0" rel="150500.27.15.1"/>
  <changelog author="william.brown@suse.com" date="1656936000">- Update to version 1.62.0 - for details see the rust1.62 package</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
</package>
<package pkgid="e8e36573b3c65b5705a351c234a0c8ddd3e3c86955f34c6a074a62b596276e19" name="cargo" arch="x86_64">
  <version epoch="0" ver="1.79.0" rel="150500.27.15.1"/>
  <changelog author="william.brown@suse.com" date="1656936000">- Update to version 1.62.0 - for details see the rust1.62 package</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
</package>
<package pkgid="1e5177d6731b6e3cc7c19f29b6f069cd8cc837787e95efd92deeede69fcfef3c" name="cargo" arch="aarch64">
  <version epoch="0" ver="1.80.0" rel="150500.27.18.1"/>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
  <changelog author="william.brown@suse.com" date="1721995200">- Update to version 1.80.0 - for details see the rust1.80 package</changelog>
</package>
<package pkgid="489a4bba1179c177826108f44b29905733be01ea6aad268ce5a7d27f32721c38" name="cargo" arch="ppc64le">
  <version epoch="0" ver="1.80.0" rel="150500.27.18.1"/>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
  <changelog author="william.brown@suse.com" date="1721995200">- Update to version 1.80.0 - for details see the rust1.80 package</changelog>
</package>
<package pkgid="ed0975bb8228d08ae76750deae58f7bc14b8b2f94169a6a9f51dba58fc78db56" name="cargo" arch="s390x">
  <version epoch="0" ver="1.80.0" rel="150500.27.18.1"/>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
  <changelog author="william.brown@suse.com" date="1721995200">- Update to version 1.80.0 - for details see the rust1.80 package</changelog>
</package>
<package pkgid="8c6ffd62932df989c4ea421d799f7a4b71c8856d0faa88d320fdd7e6a213d39d" name="cargo" arch="x86_64">
  <version epoch="0" ver="1.80.0" rel="150500.27.18.1"/>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
  <changelog author="william.brown@suse.com" date="1721995200">- Update to version 1.80.0 - for details see the rust1.80 package</changelog>
</package>
<package pkgid="f205d406f4b5229de6c7fc4ce0ef7d146d971835b9b67f03ad01e8c49ef47fc4" name="cargo" arch="aarch64">
  <version epoch="0" ver="1.81.0" rel="150500.27.21.1"/>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
  <changelog author="william.brown@suse.com" date="1721995200">- Update to version 1.80.0 - for details see the rust1.80 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1725883200">- Update to version 1.81.0 - for details see the rust1.81 package</changelog>
</package>
<package pkgid="d1174e014a655e38496a29a8854cec3c309b6500e358ee004c9bc0f5b63d0763" name="cargo" arch="ppc64le">
  <version epoch="0" ver="1.81.0" rel="150500.27.21.1"/>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
  <changelog author="william.brown@suse.com" date="1721995200">- Update to version 1.80.0 - for details see the rust1.80 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1725883200">- Update to version 1.81.0 - for details see the rust1.81 package</changelog>
</package>
<package pkgid="9bb2cb061368ab89323c439e707d4db4914bc8268b07767f75d411a861165ca1" name="cargo" arch="s390x">
  <version epoch="0" ver="1.81.0" rel="150500.27.21.1"/>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
  <changelog author="william.brown@suse.com" date="1721995200">- Update to version 1.80.0 - for details see the rust1.80 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1725883200">- Update to version 1.81.0 - for details see the rust1.81 package</changelog>
</package>
<package pkgid="013e5191b9c5c6b0a515ddc6c2b2f3a34e783d0742169be878f6c1666a5de577" name="cargo" arch="x86_64">
  <version epoch="0" ver="1.81.0" rel="150500.27.21.1"/>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
  <changelog author="william.brown@suse.com" date="1721995200">- Update to version 1.80.0 - for details see the rust1.80 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1725883200">- Update to version 1.81.0 - for details see the rust1.81 package</changelog>
</package>
<package pkgid="d17110b74bae0a9bf9ad594113d9a5571e01a887407186dad8a9286510f8198c" name="cargo" arch="aarch64">
  <version epoch="0" ver="1.82.0" rel="150500.27.24.1"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
  <changelog author="william.brown@suse.com" date="1721995200">- Update to version 1.80.0 - for details see the rust1.80 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1725883200">- Update to version 1.81.0 - for details see the rust1.81 package</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- Update to version 1.82.0 - for details see the rust1.82 package</changelog>
</package>
<package pkgid="8440eee976b2b88b7292457680317fd76dedfe6282369dc076a13a03086c1615" name="cargo" arch="ppc64le">
  <version epoch="0" ver="1.82.0" rel="150500.27.24.1"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
  <changelog author="william.brown@suse.com" date="1721995200">- Update to version 1.80.0 - for details see the rust1.80 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1725883200">- Update to version 1.81.0 - for details see the rust1.81 package</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- Update to version 1.82.0 - for details see the rust1.82 package</changelog>
</package>
<package pkgid="6ddad80323dcbc574f550f9adb623adcc2cbeeb07f0a6dd4a3255492bcc6608b" name="cargo" arch="s390x">
  <version epoch="0" ver="1.82.0" rel="150500.27.24.1"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
  <changelog author="william.brown@suse.com" date="1721995200">- Update to version 1.80.0 - for details see the rust1.80 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1725883200">- Update to version 1.81.0 - for details see the rust1.81 package</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- Update to version 1.82.0 - for details see the rust1.82 package</changelog>
</package>
<package pkgid="012b5691590868e323f9e16caf0d7c6395947e77d5789a9def2aecf984995a05" name="cargo" arch="x86_64">
  <version epoch="0" ver="1.82.0" rel="150500.27.24.1"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
  <changelog author="william.brown@suse.com" date="1721995200">- Update to version 1.80.0 - for details see the rust1.80 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1725883200">- Update to version 1.81.0 - for details see the rust1.81 package</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- Update to version 1.82.0 - for details see the rust1.82 package</changelog>
</package>
<package pkgid="9075209bf919e83254e8e005ec430db695c8e09c4922baa8b1b12bc817e0c26f" name="cargo-auditable" arch="aarch64">
  <version epoch="0" ver="0.6.4~0" rel="150500.12.3.1"/>
  <changelog author="william.brown@suse.com" date="1667476800">- Initial commit</changelog>
  <changelog author="andrea.manzini@suse.com" date="1677153600">- Update to version 0.6.0~0:
  * README and documentation improvements
  * Read the rustc path passed by Cargo; fixes #90
  * Read location of Cargo from the environment variable Cargo sets for third-party subcommands
  * Add a note on sccache version compatibility to CHANGELOG.md
  * Panic on compilation commands where we fail to parse the arguments instead of silently ignoring the error
  * Specifying the binary-scanning feature is no longer needed
  * Pass options such as --offline to `cargo metadata`
  * Pass on arguments from `cargo auditable` invocation to the rustc wrapper; prep work towards fixing #83
  * Bump rust-audit-info to 0.5.2
  * Bump auditable-serde version to 0.5.2
  * Correctly fill in the source even in dependency entries when converting to cargo-lock data format
  * Drop the roundtrip through &amp;str in semver::Version; now that semver 1.0 has shipped the versions are API-compatible and this is no longer necessary
  * Release auditable-info 0.6.1
  * Bump all the version requirements for things depending on auditable-info
  * Fix audit_info_from_slice function signature</changelog>
  <changelog author="uncomfy+openbuildservice@uncomfyhalomacro.pl" date="1709640000">- Update specfile:
  * remove cargo_config file
- Update service file:
  * replace obsoleted "disabled" mode with "manual"
- Update to version 0.6.2~0:
  * Update the lockfile
  * New releases of cargo-auditable and auditable-serde
  * Use a separate project for the custom rustc path tests. Fixes intermittent test failures due to race conditions
  * Revert "add commit hashes to git sources"
  * Fix cyclic dependency graph being encoded
  * Revert "An unsuccessful attempt to fix cycles caused by dev-dependencies"
  * An unsuccessful attempt to fix cycles caused by dev-dependencies
  * Fix typo
  * Add comment
  * Add a test for an issue with cyclic dependencies reported at https://github.com/rustsec/rustsec/issues/1043
  * Fix auditable-serde example not building
  * upgrade dependency miniz_oxide to 0.6.0
  * fix formatting errors
  * apply clippy lints for --all-features
  * improve the internal docs and comments
  * apply clippy lints
  * add missing sources for one of test fixtures
  * add commit hashes to git sources
  * Run all tests on CI
  * cargo fmt
  * Run `cargo clean` in tests to get rid of stale binaries
  * Fix date in changelog
  * Populate changelog
  * Bump auditable-info version in rust-audit-info
  * Add auditable-info changelog
  * Bump versions following cargo-lock bump
  * auditable-serde: bump `cargo-lock` to v9
  * switch to UNRELEASED
  * Update CHANGELOG.md
  * Print a better error if calling rustc fails
  * Drop unused import
  * placate Clippy
  * Don't inject audit info if --print argument is passed to rustc
  * Reflect the version change in Cargo.lock
  * Remove space from keywords
  * bump version to 0.6.1
  * Fix date in changelog
  * Update CHANGELOG.md
  * Add publish=false
  * Commit the generated manpage
  * Add the code for generating a manpage; rather rudimentary so far, but it's a starting point
  * Explain relation to supply chain attacks
  * Add keywords to the Cargo manifest
  * Revert "generate a man page for cargo auditable"
  * fix formatting
  * fix review feedback, relocate file to under OUT_DIR, don't use anyhow and also commit the lock file
  * generate a man page for cargo auditable
  * Add Clippy suppression
  * placate clippy
  * commit Cargo.lock
  * Sync to latest object file writing code from rustc
  * Fix examples in docs
  * Allow redundant field names
  * Apply clippy suggestion: match -&gt; if let
  * Check for clippy and format in CI
  * Apply clippy suggestions
  * Run CI with --locked</changelog>
  <changelog author="william.brown@suse.com" date="1716897600">- Update to version 0.6.4~0:
  * Release cargo-auditable v0.6.4
  * Correctly attribute changelog file addition in changelog
  * Add changelog for auditable-extract
  * Verify various feature combinations in CI
  * Upgrade wasmparser to remove dependencies with `unsafe`
  * Add LoongArch support
  * cargo fmt
  * Move doc headers to README.md and point rustdoc to them, so that we have nice crates.io pages
  * Expand on the note about WebAssembly parsing
  * Populate changelogs
  * Resume bragging about all dependencies being safe, now that there is a caveat below
  * drop fuzz Cargo.lock to always fuzz against latest versions
  * Bump `cargo auditable` version
  * Mention WASM support in README
  * Revert "Be super duper extra sure both MinGW and MSVC are tested on CI"
  * Be super duper extra sure both MinGW and MSVC are tested on CI
  * Add wasm32 targets to CI for more platforms
  * Don't pass --target twice in tests
  * Install WASM toolchain in CI
  * cargo fmt
  * Add WASM end-to-end test
  * cargo fmt
  * Update documentation to mention the WASM feature
  * cargo fmt
  * Plumb WASM parsing feature through the whole stack
  * Make WASM parsing an optional, non-default feature
  * Add a fuzzing harness for WASM parsing
  * Rewritten WASM parsing to avoid heap allocations
  * Initial WASM extraction support
  * Nicer assertion
  * Drop obsolete comment
  * Clarify that embedding the compiler version has shipped.
  * Fixed section name for WASM
  * Unified and more robust platform detection. Fixed wasm build process
  * Initial WASM support
  * More robust platform detection for picking the binary format
  * Fix Windows CI to run both -msvc and -gnu
  * Use the correct link.exe flag for preserving the specified symbol even if it is unused
  * Fix Windows
  * Fix tests on Rust 1.77
  * Placate clippy
  * Oopps, I meant components field
  * Also remove the dependencies field if empty
  * Use serde_json with order preservation feature to get a more compressible JSON after workarounds
  * Work around cyclonedx-bom limitations to produce minified JSON
  * Also record the dependency kind
  * cyclonedx-bom: also record PURL
  * Also write the dependency tree
  * Clear the serial number in the minimal CycloneDX variant
  * Prototype impl of auditable2cdx
  * Fill in auditable2cdx dependencies
  * Initial auditable2cdx boilerplace
  * add #![forbid(unsafe_code)]
  * Initial implementation of auditable-to-cyclonedx conversion
  * Add the necessary dependencies to auditable-cyclonedx
  * Initial dummy package for auditable-cyclonedx</changelog>
  <changelog author="william.brown@suse.com" date="1721390400">- Depend on provides of rust to allow older compiler version usage</changelog>
  <changelog author="william.brown@suse.com" date="1721390401">- Resolve build failure when backported to 15-SP3</changelog>
</package>
<package pkgid="da5d9e38ed35e2d35286b1b30b5b2c28055237d85bbdc0956f97247953590bc3" name="cargo-auditable" arch="ppc64le">
  <version epoch="0" ver="0.6.4~0" rel="150500.12.3.1"/>
  <changelog author="william.brown@suse.com" date="1667476800">- Initial commit</changelog>
  <changelog author="andrea.manzini@suse.com" date="1677153600">- Update to version 0.6.0~0:
  * README and documentation improvements
  * Read the rustc path passed by Cargo; fixes #90
  * Read location of Cargo from the environment variable Cargo sets for third-party subcommands
  * Add a note on sccache version compatibility to CHANGELOG.md
  * Panic on compilation commands where we fail to parse the arguments instead of silently ignoring the error
  * Specifying the binary-scanning feature is no longer needed
  * Pass options such as --offline to `cargo metadata`
  * Pass on arguments from `cargo auditable` invocation to the rustc wrapper; prep work towards fixing #83
  * Bump rust-audit-info to 0.5.2
  * Bump auditable-serde version to 0.5.2
  * Correctly fill in the source even in dependency entries when converting to cargo-lock data format
  * Drop the roundtrip through &amp;str in semver::Version; now that semver 1.0 has shipped the versions are API-compatible and this is no longer necessary
  * Release auditable-info 0.6.1
  * Bump all the version requirements for things depending on auditable-info
  * Fix audit_info_from_slice function signature</changelog>
  <changelog author="uncomfy+openbuildservice@uncomfyhalomacro.pl" date="1709640000">- Update specfile:
  * remove cargo_config file
- Update service file:
  * replace obsoleted "disabled" mode with "manual"
- Update to version 0.6.2~0:
  * Update the lockfile
  * New releases of cargo-auditable and auditable-serde
  * Use a separate project for the custom rustc path tests. Fixes intermittent test failures due to race conditions
  * Revert "add commit hashes to git sources"
  * Fix cyclic dependency graph being encoded
  * Revert "An unsuccessful attempt to fix cycles caused by dev-dependencies"
  * An unsuccessful attempt to fix cycles caused by dev-dependencies
  * Fix typo
  * Add comment
  * Add a test for an issue with cyclic dependencies reported at https://github.com/rustsec/rustsec/issues/1043
  * Fix auditable-serde example not building
  * upgrade dependency miniz_oxide to 0.6.0
  * fix formatting errors
  * apply clippy lints for --all-features
  * improve the internal docs and comments
  * apply clippy lints
  * add missing sources for one of test fixtures
  * add commit hashes to git sources
  * Run all tests on CI
  * cargo fmt
  * Run `cargo clean` in tests to get rid of stale binaries
  * Fix date in changelog
  * Populate changelog
  * Bump auditable-info version in rust-audit-info
  * Add auditable-info changelog
  * Bump versions following cargo-lock bump
  * auditable-serde: bump `cargo-lock` to v9
  * switch to UNRELEASED
  * Update CHANGELOG.md
  * Print a better error if calling rustc fails
  * Drop unused import
  * placate Clippy
  * Don't inject audit info if --print argument is passed to rustc
  * Reflect the version change in Cargo.lock
  * Remove space from keywords
  * bump version to 0.6.1
  * Fix date in changelog
  * Update CHANGELOG.md
  * Add publish=false
  * Commit the generated manpage
  * Add the code for generating a manpage; rather rudimentary so far, but it's a starting point
  * Explain relation to supply chain attacks
  * Add keywords to the Cargo manifest
  * Revert "generate a man page for cargo auditable"
  * fix formatting
  * fix review feedback, relocate file to under OUT_DIR, don't use anyhow and also commit the lock file
  * generate a man page for cargo auditable
  * Add Clippy suppression
  * placate clippy
  * commit Cargo.lock
  * Sync to latest object file writing code from rustc
  * Fix examples in docs
  * Allow redundant field names
  * Apply clippy suggestion: match -&gt; if let
  * Check for clippy and format in CI
  * Apply clippy suggestions
  * Run CI with --locked</changelog>
  <changelog author="william.brown@suse.com" date="1716897600">- Update to version 0.6.4~0:
  * Release cargo-auditable v0.6.4
  * Correctly attribute changelog file addition in changelog
  * Add changelog for auditable-extract
  * Verify various feature combinations in CI
  * Upgrade wasmparser to remove dependencies with `unsafe`
  * Add LoongArch support
  * cargo fmt
  * Move doc headers to README.md and point rustdoc to them, so that we have nice crates.io pages
  * Expand on the note about WebAssembly parsing
  * Populate changelogs
  * Resume bragging about all dependencies being safe, now that there is a caveat below
  * drop fuzz Cargo.lock to always fuzz against latest versions
  * Bump `cargo auditable` version
  * Mention WASM support in README
  * Revert "Be super duper extra sure both MinGW and MSVC are tested on CI"
  * Be super duper extra sure both MinGW and MSVC are tested on CI
  * Add wasm32 targets to CI for more platforms
  * Don't pass --target twice in tests
  * Install WASM toolchain in CI
  * cargo fmt
  * Add WASM end-to-end test
  * cargo fmt
  * Update documentation to mention the WASM feature
  * cargo fmt
  * Plumb WASM parsing feature through the whole stack
  * Make WASM parsing an optional, non-default feature
  * Add a fuzzing harness for WASM parsing
  * Rewritten WASM parsing to avoid heap allocations
  * Initial WASM extraction support
  * Nicer assertion
  * Drop obsolete comment
  * Clarify that embedding the compiler version has shipped.
  * Fixed section name for WASM
  * Unified and more robust platform detection. Fixed wasm build process
  * Initial WASM support
  * More robust platform detection for picking the binary format
  * Fix Windows CI to run both -msvc and -gnu
  * Use the correct link.exe flag for preserving the specified symbol even if it is unused
  * Fix Windows
  * Fix tests on Rust 1.77
  * Placate clippy
  * Oopps, I meant components field
  * Also remove the dependencies field if empty
  * Use serde_json with order preservation feature to get a more compressible JSON after workarounds
  * Work around cyclonedx-bom limitations to produce minified JSON
  * Also record the dependency kind
  * cyclonedx-bom: also record PURL
  * Also write the dependency tree
  * Clear the serial number in the minimal CycloneDX variant
  * Prototype impl of auditable2cdx
  * Fill in auditable2cdx dependencies
  * Initial auditable2cdx boilerplace
  * add #![forbid(unsafe_code)]
  * Initial implementation of auditable-to-cyclonedx conversion
  * Add the necessary dependencies to auditable-cyclonedx
  * Initial dummy package for auditable-cyclonedx</changelog>
  <changelog author="william.brown@suse.com" date="1721390400">- Depend on provides of rust to allow older compiler version usage</changelog>
  <changelog author="william.brown@suse.com" date="1721390401">- Resolve build failure when backported to 15-SP3</changelog>
</package>
<package pkgid="e2241ad7dd50bf6ac65e1b0db22ec554177c692033a7e1bbcc478ee7a20e87c2" name="cargo-auditable" arch="s390x">
  <version epoch="0" ver="0.6.4~0" rel="150500.12.3.1"/>
  <changelog author="william.brown@suse.com" date="1667476800">- Initial commit</changelog>
  <changelog author="andrea.manzini@suse.com" date="1677153600">- Update to version 0.6.0~0:
  * README and documentation improvements
  * Read the rustc path passed by Cargo; fixes #90
  * Read location of Cargo from the environment variable Cargo sets for third-party subcommands
  * Add a note on sccache version compatibility to CHANGELOG.md
  * Panic on compilation commands where we fail to parse the arguments instead of silently ignoring the error
  * Specifying the binary-scanning feature is no longer needed
  * Pass options such as --offline to `cargo metadata`
  * Pass on arguments from `cargo auditable` invocation to the rustc wrapper; prep work towards fixing #83
  * Bump rust-audit-info to 0.5.2
  * Bump auditable-serde version to 0.5.2
  * Correctly fill in the source even in dependency entries when converting to cargo-lock data format
  * Drop the roundtrip through &amp;str in semver::Version; now that semver 1.0 has shipped the versions are API-compatible and this is no longer necessary
  * Release auditable-info 0.6.1
  * Bump all the version requirements for things depending on auditable-info
  * Fix audit_info_from_slice function signature</changelog>
  <changelog author="uncomfy+openbuildservice@uncomfyhalomacro.pl" date="1709640000">- Update specfile:
  * remove cargo_config file
- Update service file:
  * replace obsoleted "disabled" mode with "manual"
- Update to version 0.6.2~0:
  * Update the lockfile
  * New releases of cargo-auditable and auditable-serde
  * Use a separate project for the custom rustc path tests. Fixes intermittent test failures due to race conditions
  * Revert "add commit hashes to git sources"
  * Fix cyclic dependency graph being encoded
  * Revert "An unsuccessful attempt to fix cycles caused by dev-dependencies"
  * An unsuccessful attempt to fix cycles caused by dev-dependencies
  * Fix typo
  * Add comment
  * Add a test for an issue with cyclic dependencies reported at https://github.com/rustsec/rustsec/issues/1043
  * Fix auditable-serde example not building
  * upgrade dependency miniz_oxide to 0.6.0
  * fix formatting errors
  * apply clippy lints for --all-features
  * improve the internal docs and comments
  * apply clippy lints
  * add missing sources for one of test fixtures
  * add commit hashes to git sources
  * Run all tests on CI
  * cargo fmt
  * Run `cargo clean` in tests to get rid of stale binaries
  * Fix date in changelog
  * Populate changelog
  * Bump auditable-info version in rust-audit-info
  * Add auditable-info changelog
  * Bump versions following cargo-lock bump
  * auditable-serde: bump `cargo-lock` to v9
  * switch to UNRELEASED
  * Update CHANGELOG.md
  * Print a better error if calling rustc fails
  * Drop unused import
  * placate Clippy
  * Don't inject audit info if --print argument is passed to rustc
  * Reflect the version change in Cargo.lock
  * Remove space from keywords
  * bump version to 0.6.1
  * Fix date in changelog
  * Update CHANGELOG.md
  * Add publish=false
  * Commit the generated manpage
  * Add the code for generating a manpage; rather rudimentary so far, but it's a starting point
  * Explain relation to supply chain attacks
  * Add keywords to the Cargo manifest
  * Revert "generate a man page for cargo auditable"
  * fix formatting
  * fix review feedback, relocate file to under OUT_DIR, don't use anyhow and also commit the lock file
  * generate a man page for cargo auditable
  * Add Clippy suppression
  * placate clippy
  * commit Cargo.lock
  * Sync to latest object file writing code from rustc
  * Fix examples in docs
  * Allow redundant field names
  * Apply clippy suggestion: match -&gt; if let
  * Check for clippy and format in CI
  * Apply clippy suggestions
  * Run CI with --locked</changelog>
  <changelog author="william.brown@suse.com" date="1716897600">- Update to version 0.6.4~0:
  * Release cargo-auditable v0.6.4
  * Correctly attribute changelog file addition in changelog
  * Add changelog for auditable-extract
  * Verify various feature combinations in CI
  * Upgrade wasmparser to remove dependencies with `unsafe`
  * Add LoongArch support
  * cargo fmt
  * Move doc headers to README.md and point rustdoc to them, so that we have nice crates.io pages
  * Expand on the note about WebAssembly parsing
  * Populate changelogs
  * Resume bragging about all dependencies being safe, now that there is a caveat below
  * drop fuzz Cargo.lock to always fuzz against latest versions
  * Bump `cargo auditable` version
  * Mention WASM support in README
  * Revert "Be super duper extra sure both MinGW and MSVC are tested on CI"
  * Be super duper extra sure both MinGW and MSVC are tested on CI
  * Add wasm32 targets to CI for more platforms
  * Don't pass --target twice in tests
  * Install WASM toolchain in CI
  * cargo fmt
  * Add WASM end-to-end test
  * cargo fmt
  * Update documentation to mention the WASM feature
  * cargo fmt
  * Plumb WASM parsing feature through the whole stack
  * Make WASM parsing an optional, non-default feature
  * Add a fuzzing harness for WASM parsing
  * Rewritten WASM parsing to avoid heap allocations
  * Initial WASM extraction support
  * Nicer assertion
  * Drop obsolete comment
  * Clarify that embedding the compiler version has shipped.
  * Fixed section name for WASM
  * Unified and more robust platform detection. Fixed wasm build process
  * Initial WASM support
  * More robust platform detection for picking the binary format
  * Fix Windows CI to run both -msvc and -gnu
  * Use the correct link.exe flag for preserving the specified symbol even if it is unused
  * Fix Windows
  * Fix tests on Rust 1.77
  * Placate clippy
  * Oopps, I meant components field
  * Also remove the dependencies field if empty
  * Use serde_json with order preservation feature to get a more compressible JSON after workarounds
  * Work around cyclonedx-bom limitations to produce minified JSON
  * Also record the dependency kind
  * cyclonedx-bom: also record PURL
  * Also write the dependency tree
  * Clear the serial number in the minimal CycloneDX variant
  * Prototype impl of auditable2cdx
  * Fill in auditable2cdx dependencies
  * Initial auditable2cdx boilerplace
  * add #![forbid(unsafe_code)]
  * Initial implementation of auditable-to-cyclonedx conversion
  * Add the necessary dependencies to auditable-cyclonedx
  * Initial dummy package for auditable-cyclonedx</changelog>
  <changelog author="william.brown@suse.com" date="1721390400">- Depend on provides of rust to allow older compiler version usage</changelog>
  <changelog author="william.brown@suse.com" date="1721390401">- Resolve build failure when backported to 15-SP3</changelog>
</package>
<package pkgid="fcbf4bdd6d1c3f3888e9dba4bedae72513937ef15ab2e79b4f2e580dd55d539e" name="cargo-auditable" arch="src">
  <version epoch="0" ver="0.6.4~0" rel="150500.12.3.1"/>
  <changelog author="william.brown@suse.com" date="1667476800">- Initial commit</changelog>
  <changelog author="andrea.manzini@suse.com" date="1677153600">- Update to version 0.6.0~0:
  * README and documentation improvements
  * Read the rustc path passed by Cargo; fixes #90
  * Read location of Cargo from the environment variable Cargo sets for third-party subcommands
  * Add a note on sccache version compatibility to CHANGELOG.md
  * Panic on compilation commands where we fail to parse the arguments instead of silently ignoring the error
  * Specifying the binary-scanning feature is no longer needed
  * Pass options such as --offline to `cargo metadata`
  * Pass on arguments from `cargo auditable` invocation to the rustc wrapper; prep work towards fixing #83
  * Bump rust-audit-info to 0.5.2
  * Bump auditable-serde version to 0.5.2
  * Correctly fill in the source even in dependency entries when converting to cargo-lock data format
  * Drop the roundtrip through &amp;str in semver::Version; now that semver 1.0 has shipped the versions are API-compatible and this is no longer necessary
  * Release auditable-info 0.6.1
  * Bump all the version requirements for things depending on auditable-info
  * Fix audit_info_from_slice function signature</changelog>
  <changelog author="uncomfy+openbuildservice@uncomfyhalomacro.pl" date="1709640000">- Update specfile:
  * remove cargo_config file
- Update service file:
  * replace obsoleted "disabled" mode with "manual"
- Update to version 0.6.2~0:
  * Update the lockfile
  * New releases of cargo-auditable and auditable-serde
  * Use a separate project for the custom rustc path tests. Fixes intermittent test failures due to race conditions
  * Revert "add commit hashes to git sources"
  * Fix cyclic dependency graph being encoded
  * Revert "An unsuccessful attempt to fix cycles caused by dev-dependencies"
  * An unsuccessful attempt to fix cycles caused by dev-dependencies
  * Fix typo
  * Add comment
  * Add a test for an issue with cyclic dependencies reported at https://github.com/rustsec/rustsec/issues/1043
  * Fix auditable-serde example not building
  * upgrade dependency miniz_oxide to 0.6.0
  * fix formatting errors
  * apply clippy lints for --all-features
  * improve the internal docs and comments
  * apply clippy lints
  * add missing sources for one of test fixtures
  * add commit hashes to git sources
  * Run all tests on CI
  * cargo fmt
  * Run `cargo clean` in tests to get rid of stale binaries
  * Fix date in changelog
  * Populate changelog
  * Bump auditable-info version in rust-audit-info
  * Add auditable-info changelog
  * Bump versions following cargo-lock bump
  * auditable-serde: bump `cargo-lock` to v9
  * switch to UNRELEASED
  * Update CHANGELOG.md
  * Print a better error if calling rustc fails
  * Drop unused import
  * placate Clippy
  * Don't inject audit info if --print argument is passed to rustc
  * Reflect the version change in Cargo.lock
  * Remove space from keywords
  * bump version to 0.6.1
  * Fix date in changelog
  * Update CHANGELOG.md
  * Add publish=false
  * Commit the generated manpage
  * Add the code for generating a manpage; rather rudimentary so far, but it's a starting point
  * Explain relation to supply chain attacks
  * Add keywords to the Cargo manifest
  * Revert "generate a man page for cargo auditable"
  * fix formatting
  * fix review feedback, relocate file to under OUT_DIR, don't use anyhow and also commit the lock file
  * generate a man page for cargo auditable
  * Add Clippy suppression
  * placate clippy
  * commit Cargo.lock
  * Sync to latest object file writing code from rustc
  * Fix examples in docs
  * Allow redundant field names
  * Apply clippy suggestion: match -&gt; if let
  * Check for clippy and format in CI
  * Apply clippy suggestions
  * Run CI with --locked</changelog>
  <changelog author="william.brown@suse.com" date="1716897600">- Update to version 0.6.4~0:
  * Release cargo-auditable v0.6.4
  * Correctly attribute changelog file addition in changelog
  * Add changelog for auditable-extract
  * Verify various feature combinations in CI
  * Upgrade wasmparser to remove dependencies with `unsafe`
  * Add LoongArch support
  * cargo fmt
  * Move doc headers to README.md and point rustdoc to them, so that we have nice crates.io pages
  * Expand on the note about WebAssembly parsing
  * Populate changelogs
  * Resume bragging about all dependencies being safe, now that there is a caveat below
  * drop fuzz Cargo.lock to always fuzz against latest versions
  * Bump `cargo auditable` version
  * Mention WASM support in README
  * Revert "Be super duper extra sure both MinGW and MSVC are tested on CI"
  * Be super duper extra sure both MinGW and MSVC are tested on CI
  * Add wasm32 targets to CI for more platforms
  * Don't pass --target twice in tests
  * Install WASM toolchain in CI
  * cargo fmt
  * Add WASM end-to-end test
  * cargo fmt
  * Update documentation to mention the WASM feature
  * cargo fmt
  * Plumb WASM parsing feature through the whole stack
  * Make WASM parsing an optional, non-default feature
  * Add a fuzzing harness for WASM parsing
  * Rewritten WASM parsing to avoid heap allocations
  * Initial WASM extraction support
  * Nicer assertion
  * Drop obsolete comment
  * Clarify that embedding the compiler version has shipped.
  * Fixed section name for WASM
  * Unified and more robust platform detection. Fixed wasm build process
  * Initial WASM support
  * More robust platform detection for picking the binary format
  * Fix Windows CI to run both -msvc and -gnu
  * Use the correct link.exe flag for preserving the specified symbol even if it is unused
  * Fix Windows
  * Fix tests on Rust 1.77
  * Placate clippy
  * Oopps, I meant components field
  * Also remove the dependencies field if empty
  * Use serde_json with order preservation feature to get a more compressible JSON after workarounds
  * Work around cyclonedx-bom limitations to produce minified JSON
  * Also record the dependency kind
  * cyclonedx-bom: also record PURL
  * Also write the dependency tree
  * Clear the serial number in the minimal CycloneDX variant
  * Prototype impl of auditable2cdx
  * Fill in auditable2cdx dependencies
  * Initial auditable2cdx boilerplace
  * add #![forbid(unsafe_code)]
  * Initial implementation of auditable-to-cyclonedx conversion
  * Add the necessary dependencies to auditable-cyclonedx
  * Initial dummy package for auditable-cyclonedx</changelog>
  <changelog author="william.brown@suse.com" date="1721390400">- Depend on provides of rust to allow older compiler version usage</changelog>
  <changelog author="william.brown@suse.com" date="1721390401">- Resolve build failure when backported to 15-SP3</changelog>
</package>
<package pkgid="1cc7ee0568260f4148fcd2d57461d439c09e34dc8068f07cdc5806af0df6c913" name="cargo-auditable" arch="x86_64">
  <version epoch="0" ver="0.6.4~0" rel="150500.12.3.1"/>
  <changelog author="william.brown@suse.com" date="1667476800">- Initial commit</changelog>
  <changelog author="andrea.manzini@suse.com" date="1677153600">- Update to version 0.6.0~0:
  * README and documentation improvements
  * Read the rustc path passed by Cargo; fixes #90
  * Read location of Cargo from the environment variable Cargo sets for third-party subcommands
  * Add a note on sccache version compatibility to CHANGELOG.md
  * Panic on compilation commands where we fail to parse the arguments instead of silently ignoring the error
  * Specifying the binary-scanning feature is no longer needed
  * Pass options such as --offline to `cargo metadata`
  * Pass on arguments from `cargo auditable` invocation to the rustc wrapper; prep work towards fixing #83
  * Bump rust-audit-info to 0.5.2
  * Bump auditable-serde version to 0.5.2
  * Correctly fill in the source even in dependency entries when converting to cargo-lock data format
  * Drop the roundtrip through &amp;str in semver::Version; now that semver 1.0 has shipped the versions are API-compatible and this is no longer necessary
  * Release auditable-info 0.6.1
  * Bump all the version requirements for things depending on auditable-info
  * Fix audit_info_from_slice function signature</changelog>
  <changelog author="uncomfy+openbuildservice@uncomfyhalomacro.pl" date="1709640000">- Update specfile:
  * remove cargo_config file
- Update service file:
  * replace obsoleted "disabled" mode with "manual"
- Update to version 0.6.2~0:
  * Update the lockfile
  * New releases of cargo-auditable and auditable-serde
  * Use a separate project for the custom rustc path tests. Fixes intermittent test failures due to race conditions
  * Revert "add commit hashes to git sources"
  * Fix cyclic dependency graph being encoded
  * Revert "An unsuccessful attempt to fix cycles caused by dev-dependencies"
  * An unsuccessful attempt to fix cycles caused by dev-dependencies
  * Fix typo
  * Add comment
  * Add a test for an issue with cyclic dependencies reported at https://github.com/rustsec/rustsec/issues/1043
  * Fix auditable-serde example not building
  * upgrade dependency miniz_oxide to 0.6.0
  * fix formatting errors
  * apply clippy lints for --all-features
  * improve the internal docs and comments
  * apply clippy lints
  * add missing sources for one of test fixtures
  * add commit hashes to git sources
  * Run all tests on CI
  * cargo fmt
  * Run `cargo clean` in tests to get rid of stale binaries
  * Fix date in changelog
  * Populate changelog
  * Bump auditable-info version in rust-audit-info
  * Add auditable-info changelog
  * Bump versions following cargo-lock bump
  * auditable-serde: bump `cargo-lock` to v9
  * switch to UNRELEASED
  * Update CHANGELOG.md
  * Print a better error if calling rustc fails
  * Drop unused import
  * placate Clippy
  * Don't inject audit info if --print argument is passed to rustc
  * Reflect the version change in Cargo.lock
  * Remove space from keywords
  * bump version to 0.6.1
  * Fix date in changelog
  * Update CHANGELOG.md
  * Add publish=false
  * Commit the generated manpage
  * Add the code for generating a manpage; rather rudimentary so far, but it's a starting point
  * Explain relation to supply chain attacks
  * Add keywords to the Cargo manifest
  * Revert "generate a man page for cargo auditable"
  * fix formatting
  * fix review feedback, relocate file to under OUT_DIR, don't use anyhow and also commit the lock file
  * generate a man page for cargo auditable
  * Add Clippy suppression
  * placate clippy
  * commit Cargo.lock
  * Sync to latest object file writing code from rustc
  * Fix examples in docs
  * Allow redundant field names
  * Apply clippy suggestion: match -&gt; if let
  * Check for clippy and format in CI
  * Apply clippy suggestions
  * Run CI with --locked</changelog>
  <changelog author="william.brown@suse.com" date="1716897600">- Update to version 0.6.4~0:
  * Release cargo-auditable v0.6.4
  * Correctly attribute changelog file addition in changelog
  * Add changelog for auditable-extract
  * Verify various feature combinations in CI
  * Upgrade wasmparser to remove dependencies with `unsafe`
  * Add LoongArch support
  * cargo fmt
  * Move doc headers to README.md and point rustdoc to them, so that we have nice crates.io pages
  * Expand on the note about WebAssembly parsing
  * Populate changelogs
  * Resume bragging about all dependencies being safe, now that there is a caveat below
  * drop fuzz Cargo.lock to always fuzz against latest versions
  * Bump `cargo auditable` version
  * Mention WASM support in README
  * Revert "Be super duper extra sure both MinGW and MSVC are tested on CI"
  * Be super duper extra sure both MinGW and MSVC are tested on CI
  * Add wasm32 targets to CI for more platforms
  * Don't pass --target twice in tests
  * Install WASM toolchain in CI
  * cargo fmt
  * Add WASM end-to-end test
  * cargo fmt
  * Update documentation to mention the WASM feature
  * cargo fmt
  * Plumb WASM parsing feature through the whole stack
  * Make WASM parsing an optional, non-default feature
  * Add a fuzzing harness for WASM parsing
  * Rewritten WASM parsing to avoid heap allocations
  * Initial WASM extraction support
  * Nicer assertion
  * Drop obsolete comment
  * Clarify that embedding the compiler version has shipped.
  * Fixed section name for WASM
  * Unified and more robust platform detection. Fixed wasm build process
  * Initial WASM support
  * More robust platform detection for picking the binary format
  * Fix Windows CI to run both -msvc and -gnu
  * Use the correct link.exe flag for preserving the specified symbol even if it is unused
  * Fix Windows
  * Fix tests on Rust 1.77
  * Placate clippy
  * Oopps, I meant components field
  * Also remove the dependencies field if empty
  * Use serde_json with order preservation feature to get a more compressible JSON after workarounds
  * Work around cyclonedx-bom limitations to produce minified JSON
  * Also record the dependency kind
  * cyclonedx-bom: also record PURL
  * Also write the dependency tree
  * Clear the serial number in the minimal CycloneDX variant
  * Prototype impl of auditable2cdx
  * Fill in auditable2cdx dependencies
  * Initial auditable2cdx boilerplace
  * add #![forbid(unsafe_code)]
  * Initial implementation of auditable-to-cyclonedx conversion
  * Add the necessary dependencies to auditable-cyclonedx
  * Initial dummy package for auditable-cyclonedx</changelog>
  <changelog author="william.brown@suse.com" date="1721390400">- Depend on provides of rust to allow older compiler version usage</changelog>
  <changelog author="william.brown@suse.com" date="1721390401">- Resolve build failure when backported to 15-SP3</changelog>
</package>
<package pkgid="50c68e5cc3916809a2bf6eda91284a490c4b2343db486aa6a9d164a4cbff104a" name="cargo-c" arch="aarch64">
  <version epoch="0" ver="0.10.3~git0.ee7d7ef" rel="150600.3.3.1"/>
  <changelog author="asn@cryptomilk.org" date="1591099200">- Update to version 0.6.5
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.5
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.4
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.3</changelog>
  <changelog author="asn@cryptomilk.org" date="1591617600">- Update to version 0.6.7
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.7
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.6</changelog>
  <changelog author="asn@cryptomilk.org" date="1594641600">- Update to version 0.6.9
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.9
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.8</changelog>
  <changelog author="asn@cryptomilk.org" date="1599652800">- Update to version 0.6.13
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.13
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.12
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.11
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.10</changelog>
  <changelog author="asn@cryptomilk.org" date="1602590400">- Added 123.patch
  * Save the include subdir to a specific field</changelog>
  <changelog author="asn@cryptomilk.org" date="1603022400">- Update to version 0.6.15
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.15
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.14
- Removed 123.patch</changelog>
  <changelog author="asn@cryptomilk.org" date="1610539200">- Update to version 0.7.0
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.7.0</changelog>
  <changelog author="alarrosa@suse.com" date="1617624000">- Update to version 0.8.0
  * cbindgen 0.18
  * provide a cli option to have fully static builds.
  * cargo cinstall and cargo capi install now imply --release
    to match the behavior of cargo install.</changelog>
  <changelog author="william.brown@suse.com" date="1617710400">- Add README.suse-maint to fix OBS warning.</changelog>
  <changelog author="william.brown@suse.com" date="1622635200">- Update to version 0.8.1~git0.cce1b08:
  * Prepare for release
  * Set the capi.library.rustflags
  * Add a simple way to set the RUSTFLAGS from Cargo.toml
  * CI: test example project in Windows/MSYS2 (#191)
  * Update cargo requirement from 0.52 to 0.53
  * Upgrade to GitHub-native Dependabot
  * Default to nightly
  * Use codecov
  * Move the code coverage in a stand-alone script
  * Enable colored help</changelog>
  <changelog author="william.brown@suse.com" date="1641470400">- resolve bsc#1194113 (CVE-2018-25023)
- resolve bsc#1194119 (CVE-2021-45710)</changelog>
  <changelog author="asn@cryptomilk.org" date="1641816000">- Update to version 0.9.6~git0.68e65ad:
  * Prepare for release
  * Bump cargo
  * Support custom paths for data files as it is available for includes
  * Fix the datadir description
  * Change the configuration paths for datadir
  * Add datadir destination path customization
  * Suppress warning about dead code for Common
  * Add datadir support
  * Make sure the right rust is used on deploy
  * Bump the edition in the examples</changelog>
  <changelog author="william.brown@suse.com" date="1646222400">- Update vendored libraries to resolve security issues.</changelog>
  <changelog author="asn@cryptomilk.org" date="1656936000">- Update to version 0.9.11~git0.41f5562:
  * Prepare for release
  * Fix clippy warnings
  * Versions bump
  * Add back the deps.rs badge
  * Increase the regex requirement
  * Prepare for release
  * Bump cargo
  * Add support for Haiku Operating System
  * Add udbserver to users
  * Extend the coverage further
  * Fix the code coverage script
  * Fix subcommand fallback support
  * Print the issued commands
  * Fix testing cross compilation
  * Bump cargo-metadata
  * Bump cbindgen
  * Support rustc-1.60 and following
  * Update to clap-3.1 and cargo-0.61
  * Prepare for release
  * Do not use the patch version in macOS -install_name
  * Add Android to the build targets supported by LibType
  * Make nightly clippy happy
  * Simplify a writln
  * Prepare for release
  * Bump cargo version
  * Remove newlines from the description
  * Make the default destdir None
  * CI: use MSYS2 cargo package for example project
  * Print the PKG_CONFIG_PATH in verbose mode</changelog>
  <changelog author="asn@cryptomilk.org" date="1672660800">- Update to version 0.9.15~git0.2d3044b:
  * Prepare for release
  * Update to cargo-0.67 and clap-4
  * macos: Allow larger install_name entries
  * Fix the new clippy lints
  * Don't include version in soname ELF header if versioning is disabled
  * Use get_many instead of values_of_lossy
  * Use macos-12 for the macos runner
  * Add job deps
  * Generate paths relative to ${prefix} in the pkg-config file even if --libdir or --includedir are given
  * Compact the main CI
  * Fix more warnings in the main CI
  * Use a custom release profile to strip binaries
  * ci(deploy): Use musl abi for aarch64 linux binary, add i686 linux
  * Remove msys2 test
  * Update the example-project CI
  * Make sure the supported rustc version is evident
  * Use the default compiler to build a static binary for musl
  * Save all the linux binaries
  * Prepare for release
  * Add pre-built ppc64le and aarch64 linux binaries
  * Simplify the deploy script
  * Fix new clippy lints
  * Update to cargo-0.66
  * Use dtolnay/rust-toolchain
  * Remove actions-rs/cargo
  * Prepare for release
  * add support for illumos
  * Bump cargo version
  * Prepare for release
  * Bump cargo to 0.64
  * Install the windows DLL in the libdir if it is custom
  * Fix typo on readme
  * Bump the codecov action
  * Add sonames on musl</changelog>
  <changelog author="dmueller@suse.com" date="1678795200">- add constraints to avoid out of disk space errors</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697544000">- Update to version 0.9.27~git0.54774e0:
  * Complete the soversion granularity
  * Bump cbindgen
  * Make sure the version variables are consistent
  * Fix sover detection for 0-based versioning
  * Bump cargo version
  * Bump cbindgen
  * Do not pass the token to clippy-check
- Switch _service to manual.</changelog>
  <changelog author="david.mulder@suse.com" date="1717502400">- Update to version 0.9.32~git0.56dfe34:
  * Prepare for release
  * Bump cargo version
  * Use clone_from/clone_into
  * Do not install the versioned links and lib on Android
  * docs: add rustls-ffi to README users list
  * Bump the msrv again
  * Bump msrv
  * Bump cargo version
  * Match the beaviour of meson regarding relative paths in the install directories
  * Bump cargo version</changelog>
  <changelog author="kilgore.trout@idesmi.eu" date="1724760000">- Update to version 0.10.3~git0.ee7d7ef:
  * Wire in the heuristics
  * Implement heuristics for target-specific install paths
  * Fix the generated header fingerprinting logic
  * Make notice about missing windows debug files verbose-only
  * Update dependencies
  * Require cargo 0.80.0
- Use macros from cargo-packaging
- Remove cargo_config: contained in vendor.tar
- Remove cargo_audit service: now part of cargo_vendor
- Remove custom rustflags and let the macros set them instead</changelog>
  <changelog author="william.brown@suse.com" date="1726833600">- bsc#1230683 - CVE-2024-45405 - gix-path improper path resolution</changelog>
</package>
<package pkgid="5ffa6f608b10bebd11d7ceacc2bc34e677e6bfb8aea9b8164bcfbbafab2bf4b0" name="cargo-c" arch="ppc64le">
  <version epoch="0" ver="0.10.3~git0.ee7d7ef" rel="150600.3.3.1"/>
  <changelog author="asn@cryptomilk.org" date="1591099200">- Update to version 0.6.5
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.5
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.4
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.3</changelog>
  <changelog author="asn@cryptomilk.org" date="1591617600">- Update to version 0.6.7
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.7
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.6</changelog>
  <changelog author="asn@cryptomilk.org" date="1594641600">- Update to version 0.6.9
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.9
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.8</changelog>
  <changelog author="asn@cryptomilk.org" date="1599652800">- Update to version 0.6.13
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.13
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.12
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.11
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.10</changelog>
  <changelog author="asn@cryptomilk.org" date="1602590400">- Added 123.patch
  * Save the include subdir to a specific field</changelog>
  <changelog author="asn@cryptomilk.org" date="1603022400">- Update to version 0.6.15
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.15
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.14
- Removed 123.patch</changelog>
  <changelog author="asn@cryptomilk.org" date="1610539200">- Update to version 0.7.0
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.7.0</changelog>
  <changelog author="alarrosa@suse.com" date="1617624000">- Update to version 0.8.0
  * cbindgen 0.18
  * provide a cli option to have fully static builds.
  * cargo cinstall and cargo capi install now imply --release
    to match the behavior of cargo install.</changelog>
  <changelog author="william.brown@suse.com" date="1617710400">- Add README.suse-maint to fix OBS warning.</changelog>
  <changelog author="william.brown@suse.com" date="1622635200">- Update to version 0.8.1~git0.cce1b08:
  * Prepare for release
  * Set the capi.library.rustflags
  * Add a simple way to set the RUSTFLAGS from Cargo.toml
  * CI: test example project in Windows/MSYS2 (#191)
  * Update cargo requirement from 0.52 to 0.53
  * Upgrade to GitHub-native Dependabot
  * Default to nightly
  * Use codecov
  * Move the code coverage in a stand-alone script
  * Enable colored help</changelog>
  <changelog author="william.brown@suse.com" date="1641470400">- resolve bsc#1194113 (CVE-2018-25023)
- resolve bsc#1194119 (CVE-2021-45710)</changelog>
  <changelog author="asn@cryptomilk.org" date="1641816000">- Update to version 0.9.6~git0.68e65ad:
  * Prepare for release
  * Bump cargo
  * Support custom paths for data files as it is available for includes
  * Fix the datadir description
  * Change the configuration paths for datadir
  * Add datadir destination path customization
  * Suppress warning about dead code for Common
  * Add datadir support
  * Make sure the right rust is used on deploy
  * Bump the edition in the examples</changelog>
  <changelog author="william.brown@suse.com" date="1646222400">- Update vendored libraries to resolve security issues.</changelog>
  <changelog author="asn@cryptomilk.org" date="1656936000">- Update to version 0.9.11~git0.41f5562:
  * Prepare for release
  * Fix clippy warnings
  * Versions bump
  * Add back the deps.rs badge
  * Increase the regex requirement
  * Prepare for release
  * Bump cargo
  * Add support for Haiku Operating System
  * Add udbserver to users
  * Extend the coverage further
  * Fix the code coverage script
  * Fix subcommand fallback support
  * Print the issued commands
  * Fix testing cross compilation
  * Bump cargo-metadata
  * Bump cbindgen
  * Support rustc-1.60 and following
  * Update to clap-3.1 and cargo-0.61
  * Prepare for release
  * Do not use the patch version in macOS -install_name
  * Add Android to the build targets supported by LibType
  * Make nightly clippy happy
  * Simplify a writln
  * Prepare for release
  * Bump cargo version
  * Remove newlines from the description
  * Make the default destdir None
  * CI: use MSYS2 cargo package for example project
  * Print the PKG_CONFIG_PATH in verbose mode</changelog>
  <changelog author="asn@cryptomilk.org" date="1672660800">- Update to version 0.9.15~git0.2d3044b:
  * Prepare for release
  * Update to cargo-0.67 and clap-4
  * macos: Allow larger install_name entries
  * Fix the new clippy lints
  * Don't include version in soname ELF header if versioning is disabled
  * Use get_many instead of values_of_lossy
  * Use macos-12 for the macos runner
  * Add job deps
  * Generate paths relative to ${prefix} in the pkg-config file even if --libdir or --includedir are given
  * Compact the main CI
  * Fix more warnings in the main CI
  * Use a custom release profile to strip binaries
  * ci(deploy): Use musl abi for aarch64 linux binary, add i686 linux
  * Remove msys2 test
  * Update the example-project CI
  * Make sure the supported rustc version is evident
  * Use the default compiler to build a static binary for musl
  * Save all the linux binaries
  * Prepare for release
  * Add pre-built ppc64le and aarch64 linux binaries
  * Simplify the deploy script
  * Fix new clippy lints
  * Update to cargo-0.66
  * Use dtolnay/rust-toolchain
  * Remove actions-rs/cargo
  * Prepare for release
  * add support for illumos
  * Bump cargo version
  * Prepare for release
  * Bump cargo to 0.64
  * Install the windows DLL in the libdir if it is custom
  * Fix typo on readme
  * Bump the codecov action
  * Add sonames on musl</changelog>
  <changelog author="dmueller@suse.com" date="1678795200">- add constraints to avoid out of disk space errors</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697544000">- Update to version 0.9.27~git0.54774e0:
  * Complete the soversion granularity
  * Bump cbindgen
  * Make sure the version variables are consistent
  * Fix sover detection for 0-based versioning
  * Bump cargo version
  * Bump cbindgen
  * Do not pass the token to clippy-check
- Switch _service to manual.</changelog>
  <changelog author="david.mulder@suse.com" date="1717502400">- Update to version 0.9.32~git0.56dfe34:
  * Prepare for release
  * Bump cargo version
  * Use clone_from/clone_into
  * Do not install the versioned links and lib on Android
  * docs: add rustls-ffi to README users list
  * Bump the msrv again
  * Bump msrv
  * Bump cargo version
  * Match the beaviour of meson regarding relative paths in the install directories
  * Bump cargo version</changelog>
  <changelog author="kilgore.trout@idesmi.eu" date="1724760000">- Update to version 0.10.3~git0.ee7d7ef:
  * Wire in the heuristics
  * Implement heuristics for target-specific install paths
  * Fix the generated header fingerprinting logic
  * Make notice about missing windows debug files verbose-only
  * Update dependencies
  * Require cargo 0.80.0
- Use macros from cargo-packaging
- Remove cargo_config: contained in vendor.tar
- Remove cargo_audit service: now part of cargo_vendor
- Remove custom rustflags and let the macros set them instead</changelog>
  <changelog author="william.brown@suse.com" date="1726833600">- bsc#1230683 - CVE-2024-45405 - gix-path improper path resolution</changelog>
</package>
<package pkgid="8f5a149dbe8bf1ffa237f443d4b996148c0d8fca6bd36237f3bf6ff4b37539b9" name="cargo-c" arch="s390x">
  <version epoch="0" ver="0.10.3~git0.ee7d7ef" rel="150600.3.3.1"/>
  <changelog author="asn@cryptomilk.org" date="1591099200">- Update to version 0.6.5
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.5
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.4
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.3</changelog>
  <changelog author="asn@cryptomilk.org" date="1591617600">- Update to version 0.6.7
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.7
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.6</changelog>
  <changelog author="asn@cryptomilk.org" date="1594641600">- Update to version 0.6.9
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.9
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.8</changelog>
  <changelog author="asn@cryptomilk.org" date="1599652800">- Update to version 0.6.13
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.13
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.12
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.11
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.10</changelog>
  <changelog author="asn@cryptomilk.org" date="1602590400">- Added 123.patch
  * Save the include subdir to a specific field</changelog>
  <changelog author="asn@cryptomilk.org" date="1603022400">- Update to version 0.6.15
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.15
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.14
- Removed 123.patch</changelog>
  <changelog author="asn@cryptomilk.org" date="1610539200">- Update to version 0.7.0
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.7.0</changelog>
  <changelog author="alarrosa@suse.com" date="1617624000">- Update to version 0.8.0
  * cbindgen 0.18
  * provide a cli option to have fully static builds.
  * cargo cinstall and cargo capi install now imply --release
    to match the behavior of cargo install.</changelog>
  <changelog author="william.brown@suse.com" date="1617710400">- Add README.suse-maint to fix OBS warning.</changelog>
  <changelog author="william.brown@suse.com" date="1622635200">- Update to version 0.8.1~git0.cce1b08:
  * Prepare for release
  * Set the capi.library.rustflags
  * Add a simple way to set the RUSTFLAGS from Cargo.toml
  * CI: test example project in Windows/MSYS2 (#191)
  * Update cargo requirement from 0.52 to 0.53
  * Upgrade to GitHub-native Dependabot
  * Default to nightly
  * Use codecov
  * Move the code coverage in a stand-alone script
  * Enable colored help</changelog>
  <changelog author="william.brown@suse.com" date="1641470400">- resolve bsc#1194113 (CVE-2018-25023)
- resolve bsc#1194119 (CVE-2021-45710)</changelog>
  <changelog author="asn@cryptomilk.org" date="1641816000">- Update to version 0.9.6~git0.68e65ad:
  * Prepare for release
  * Bump cargo
  * Support custom paths for data files as it is available for includes
  * Fix the datadir description
  * Change the configuration paths for datadir
  * Add datadir destination path customization
  * Suppress warning about dead code for Common
  * Add datadir support
  * Make sure the right rust is used on deploy
  * Bump the edition in the examples</changelog>
  <changelog author="william.brown@suse.com" date="1646222400">- Update vendored libraries to resolve security issues.</changelog>
  <changelog author="asn@cryptomilk.org" date="1656936000">- Update to version 0.9.11~git0.41f5562:
  * Prepare for release
  * Fix clippy warnings
  * Versions bump
  * Add back the deps.rs badge
  * Increase the regex requirement
  * Prepare for release
  * Bump cargo
  * Add support for Haiku Operating System
  * Add udbserver to users
  * Extend the coverage further
  * Fix the code coverage script
  * Fix subcommand fallback support
  * Print the issued commands
  * Fix testing cross compilation
  * Bump cargo-metadata
  * Bump cbindgen
  * Support rustc-1.60 and following
  * Update to clap-3.1 and cargo-0.61
  * Prepare for release
  * Do not use the patch version in macOS -install_name
  * Add Android to the build targets supported by LibType
  * Make nightly clippy happy
  * Simplify a writln
  * Prepare for release
  * Bump cargo version
  * Remove newlines from the description
  * Make the default destdir None
  * CI: use MSYS2 cargo package for example project
  * Print the PKG_CONFIG_PATH in verbose mode</changelog>
  <changelog author="asn@cryptomilk.org" date="1672660800">- Update to version 0.9.15~git0.2d3044b:
  * Prepare for release
  * Update to cargo-0.67 and clap-4
  * macos: Allow larger install_name entries
  * Fix the new clippy lints
  * Don't include version in soname ELF header if versioning is disabled
  * Use get_many instead of values_of_lossy
  * Use macos-12 for the macos runner
  * Add job deps
  * Generate paths relative to ${prefix} in the pkg-config file even if --libdir or --includedir are given
  * Compact the main CI
  * Fix more warnings in the main CI
  * Use a custom release profile to strip binaries
  * ci(deploy): Use musl abi for aarch64 linux binary, add i686 linux
  * Remove msys2 test
  * Update the example-project CI
  * Make sure the supported rustc version is evident
  * Use the default compiler to build a static binary for musl
  * Save all the linux binaries
  * Prepare for release
  * Add pre-built ppc64le and aarch64 linux binaries
  * Simplify the deploy script
  * Fix new clippy lints
  * Update to cargo-0.66
  * Use dtolnay/rust-toolchain
  * Remove actions-rs/cargo
  * Prepare for release
  * add support for illumos
  * Bump cargo version
  * Prepare for release
  * Bump cargo to 0.64
  * Install the windows DLL in the libdir if it is custom
  * Fix typo on readme
  * Bump the codecov action
  * Add sonames on musl</changelog>
  <changelog author="dmueller@suse.com" date="1678795200">- add constraints to avoid out of disk space errors</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697544000">- Update to version 0.9.27~git0.54774e0:
  * Complete the soversion granularity
  * Bump cbindgen
  * Make sure the version variables are consistent
  * Fix sover detection for 0-based versioning
  * Bump cargo version
  * Bump cbindgen
  * Do not pass the token to clippy-check
- Switch _service to manual.</changelog>
  <changelog author="david.mulder@suse.com" date="1717502400">- Update to version 0.9.32~git0.56dfe34:
  * Prepare for release
  * Bump cargo version
  * Use clone_from/clone_into
  * Do not install the versioned links and lib on Android
  * docs: add rustls-ffi to README users list
  * Bump the msrv again
  * Bump msrv
  * Bump cargo version
  * Match the beaviour of meson regarding relative paths in the install directories
  * Bump cargo version</changelog>
  <changelog author="kilgore.trout@idesmi.eu" date="1724760000">- Update to version 0.10.3~git0.ee7d7ef:
  * Wire in the heuristics
  * Implement heuristics for target-specific install paths
  * Fix the generated header fingerprinting logic
  * Make notice about missing windows debug files verbose-only
  * Update dependencies
  * Require cargo 0.80.0
- Use macros from cargo-packaging
- Remove cargo_config: contained in vendor.tar
- Remove cargo_audit service: now part of cargo_vendor
- Remove custom rustflags and let the macros set them instead</changelog>
  <changelog author="william.brown@suse.com" date="1726833600">- bsc#1230683 - CVE-2024-45405 - gix-path improper path resolution</changelog>
</package>
<package pkgid="23530353644bdab42d1e9f63c7f77559808a43b334d91c8042be0738c9027eb2" name="cargo-c" arch="src">
  <version epoch="0" ver="0.10.3~git0.ee7d7ef" rel="150600.3.3.1"/>
  <changelog author="asn@cryptomilk.org" date="1591099200">- Update to version 0.6.5
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.5
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.4
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.3</changelog>
  <changelog author="asn@cryptomilk.org" date="1591617600">- Update to version 0.6.7
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.7
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.6</changelog>
  <changelog author="asn@cryptomilk.org" date="1594641600">- Update to version 0.6.9
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.9
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.8</changelog>
  <changelog author="asn@cryptomilk.org" date="1599652800">- Update to version 0.6.13
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.13
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.12
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.11
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.10</changelog>
  <changelog author="asn@cryptomilk.org" date="1602590400">- Added 123.patch
  * Save the include subdir to a specific field</changelog>
  <changelog author="asn@cryptomilk.org" date="1603022400">- Update to version 0.6.15
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.15
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.14
- Removed 123.patch</changelog>
  <changelog author="asn@cryptomilk.org" date="1610539200">- Update to version 0.7.0
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.7.0</changelog>
  <changelog author="alarrosa@suse.com" date="1617624000">- Update to version 0.8.0
  * cbindgen 0.18
  * provide a cli option to have fully static builds.
  * cargo cinstall and cargo capi install now imply --release
    to match the behavior of cargo install.</changelog>
  <changelog author="william.brown@suse.com" date="1617710400">- Add README.suse-maint to fix OBS warning.</changelog>
  <changelog author="william.brown@suse.com" date="1622635200">- Update to version 0.8.1~git0.cce1b08:
  * Prepare for release
  * Set the capi.library.rustflags
  * Add a simple way to set the RUSTFLAGS from Cargo.toml
  * CI: test example project in Windows/MSYS2 (#191)
  * Update cargo requirement from 0.52 to 0.53
  * Upgrade to GitHub-native Dependabot
  * Default to nightly
  * Use codecov
  * Move the code coverage in a stand-alone script
  * Enable colored help</changelog>
  <changelog author="william.brown@suse.com" date="1641470400">- resolve bsc#1194113 (CVE-2018-25023)
- resolve bsc#1194119 (CVE-2021-45710)</changelog>
  <changelog author="asn@cryptomilk.org" date="1641816000">- Update to version 0.9.6~git0.68e65ad:
  * Prepare for release
  * Bump cargo
  * Support custom paths for data files as it is available for includes
  * Fix the datadir description
  * Change the configuration paths for datadir
  * Add datadir destination path customization
  * Suppress warning about dead code for Common
  * Add datadir support
  * Make sure the right rust is used on deploy
  * Bump the edition in the examples</changelog>
  <changelog author="william.brown@suse.com" date="1646222400">- Update vendored libraries to resolve security issues.</changelog>
  <changelog author="asn@cryptomilk.org" date="1656936000">- Update to version 0.9.11~git0.41f5562:
  * Prepare for release
  * Fix clippy warnings
  * Versions bump
  * Add back the deps.rs badge
  * Increase the regex requirement
  * Prepare for release
  * Bump cargo
  * Add support for Haiku Operating System
  * Add udbserver to users
  * Extend the coverage further
  * Fix the code coverage script
  * Fix subcommand fallback support
  * Print the issued commands
  * Fix testing cross compilation
  * Bump cargo-metadata
  * Bump cbindgen
  * Support rustc-1.60 and following
  * Update to clap-3.1 and cargo-0.61
  * Prepare for release
  * Do not use the patch version in macOS -install_name
  * Add Android to the build targets supported by LibType
  * Make nightly clippy happy
  * Simplify a writln
  * Prepare for release
  * Bump cargo version
  * Remove newlines from the description
  * Make the default destdir None
  * CI: use MSYS2 cargo package for example project
  * Print the PKG_CONFIG_PATH in verbose mode</changelog>
  <changelog author="asn@cryptomilk.org" date="1672660800">- Update to version 0.9.15~git0.2d3044b:
  * Prepare for release
  * Update to cargo-0.67 and clap-4
  * macos: Allow larger install_name entries
  * Fix the new clippy lints
  * Don't include version in soname ELF header if versioning is disabled
  * Use get_many instead of values_of_lossy
  * Use macos-12 for the macos runner
  * Add job deps
  * Generate paths relative to ${prefix} in the pkg-config file even if --libdir or --includedir are given
  * Compact the main CI
  * Fix more warnings in the main CI
  * Use a custom release profile to strip binaries
  * ci(deploy): Use musl abi for aarch64 linux binary, add i686 linux
  * Remove msys2 test
  * Update the example-project CI
  * Make sure the supported rustc version is evident
  * Use the default compiler to build a static binary for musl
  * Save all the linux binaries
  * Prepare for release
  * Add pre-built ppc64le and aarch64 linux binaries
  * Simplify the deploy script
  * Fix new clippy lints
  * Update to cargo-0.66
  * Use dtolnay/rust-toolchain
  * Remove actions-rs/cargo
  * Prepare for release
  * add support for illumos
  * Bump cargo version
  * Prepare for release
  * Bump cargo to 0.64
  * Install the windows DLL in the libdir if it is custom
  * Fix typo on readme
  * Bump the codecov action
  * Add sonames on musl</changelog>
  <changelog author="dmueller@suse.com" date="1678795200">- add constraints to avoid out of disk space errors</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697544000">- Update to version 0.9.27~git0.54774e0:
  * Complete the soversion granularity
  * Bump cbindgen
  * Make sure the version variables are consistent
  * Fix sover detection for 0-based versioning
  * Bump cargo version
  * Bump cbindgen
  * Do not pass the token to clippy-check
- Switch _service to manual.</changelog>
  <changelog author="david.mulder@suse.com" date="1717502400">- Update to version 0.9.32~git0.56dfe34:
  * Prepare for release
  * Bump cargo version
  * Use clone_from/clone_into
  * Do not install the versioned links and lib on Android
  * docs: add rustls-ffi to README users list
  * Bump the msrv again
  * Bump msrv
  * Bump cargo version
  * Match the beaviour of meson regarding relative paths in the install directories
  * Bump cargo version</changelog>
  <changelog author="kilgore.trout@idesmi.eu" date="1724760000">- Update to version 0.10.3~git0.ee7d7ef:
  * Wire in the heuristics
  * Implement heuristics for target-specific install paths
  * Fix the generated header fingerprinting logic
  * Make notice about missing windows debug files verbose-only
  * Update dependencies
  * Require cargo 0.80.0
- Use macros from cargo-packaging
- Remove cargo_config: contained in vendor.tar
- Remove cargo_audit service: now part of cargo_vendor
- Remove custom rustflags and let the macros set them instead</changelog>
  <changelog author="william.brown@suse.com" date="1726833600">- bsc#1230683 - CVE-2024-45405 - gix-path improper path resolution</changelog>
</package>
<package pkgid="24438e5d5ce1b8c63f5e7721779bd79116fdcc52fbc1214a5eec47be57780420" name="cargo-c" arch="x86_64">
  <version epoch="0" ver="0.10.3~git0.ee7d7ef" rel="150600.3.3.1"/>
  <changelog author="asn@cryptomilk.org" date="1591099200">- Update to version 0.6.5
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.5
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.4
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.3</changelog>
  <changelog author="asn@cryptomilk.org" date="1591617600">- Update to version 0.6.7
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.7
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.6</changelog>
  <changelog author="asn@cryptomilk.org" date="1594641600">- Update to version 0.6.9
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.9
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.8</changelog>
  <changelog author="asn@cryptomilk.org" date="1599652800">- Update to version 0.6.13
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.13
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.12
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.11
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.10</changelog>
  <changelog author="asn@cryptomilk.org" date="1602590400">- Added 123.patch
  * Save the include subdir to a specific field</changelog>
  <changelog author="asn@cryptomilk.org" date="1603022400">- Update to version 0.6.15
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.15
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.6.14
- Removed 123.patch</changelog>
  <changelog author="asn@cryptomilk.org" date="1610539200">- Update to version 0.7.0
  * https://github.com/lu-zero/cargo-c/releases/tag/v0.7.0</changelog>
  <changelog author="alarrosa@suse.com" date="1617624000">- Update to version 0.8.0
  * cbindgen 0.18
  * provide a cli option to have fully static builds.
  * cargo cinstall and cargo capi install now imply --release
    to match the behavior of cargo install.</changelog>
  <changelog author="william.brown@suse.com" date="1617710400">- Add README.suse-maint to fix OBS warning.</changelog>
  <changelog author="william.brown@suse.com" date="1622635200">- Update to version 0.8.1~git0.cce1b08:
  * Prepare for release
  * Set the capi.library.rustflags
  * Add a simple way to set the RUSTFLAGS from Cargo.toml
  * CI: test example project in Windows/MSYS2 (#191)
  * Update cargo requirement from 0.52 to 0.53
  * Upgrade to GitHub-native Dependabot
  * Default to nightly
  * Use codecov
  * Move the code coverage in a stand-alone script
  * Enable colored help</changelog>
  <changelog author="william.brown@suse.com" date="1641470400">- resolve bsc#1194113 (CVE-2018-25023)
- resolve bsc#1194119 (CVE-2021-45710)</changelog>
  <changelog author="asn@cryptomilk.org" date="1641816000">- Update to version 0.9.6~git0.68e65ad:
  * Prepare for release
  * Bump cargo
  * Support custom paths for data files as it is available for includes
  * Fix the datadir description
  * Change the configuration paths for datadir
  * Add datadir destination path customization
  * Suppress warning about dead code for Common
  * Add datadir support
  * Make sure the right rust is used on deploy
  * Bump the edition in the examples</changelog>
  <changelog author="william.brown@suse.com" date="1646222400">- Update vendored libraries to resolve security issues.</changelog>
  <changelog author="asn@cryptomilk.org" date="1656936000">- Update to version 0.9.11~git0.41f5562:
  * Prepare for release
  * Fix clippy warnings
  * Versions bump
  * Add back the deps.rs badge
  * Increase the regex requirement
  * Prepare for release
  * Bump cargo
  * Add support for Haiku Operating System
  * Add udbserver to users
  * Extend the coverage further
  * Fix the code coverage script
  * Fix subcommand fallback support
  * Print the issued commands
  * Fix testing cross compilation
  * Bump cargo-metadata
  * Bump cbindgen
  * Support rustc-1.60 and following
  * Update to clap-3.1 and cargo-0.61
  * Prepare for release
  * Do not use the patch version in macOS -install_name
  * Add Android to the build targets supported by LibType
  * Make nightly clippy happy
  * Simplify a writln
  * Prepare for release
  * Bump cargo version
  * Remove newlines from the description
  * Make the default destdir None
  * CI: use MSYS2 cargo package for example project
  * Print the PKG_CONFIG_PATH in verbose mode</changelog>
  <changelog author="asn@cryptomilk.org" date="1672660800">- Update to version 0.9.15~git0.2d3044b:
  * Prepare for release
  * Update to cargo-0.67 and clap-4
  * macos: Allow larger install_name entries
  * Fix the new clippy lints
  * Don't include version in soname ELF header if versioning is disabled
  * Use get_many instead of values_of_lossy
  * Use macos-12 for the macos runner
  * Add job deps
  * Generate paths relative to ${prefix} in the pkg-config file even if --libdir or --includedir are given
  * Compact the main CI
  * Fix more warnings in the main CI
  * Use a custom release profile to strip binaries
  * ci(deploy): Use musl abi for aarch64 linux binary, add i686 linux
  * Remove msys2 test
  * Update the example-project CI
  * Make sure the supported rustc version is evident
  * Use the default compiler to build a static binary for musl
  * Save all the linux binaries
  * Prepare for release
  * Add pre-built ppc64le and aarch64 linux binaries
  * Simplify the deploy script
  * Fix new clippy lints
  * Update to cargo-0.66
  * Use dtolnay/rust-toolchain
  * Remove actions-rs/cargo
  * Prepare for release
  * add support for illumos
  * Bump cargo version
  * Prepare for release
  * Bump cargo to 0.64
  * Install the windows DLL in the libdir if it is custom
  * Fix typo on readme
  * Bump the codecov action
  * Add sonames on musl</changelog>
  <changelog author="dmueller@suse.com" date="1678795200">- add constraints to avoid out of disk space errors</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697544000">- Update to version 0.9.27~git0.54774e0:
  * Complete the soversion granularity
  * Bump cbindgen
  * Make sure the version variables are consistent
  * Fix sover detection for 0-based versioning
  * Bump cargo version
  * Bump cbindgen
  * Do not pass the token to clippy-check
- Switch _service to manual.</changelog>
  <changelog author="david.mulder@suse.com" date="1717502400">- Update to version 0.9.32~git0.56dfe34:
  * Prepare for release
  * Bump cargo version
  * Use clone_from/clone_into
  * Do not install the versioned links and lib on Android
  * docs: add rustls-ffi to README users list
  * Bump the msrv again
  * Bump msrv
  * Bump cargo version
  * Match the beaviour of meson regarding relative paths in the install directories
  * Bump cargo version</changelog>
  <changelog author="kilgore.trout@idesmi.eu" date="1724760000">- Update to version 0.10.3~git0.ee7d7ef:
  * Wire in the heuristics
  * Implement heuristics for target-specific install paths
  * Fix the generated header fingerprinting logic
  * Make notice about missing windows debug files verbose-only
  * Update dependencies
  * Require cargo 0.80.0
- Use macros from cargo-packaging
- Remove cargo_config: contained in vendor.tar
- Remove cargo_audit service: now part of cargo_vendor
- Remove custom rustflags and let the macros set them instead</changelog>
  <changelog author="william.brown@suse.com" date="1726833600">- bsc#1230683 - CVE-2024-45405 - gix-path improper path resolution</changelog>
</package>
<package pkgid="efde600d2ddc052d7e6fb056eca524c8a1f40070d7d2a32bf305eab11aeb5be8" name="cargo1.78" arch="aarch64">
  <version epoch="0" ver="1.78.0" rel="150500.11.3.1"/>
  <changelog author="william.brown@suse.com" date="1715688000">Version 1.78.0 (2024-05-02)
  Language
--------
- [Stabilize `#[cfg(target_abi = ...)]`](https://github.com/rust-lang/rust/pull/119590/)
- [Stabilize the `#[diagnostic]` namespace and `#[diagnostic::on_unimplemented]` attribute](https://github.com/rust-lang/rust/pull/119888/)
- [Make async-fn-in-trait implementable with concrete signatures](https://github.com/rust-lang/rust/pull/120103/)
- [Make matching on NaN a hard error, and remove the rest of `illegal_floating_point_literal_pattern`](https://github.com/rust-lang/rust/pull/116284/)
- [static mut: allow mutable reference to arbitrary types, not just slices and arrays](https://github.com/rust-lang/rust/pull/117614/)
- [Extend `invalid_reference_casting` to include references casting to bigger memory layout](https://github.com/rust-lang/rust/pull/118983/)
- [Add `non_contiguous_range_endpoints` lint for singleton gaps after exclusive ranges](https://github.com/rust-lang/rust/pull/118879/)
- [Add `wasm_c_abi` lint for use of older wasm-bindgen versions](https://github.com/rust-lang/rust/pull/117918/)
  This lint currently only works when using Cargo.
- [Update `indirect_structural_match` and `pointer_structural_match` lints to match RFC](https://github.com/rust-lang/rust/pull/120423/)
- [Make non-`PartialEq`-typed consts as patterns a hard error](https://github.com/rust-lang/rust/pull/120805/)
- [Split `refining_impl_trait` lint into `_reachable`, `_internal` variants](https://github.com/rust-lang/rust/pull/121720/)
- [Remove unnecessary type inference when using associated types inside of higher ranked `where`-bounds](https://github.com/rust-lang/rust/pull/119849)
- [Weaken eager detection of cyclic types during type inference](https://github.com/rust-lang/rust/pull/119989)
- [`trait Trait: Auto {}`: allow upcasting from `dyn Trait` to `dyn Auto`](https://github.com/rust-lang/rust/pull/119338)
  Compiler
--------
- [Made `INVALID_DOC_ATTRIBUTES` lint deny by default](https://github.com/rust-lang/rust/pull/111505/)
- [Increase accuracy of redundant `use` checking](https://github.com/rust-lang/rust/pull/117772/)
- [Suggest moving definition if non-found macro_rules! is defined later](https://github.com/rust-lang/rust/pull/121130/)
- [Lower transmutes from int to pointer type as gep on null](https://github.com/rust-lang/rust/pull/121282/)
  Target changes:
- [Windows tier 1 targets now require at least Windows 10](https://github.com/rust-lang/rust/pull/115141/)
  - [Enable CMPXCHG16B, SSE3, SAHF/LAHF and 128-bit Atomics in tier 1 Windows](https://github.com/rust-lang/rust/pull/120820/)
- [Add `wasm32-wasip1` tier 2 (without host tools) target](https://github.com/rust-lang/rust/pull/120468/)
- [Add `wasm32-wasip2` tier 3 target](https://github.com/rust-lang/rust/pull/119616/)
- [Rename `wasm32-wasi-preview1-threads` to `wasm32-wasip1-threads`](https://github.com/rust-lang/rust/pull/122170/)
- [Add `arm64ec-pc-windows-msvc` tier 3 target](https://github.com/rust-lang/rust/pull/119199/)
- [Add `armv8r-none-eabihf` tier 3 target for the Cortex-R52](https://github.com/rust-lang/rust/pull/110482/)
- [Add `loongarch64-unknown-linux-musl` tier 3 target](https://github.com/rust-lang/rust/pull/121832/)
  Refer to Rust's [platform support page][platform-support-doc]
  for more information on Rust's tiered platform support.
  Libraries
---------
- [Bump Unicode to version 15.1.0, regenerate tables](https://github.com/rust-lang/rust/pull/120777/)
- [Make align_offset, align_to well-behaved in all cases](https://github.com/rust-lang/rust/pull/121201/)
- [PartialEq, PartialOrd: document expectations for transitive chains](https://github.com/rust-lang/rust/pull/115386/)
- [Optimize away poison guards when std is built with panic=abort](https://github.com/rust-lang/rust/pull/100603/)
- [Replace pthread `RwLock` with custom implementation](https://github.com/rust-lang/rust/pull/110211/)
- [Implement unwind safety for Condvar on all platforms](https://github.com/rust-lang/rust/pull/121768/)
- [Add ASCII fast-path for `char::is_grapheme_extended`](https://github.com/rust-lang/rust/pull/121138/)
  Stabilized APIs
- [`impl Read for &amp;Stdin`](https://doc.rust-lang.org/stable/std/io/struct.Stdin.html#impl-Read-for-%26Stdin)
- [Accept non `'static` lifetimes for several `std::error::Error` related implementations](https://github.com/rust-lang/rust/pull/113833/)
- [Make `impl&lt;Fd: AsFd&gt;` impl take `?Sized`](https://github.com/rust-lang/rust/pull/114655/)
- [`impl From&lt;TryReserveError&gt; for io::Error`](https://doc.rust-lang.org/stable/std/io/struct.Error.html#impl-From%3CTryReserveError%3E-for-Error)
  These APIs are now stable in const contexts:
- [`Barrier::new()`](https://doc.rust-lang.org/stable/std/sync/struct.Barrier.html#method.new)
  Cargo
-----
- [Stabilize lockfile v4](https://github.com/rust-lang/cargo/pull/12852/)
- [Respect `rust-version` when generating lockfile](https://github.com/rust-lang/cargo/pull/12861/)
- [Control `--charset` via auto-detecting config value](https://github.com/rust-lang/cargo/pull/13337/)
- [Support `target.&lt;triple&gt;.rustdocflags` officially](https://github.com/rust-lang/cargo/pull/13197/)
- [Stabilize global cache data tracking](https://github.com/rust-lang/cargo/pull/13492/)
  Misc
----
- [rustdoc: add `--test-builder-wrapper` arg to support wrappers such as RUSTC_WRAPPER when building doctests](https://github.com/rust-lang/rust/pull/114651/)
  Compatibility Notes
- [Many unsafe precondition checks now run for user code with debug assertions enabled](https://github.com/rust-lang/rust/pull/120594/)
  This change helps users catch undefined behavior in their code, though the details of how much is checked are generally not stable.
- [riscv only supports split_debuginfo=off for now](https://github.com/rust-lang/rust/pull/120518/)
- [Consistently check bounds on hidden types of `impl Trait`](https://github.com/rust-lang/rust/pull/121679)
- [Change equality of higher ranked types to not rely on subtyping](https://github.com/rust-lang/rust/pull/118247)
- [When called, additionally check bounds on normalized function return type](https://github.com/rust-lang/rust/pull/118882)
- [Expand coverage for `arithmetic_overflow` lint](https://github.com/rust-lang/rust/pull/119432/)
- [Fix detection of potential interior mutability in `const` initializers](https://github.com/rust-lang/rust/issues/121250)
  This code was accidentally accepted. The fix can break generic code that borrows a value of unknown type,
  as there is currently no way to declare "this type has no interior mutability". In the future, stabilizing
  the [`Freeze` trait](https://github.com/rust-lang/rust/issues/121675) will allow proper support for such code.</changelog>
</package>
<package pkgid="d67b7313415e650b76fa09e4b6b5cef00af669db544b9bc937dcae4fc01147df" name="cargo1.78" arch="ppc64le">
  <version epoch="0" ver="1.78.0" rel="150500.11.3.1"/>
  <changelog author="william.brown@suse.com" date="1715688000">Version 1.78.0 (2024-05-02)
  Language
--------
- [Stabilize `#[cfg(target_abi = ...)]`](https://github.com/rust-lang/rust/pull/119590/)
- [Stabilize the `#[diagnostic]` namespace and `#[diagnostic::on_unimplemented]` attribute](https://github.com/rust-lang/rust/pull/119888/)
- [Make async-fn-in-trait implementable with concrete signatures](https://github.com/rust-lang/rust/pull/120103/)
- [Make matching on NaN a hard error, and remove the rest of `illegal_floating_point_literal_pattern`](https://github.com/rust-lang/rust/pull/116284/)
- [static mut: allow mutable reference to arbitrary types, not just slices and arrays](https://github.com/rust-lang/rust/pull/117614/)
- [Extend `invalid_reference_casting` to include references casting to bigger memory layout](https://github.com/rust-lang/rust/pull/118983/)
- [Add `non_contiguous_range_endpoints` lint for singleton gaps after exclusive ranges](https://github.com/rust-lang/rust/pull/118879/)
- [Add `wasm_c_abi` lint for use of older wasm-bindgen versions](https://github.com/rust-lang/rust/pull/117918/)
  This lint currently only works when using Cargo.
- [Update `indirect_structural_match` and `pointer_structural_match` lints to match RFC](https://github.com/rust-lang/rust/pull/120423/)
- [Make non-`PartialEq`-typed consts as patterns a hard error](https://github.com/rust-lang/rust/pull/120805/)
- [Split `refining_impl_trait` lint into `_reachable`, `_internal` variants](https://github.com/rust-lang/rust/pull/121720/)
- [Remove unnecessary type inference when using associated types inside of higher ranked `where`-bounds](https://github.com/rust-lang/rust/pull/119849)
- [Weaken eager detection of cyclic types during type inference](https://github.com/rust-lang/rust/pull/119989)
- [`trait Trait: Auto {}`: allow upcasting from `dyn Trait` to `dyn Auto`](https://github.com/rust-lang/rust/pull/119338)
  Compiler
--------
- [Made `INVALID_DOC_ATTRIBUTES` lint deny by default](https://github.com/rust-lang/rust/pull/111505/)
- [Increase accuracy of redundant `use` checking](https://github.com/rust-lang/rust/pull/117772/)
- [Suggest moving definition if non-found macro_rules! is defined later](https://github.com/rust-lang/rust/pull/121130/)
- [Lower transmutes from int to pointer type as gep on null](https://github.com/rust-lang/rust/pull/121282/)
  Target changes:
- [Windows tier 1 targets now require at least Windows 10](https://github.com/rust-lang/rust/pull/115141/)
  - [Enable CMPXCHG16B, SSE3, SAHF/LAHF and 128-bit Atomics in tier 1 Windows](https://github.com/rust-lang/rust/pull/120820/)
- [Add `wasm32-wasip1` tier 2 (without host tools) target](https://github.com/rust-lang/rust/pull/120468/)
- [Add `wasm32-wasip2` tier 3 target](https://github.com/rust-lang/rust/pull/119616/)
- [Rename `wasm32-wasi-preview1-threads` to `wasm32-wasip1-threads`](https://github.com/rust-lang/rust/pull/122170/)
- [Add `arm64ec-pc-windows-msvc` tier 3 target](https://github.com/rust-lang/rust/pull/119199/)
- [Add `armv8r-none-eabihf` tier 3 target for the Cortex-R52](https://github.com/rust-lang/rust/pull/110482/)
- [Add `loongarch64-unknown-linux-musl` tier 3 target](https://github.com/rust-lang/rust/pull/121832/)
  Refer to Rust's [platform support page][platform-support-doc]
  for more information on Rust's tiered platform support.
  Libraries
---------
- [Bump Unicode to version 15.1.0, regenerate tables](https://github.com/rust-lang/rust/pull/120777/)
- [Make align_offset, align_to well-behaved in all cases](https://github.com/rust-lang/rust/pull/121201/)
- [PartialEq, PartialOrd: document expectations for transitive chains](https://github.com/rust-lang/rust/pull/115386/)
- [Optimize away poison guards when std is built with panic=abort](https://github.com/rust-lang/rust/pull/100603/)
- [Replace pthread `RwLock` with custom implementation](https://github.com/rust-lang/rust/pull/110211/)
- [Implement unwind safety for Condvar on all platforms](https://github.com/rust-lang/rust/pull/121768/)
- [Add ASCII fast-path for `char::is_grapheme_extended`](https://github.com/rust-lang/rust/pull/121138/)
  Stabilized APIs
- [`impl Read for &amp;Stdin`](https://doc.rust-lang.org/stable/std/io/struct.Stdin.html#impl-Read-for-%26Stdin)
- [Accept non `'static` lifetimes for several `std::error::Error` related implementations](https://github.com/rust-lang/rust/pull/113833/)
- [Make `impl&lt;Fd: AsFd&gt;` impl take `?Sized`](https://github.com/rust-lang/rust/pull/114655/)
- [`impl From&lt;TryReserveError&gt; for io::Error`](https://doc.rust-lang.org/stable/std/io/struct.Error.html#impl-From%3CTryReserveError%3E-for-Error)
  These APIs are now stable in const contexts:
- [`Barrier::new()`](https://doc.rust-lang.org/stable/std/sync/struct.Barrier.html#method.new)
  Cargo
-----
- [Stabilize lockfile v4](https://github.com/rust-lang/cargo/pull/12852/)
- [Respect `rust-version` when generating lockfile](https://github.com/rust-lang/cargo/pull/12861/)
- [Control `--charset` via auto-detecting config value](https://github.com/rust-lang/cargo/pull/13337/)
- [Support `target.&lt;triple&gt;.rustdocflags` officially](https://github.com/rust-lang/cargo/pull/13197/)
- [Stabilize global cache data tracking](https://github.com/rust-lang/cargo/pull/13492/)
  Misc
----
- [rustdoc: add `--test-builder-wrapper` arg to support wrappers such as RUSTC_WRAPPER when building doctests](https://github.com/rust-lang/rust/pull/114651/)
  Compatibility Notes
- [Many unsafe precondition checks now run for user code with debug assertions enabled](https://github.com/rust-lang/rust/pull/120594/)
  This change helps users catch undefined behavior in their code, though the details of how much is checked are generally not stable.
- [riscv only supports split_debuginfo=off for now](https://github.com/rust-lang/rust/pull/120518/)
- [Consistently check bounds on hidden types of `impl Trait`](https://github.com/rust-lang/rust/pull/121679)
- [Change equality of higher ranked types to not rely on subtyping](https://github.com/rust-lang/rust/pull/118247)
- [When called, additionally check bounds on normalized function return type](https://github.com/rust-lang/rust/pull/118882)
- [Expand coverage for `arithmetic_overflow` lint](https://github.com/rust-lang/rust/pull/119432/)
- [Fix detection of potential interior mutability in `const` initializers](https://github.com/rust-lang/rust/issues/121250)
  This code was accidentally accepted. The fix can break generic code that borrows a value of unknown type,
  as there is currently no way to declare "this type has no interior mutability". In the future, stabilizing
  the [`Freeze` trait](https://github.com/rust-lang/rust/issues/121675) will allow proper support for such code.</changelog>
</package>
<package pkgid="36600d35db9e9a2e5efd1206ebcfe6e58bff23dbf3bae2fa4dc1645dfe1688b8" name="cargo1.78" arch="s390x">
  <version epoch="0" ver="1.78.0" rel="150500.11.3.1"/>
  <changelog author="william.brown@suse.com" date="1715688000">Version 1.78.0 (2024-05-02)
  Language
--------
- [Stabilize `#[cfg(target_abi = ...)]`](https://github.com/rust-lang/rust/pull/119590/)
- [Stabilize the `#[diagnostic]` namespace and `#[diagnostic::on_unimplemented]` attribute](https://github.com/rust-lang/rust/pull/119888/)
- [Make async-fn-in-trait implementable with concrete signatures](https://github.com/rust-lang/rust/pull/120103/)
- [Make matching on NaN a hard error, and remove the rest of `illegal_floating_point_literal_pattern`](https://github.com/rust-lang/rust/pull/116284/)
- [static mut: allow mutable reference to arbitrary types, not just slices and arrays](https://github.com/rust-lang/rust/pull/117614/)
- [Extend `invalid_reference_casting` to include references casting to bigger memory layout](https://github.com/rust-lang/rust/pull/118983/)
- [Add `non_contiguous_range_endpoints` lint for singleton gaps after exclusive ranges](https://github.com/rust-lang/rust/pull/118879/)
- [Add `wasm_c_abi` lint for use of older wasm-bindgen versions](https://github.com/rust-lang/rust/pull/117918/)
  This lint currently only works when using Cargo.
- [Update `indirect_structural_match` and `pointer_structural_match` lints to match RFC](https://github.com/rust-lang/rust/pull/120423/)
- [Make non-`PartialEq`-typed consts as patterns a hard error](https://github.com/rust-lang/rust/pull/120805/)
- [Split `refining_impl_trait` lint into `_reachable`, `_internal` variants](https://github.com/rust-lang/rust/pull/121720/)
- [Remove unnecessary type inference when using associated types inside of higher ranked `where`-bounds](https://github.com/rust-lang/rust/pull/119849)
- [Weaken eager detection of cyclic types during type inference](https://github.com/rust-lang/rust/pull/119989)
- [`trait Trait: Auto {}`: allow upcasting from `dyn Trait` to `dyn Auto`](https://github.com/rust-lang/rust/pull/119338)
  Compiler
--------
- [Made `INVALID_DOC_ATTRIBUTES` lint deny by default](https://github.com/rust-lang/rust/pull/111505/)
- [Increase accuracy of redundant `use` checking](https://github.com/rust-lang/rust/pull/117772/)
- [Suggest moving definition if non-found macro_rules! is defined later](https://github.com/rust-lang/rust/pull/121130/)
- [Lower transmutes from int to pointer type as gep on null](https://github.com/rust-lang/rust/pull/121282/)
  Target changes:
- [Windows tier 1 targets now require at least Windows 10](https://github.com/rust-lang/rust/pull/115141/)
  - [Enable CMPXCHG16B, SSE3, SAHF/LAHF and 128-bit Atomics in tier 1 Windows](https://github.com/rust-lang/rust/pull/120820/)
- [Add `wasm32-wasip1` tier 2 (without host tools) target](https://github.com/rust-lang/rust/pull/120468/)
- [Add `wasm32-wasip2` tier 3 target](https://github.com/rust-lang/rust/pull/119616/)
- [Rename `wasm32-wasi-preview1-threads` to `wasm32-wasip1-threads`](https://github.com/rust-lang/rust/pull/122170/)
- [Add `arm64ec-pc-windows-msvc` tier 3 target](https://github.com/rust-lang/rust/pull/119199/)
- [Add `armv8r-none-eabihf` tier 3 target for the Cortex-R52](https://github.com/rust-lang/rust/pull/110482/)
- [Add `loongarch64-unknown-linux-musl` tier 3 target](https://github.com/rust-lang/rust/pull/121832/)
  Refer to Rust's [platform support page][platform-support-doc]
  for more information on Rust's tiered platform support.
  Libraries
---------
- [Bump Unicode to version 15.1.0, regenerate tables](https://github.com/rust-lang/rust/pull/120777/)
- [Make align_offset, align_to well-behaved in all cases](https://github.com/rust-lang/rust/pull/121201/)
- [PartialEq, PartialOrd: document expectations for transitive chains](https://github.com/rust-lang/rust/pull/115386/)
- [Optimize away poison guards when std is built with panic=abort](https://github.com/rust-lang/rust/pull/100603/)
- [Replace pthread `RwLock` with custom implementation](https://github.com/rust-lang/rust/pull/110211/)
- [Implement unwind safety for Condvar on all platforms](https://github.com/rust-lang/rust/pull/121768/)
- [Add ASCII fast-path for `char::is_grapheme_extended`](https://github.com/rust-lang/rust/pull/121138/)
  Stabilized APIs
- [`impl Read for &amp;Stdin`](https://doc.rust-lang.org/stable/std/io/struct.Stdin.html#impl-Read-for-%26Stdin)
- [Accept non `'static` lifetimes for several `std::error::Error` related implementations](https://github.com/rust-lang/rust/pull/113833/)
- [Make `impl&lt;Fd: AsFd&gt;` impl take `?Sized`](https://github.com/rust-lang/rust/pull/114655/)
- [`impl From&lt;TryReserveError&gt; for io::Error`](https://doc.rust-lang.org/stable/std/io/struct.Error.html#impl-From%3CTryReserveError%3E-for-Error)
  These APIs are now stable in const contexts:
- [`Barrier::new()`](https://doc.rust-lang.org/stable/std/sync/struct.Barrier.html#method.new)
  Cargo
-----
- [Stabilize lockfile v4](https://github.com/rust-lang/cargo/pull/12852/)
- [Respect `rust-version` when generating lockfile](https://github.com/rust-lang/cargo/pull/12861/)
- [Control `--charset` via auto-detecting config value](https://github.com/rust-lang/cargo/pull/13337/)
- [Support `target.&lt;triple&gt;.rustdocflags` officially](https://github.com/rust-lang/cargo/pull/13197/)
- [Stabilize global cache data tracking](https://github.com/rust-lang/cargo/pull/13492/)
  Misc
----
- [rustdoc: add `--test-builder-wrapper` arg to support wrappers such as RUSTC_WRAPPER when building doctests](https://github.com/rust-lang/rust/pull/114651/)
  Compatibility Notes
- [Many unsafe precondition checks now run for user code with debug assertions enabled](https://github.com/rust-lang/rust/pull/120594/)
  This change helps users catch undefined behavior in their code, though the details of how much is checked are generally not stable.
- [riscv only supports split_debuginfo=off for now](https://github.com/rust-lang/rust/pull/120518/)
- [Consistently check bounds on hidden types of `impl Trait`](https://github.com/rust-lang/rust/pull/121679)
- [Change equality of higher ranked types to not rely on subtyping](https://github.com/rust-lang/rust/pull/118247)
- [When called, additionally check bounds on normalized function return type](https://github.com/rust-lang/rust/pull/118882)
- [Expand coverage for `arithmetic_overflow` lint](https://github.com/rust-lang/rust/pull/119432/)
- [Fix detection of potential interior mutability in `const` initializers](https://github.com/rust-lang/rust/issues/121250)
  This code was accidentally accepted. The fix can break generic code that borrows a value of unknown type,
  as there is currently no way to declare "this type has no interior mutability". In the future, stabilizing
  the [`Freeze` trait](https://github.com/rust-lang/rust/issues/121675) will allow proper support for such code.</changelog>
</package>
<package pkgid="723efe343407d00c043abdc7214cd479d2e2f163e20478f31a6c47e7a8db099b" name="cargo1.78" arch="x86_64">
  <version epoch="0" ver="1.78.0" rel="150500.11.3.1"/>
  <changelog author="william.brown@suse.com" date="1715688000">Version 1.78.0 (2024-05-02)
  Language
--------
- [Stabilize `#[cfg(target_abi = ...)]`](https://github.com/rust-lang/rust/pull/119590/)
- [Stabilize the `#[diagnostic]` namespace and `#[diagnostic::on_unimplemented]` attribute](https://github.com/rust-lang/rust/pull/119888/)
- [Make async-fn-in-trait implementable with concrete signatures](https://github.com/rust-lang/rust/pull/120103/)
- [Make matching on NaN a hard error, and remove the rest of `illegal_floating_point_literal_pattern`](https://github.com/rust-lang/rust/pull/116284/)
- [static mut: allow mutable reference to arbitrary types, not just slices and arrays](https://github.com/rust-lang/rust/pull/117614/)
- [Extend `invalid_reference_casting` to include references casting to bigger memory layout](https://github.com/rust-lang/rust/pull/118983/)
- [Add `non_contiguous_range_endpoints` lint for singleton gaps after exclusive ranges](https://github.com/rust-lang/rust/pull/118879/)
- [Add `wasm_c_abi` lint for use of older wasm-bindgen versions](https://github.com/rust-lang/rust/pull/117918/)
  This lint currently only works when using Cargo.
- [Update `indirect_structural_match` and `pointer_structural_match` lints to match RFC](https://github.com/rust-lang/rust/pull/120423/)
- [Make non-`PartialEq`-typed consts as patterns a hard error](https://github.com/rust-lang/rust/pull/120805/)
- [Split `refining_impl_trait` lint into `_reachable`, `_internal` variants](https://github.com/rust-lang/rust/pull/121720/)
- [Remove unnecessary type inference when using associated types inside of higher ranked `where`-bounds](https://github.com/rust-lang/rust/pull/119849)
- [Weaken eager detection of cyclic types during type inference](https://github.com/rust-lang/rust/pull/119989)
- [`trait Trait: Auto {}`: allow upcasting from `dyn Trait` to `dyn Auto`](https://github.com/rust-lang/rust/pull/119338)
  Compiler
--------
- [Made `INVALID_DOC_ATTRIBUTES` lint deny by default](https://github.com/rust-lang/rust/pull/111505/)
- [Increase accuracy of redundant `use` checking](https://github.com/rust-lang/rust/pull/117772/)
- [Suggest moving definition if non-found macro_rules! is defined later](https://github.com/rust-lang/rust/pull/121130/)
- [Lower transmutes from int to pointer type as gep on null](https://github.com/rust-lang/rust/pull/121282/)
  Target changes:
- [Windows tier 1 targets now require at least Windows 10](https://github.com/rust-lang/rust/pull/115141/)
  - [Enable CMPXCHG16B, SSE3, SAHF/LAHF and 128-bit Atomics in tier 1 Windows](https://github.com/rust-lang/rust/pull/120820/)
- [Add `wasm32-wasip1` tier 2 (without host tools) target](https://github.com/rust-lang/rust/pull/120468/)
- [Add `wasm32-wasip2` tier 3 target](https://github.com/rust-lang/rust/pull/119616/)
- [Rename `wasm32-wasi-preview1-threads` to `wasm32-wasip1-threads`](https://github.com/rust-lang/rust/pull/122170/)
- [Add `arm64ec-pc-windows-msvc` tier 3 target](https://github.com/rust-lang/rust/pull/119199/)
- [Add `armv8r-none-eabihf` tier 3 target for the Cortex-R52](https://github.com/rust-lang/rust/pull/110482/)
- [Add `loongarch64-unknown-linux-musl` tier 3 target](https://github.com/rust-lang/rust/pull/121832/)
  Refer to Rust's [platform support page][platform-support-doc]
  for more information on Rust's tiered platform support.
  Libraries
---------
- [Bump Unicode to version 15.1.0, regenerate tables](https://github.com/rust-lang/rust/pull/120777/)
- [Make align_offset, align_to well-behaved in all cases](https://github.com/rust-lang/rust/pull/121201/)
- [PartialEq, PartialOrd: document expectations for transitive chains](https://github.com/rust-lang/rust/pull/115386/)
- [Optimize away poison guards when std is built with panic=abort](https://github.com/rust-lang/rust/pull/100603/)
- [Replace pthread `RwLock` with custom implementation](https://github.com/rust-lang/rust/pull/110211/)
- [Implement unwind safety for Condvar on all platforms](https://github.com/rust-lang/rust/pull/121768/)
- [Add ASCII fast-path for `char::is_grapheme_extended`](https://github.com/rust-lang/rust/pull/121138/)
  Stabilized APIs
- [`impl Read for &amp;Stdin`](https://doc.rust-lang.org/stable/std/io/struct.Stdin.html#impl-Read-for-%26Stdin)
- [Accept non `'static` lifetimes for several `std::error::Error` related implementations](https://github.com/rust-lang/rust/pull/113833/)
- [Make `impl&lt;Fd: AsFd&gt;` impl take `?Sized`](https://github.com/rust-lang/rust/pull/114655/)
- [`impl From&lt;TryReserveError&gt; for io::Error`](https://doc.rust-lang.org/stable/std/io/struct.Error.html#impl-From%3CTryReserveError%3E-for-Error)
  These APIs are now stable in const contexts:
- [`Barrier::new()`](https://doc.rust-lang.org/stable/std/sync/struct.Barrier.html#method.new)
  Cargo
-----
- [Stabilize lockfile v4](https://github.com/rust-lang/cargo/pull/12852/)
- [Respect `rust-version` when generating lockfile](https://github.com/rust-lang/cargo/pull/12861/)
- [Control `--charset` via auto-detecting config value](https://github.com/rust-lang/cargo/pull/13337/)
- [Support `target.&lt;triple&gt;.rustdocflags` officially](https://github.com/rust-lang/cargo/pull/13197/)
- [Stabilize global cache data tracking](https://github.com/rust-lang/cargo/pull/13492/)
  Misc
----
- [rustdoc: add `--test-builder-wrapper` arg to support wrappers such as RUSTC_WRAPPER when building doctests](https://github.com/rust-lang/rust/pull/114651/)
  Compatibility Notes
- [Many unsafe precondition checks now run for user code with debug assertions enabled](https://github.com/rust-lang/rust/pull/120594/)
  This change helps users catch undefined behavior in their code, though the details of how much is checked are generally not stable.
- [riscv only supports split_debuginfo=off for now](https://github.com/rust-lang/rust/pull/120518/)
- [Consistently check bounds on hidden types of `impl Trait`](https://github.com/rust-lang/rust/pull/121679)
- [Change equality of higher ranked types to not rely on subtyping](https://github.com/rust-lang/rust/pull/118247)
- [When called, additionally check bounds on normalized function return type](https://github.com/rust-lang/rust/pull/118882)
- [Expand coverage for `arithmetic_overflow` lint](https://github.com/rust-lang/rust/pull/119432/)
- [Fix detection of potential interior mutability in `const` initializers](https://github.com/rust-lang/rust/issues/121250)
  This code was accidentally accepted. The fix can break generic code that borrows a value of unknown type,
  as there is currently no way to declare "this type has no interior mutability". In the future, stabilizing
  the [`Freeze` trait](https://github.com/rust-lang/rust/issues/121675) will allow proper support for such code.</changelog>
</package>
<package pkgid="3a151083ace8a5a101824157227d030ae5b192f1e098fc95941ad1d113c4201e" name="cargo1.79" arch="aarch64">
  <version epoch="0" ver="1.79.0" rel="150500.11.3.1"/>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">Version 1.79.0 (2024-06-13)
  Language
--------
- [Stabilize inline `const {}` expressions.](https://github.com/rust-lang/rust/pull/104087/)
- [Prevent opaque types being instantiated twice with different regions within the same function.](https://github.com/rust-lang/rust/pull/116935/)
- [Stabilize WebAssembly target features that are in phase 4 and 5.](https://github.com/rust-lang/rust/pull/117457/)
- [Add the `redundant_lifetimes` lint to detect lifetimes which are semantically redundant.](https://github.com/rust-lang/rust/pull/118391/)
- [Stabilize the `unnameable_types` lint for public types that can't be named.](https://github.com/rust-lang/rust/pull/120144/)
- [Enable debuginfo in macros, and stabilize `-C collapse-macro-debuginfo` and `#[collapse_debuginfo]`.](https://github.com/rust-lang/rust/pull/120845/)
- [Propagate temporary lifetime extension into `if` and `match` expressions.](https://github.com/rust-lang/rust/pull/121346/)
- [Restrict promotion of `const fn` calls.](https://github.com/rust-lang/rust/pull/121557/)
- [Warn against refining impls of crate-private traits with `refining_impl_trait` lint.](https://github.com/rust-lang/rust/pull/121720/)
- [Stabilize associated type bounds (RFC 2289).](https://github.com/rust-lang/rust/pull/122055/)
- [Stabilize importing `main` from other modules or crates.](https://github.com/rust-lang/rust/pull/122060/)
- [Check return types of function types for well-formedness](https://github.com/rust-lang/rust/pull/115538)
- [Rework `impl Trait` lifetime inference](https://github.com/rust-lang/rust/pull/116891/)
- [Change inductive trait solver cycles to be ambiguous](https://github.com/rust-lang/rust/pull/122791)
  Compiler
--------
- [Define `-C strip` to only affect binaries, not artifacts like `.pdb`.](https://github.com/rust-lang/rust/pull/115120/)
- [Stabilize `-Crelro-level` for controlling runtime link hardening.](https://github.com/rust-lang/rust/pull/121694/)
- [Stabilize checking of `cfg` names and values at compile-time with `--check-cfg`.](https://github.com/rust-lang/rust/pull/123501/)
  * Note that this only stabilizes the compiler part, the Cargo part is still unstable in this release.*
- [Add `aarch64-apple-visionos` and `aarch64-apple-visionos-sim` tier 3 targets.](https://github.com/rust-lang/rust/pull/121419/)
- [Add `riscv32ima-unknown-none-elf` tier 3 target.](https://github.com/rust-lang/rust/pull/122696/)
- [Promote several Windows targets to tier 2](https://github.com/rust-lang/rust/pull/121712): `aarch64-pc-windows-gnullvm`, `i686-pc-windows-gnullvm`, and `x86_64-pc-windows-gnullvm`.
  Refer to Rust's [platform support page][platform-support-doc]
  for more information on Rust's tiered platform support.
  Libraries
---------
- [Implement `FromIterator` for `(impl Default + Extend, impl Default + Extend)`.](https://github.com/rust-lang/rust/pull/107462/)
- [Implement `{Div,Rem}Assign&lt;NonZero&lt;X&gt;&gt;` on `X`.](https://github.com/rust-lang/rust/pull/121952/)
- [Document overrides of `clone_from()` in core/std.](https://github.com/rust-lang/rust/pull/122201/)
- [Link MSVC default lib in core.](https://github.com/rust-lang/rust/pull/122268/)
- [Caution against using `transmute` between pointers and integers.](https://github.com/rust-lang/rust/pull/122379/)
- [Enable frame pointers for the standard library.](https://github.com/rust-lang/rust/pull/122646/)
  Stabilized APIs
- [`{integer}::unchecked_add`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_add)
- [`{integer}::unchecked_mul`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_mul)
- [`{integer}::unchecked_sub`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_sub)
- [`&lt;[T]&gt;::split_at_unchecked`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.split_at_unchecked)
- [`&lt;[T]&gt;::split_at_mut_unchecked`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.split_at_mut_unchecked)
- [`&lt;[u8]&gt;::utf8_chunks`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.utf8_chunks)
- [`str::Utf8Chunks`](https://doc.rust-lang.org/stable/core/str/struct.Utf8Chunks.html)
- [`str::Utf8Chunk`](https://doc.rust-lang.org/stable/core/str/struct.Utf8Chunk.html)
- [`&lt;*const T&gt;::is_aligned`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_aligned)
- [`&lt;*mut T&gt;::is_aligned`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_aligned-1)
- [`NonNull::is_aligned`](https://doc.rust-lang.org/stable/core/ptr/struct.NonNull.html#method.is_aligned)
- [`&lt;*const [T]&gt;::len`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.len)
- [`&lt;*mut [T]&gt;::len`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.len-1)
- [`&lt;*const [T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_empty)
- [`&lt;*mut [T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_empty-1)
- [`NonNull::&lt;[T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/ptr/struct.NonNull.html#method.is_empty)
- [`CStr::count_bytes`](https://doc.rust-lang.org/stable/core/ffi/c_str/struct.CStr.html#method.count_bytes)
- [`io::Error::downcast`](https://doc.rust-lang.org/stable/std/io/struct.Error.html#method.downcast)
- [`num::NonZero&lt;T&gt;`](https://doc.rust-lang.org/stable/core/num/struct.NonZero.html)
- [`path::absolute`](https://doc.rust-lang.org/stable/std/path/fn.absolute.html)
- [`proc_macro::Literal::byte_character`](https://doc.rust-lang.org/stable/proc_macro/struct.Literal.html#method.byte_character)
- [`proc_macro::Literal::c_string`](https://doc.rust-lang.org/stable/proc_macro/struct.Literal.html#method.c_string)
  These APIs are now stable in const contexts:
- [`Atomic*::into_inner`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicUsize.html#method.into_inner)
- [`io::Cursor::new`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.new)
- [`io::Cursor::get_ref`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.get_ref)
- [`io::Cursor::position`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.position)
- [`io::empty`](https://doc.rust-lang.org/stable/std/io/fn.empty.html)
- [`io::repeat`](https://doc.rust-lang.org/stable/std/io/fn.repeat.html)
- [`io::sink`](https://doc.rust-lang.org/stable/std/io/fn.sink.html)
- [`panic::Location::caller`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.caller)
- [`panic::Location::file`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.file)
- [`panic::Location::line`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.line)
- [`panic::Location::column`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.column)
  Cargo
-----
- [Prevent dashes in `lib.name`, always normalizing to `_`.](https://github.com/rust-lang/cargo/pull/12783/)
- [Stabilize MSRV-aware version requirement selection in `cargo add`.](https://github.com/rust-lang/cargo/pull/13608/)
- [Switch to using `gitoxide` by default for listing files.](https://github.com/rust-lang/cargo/pull/13696/)
- [Error on `[project]` in Edition 2024; `cargo fix --edition` will change it to `[package]`.](https://github.com/rust-lang/cargo/pull/13747/)
  Rustdoc
-----
- [Always display stability version even if it's the same as the containing item.](https://github.com/rust-lang/rust/pull/118441/)
- [Show a single search result for items with multiple paths.](https://github.com/rust-lang/rust/pull/119912/)
- [Support typing `/` in docs to begin a search.](https://github.com/rust-lang/rust/pull/123355/)
  Misc
----
  Compatibility Notes
- [Update the minimum external LLVM to 17.](https://github.com/rust-lang/rust/pull/122649/)
- [`RustcEncodable` and `RustcDecodable` are soft-destabilized, to be removed
  from the prelude in next edition.](https://github.com/rust-lang/rust/pull/116016/)
- [The `wasm_c_abi` future-incompatibility lint will warn about use of the
  non-spec-compliant C ABI.](https://github.com/rust-lang/rust/pull/117918/)
  Use `wasm-bindgen v0.2.88` to generate forward-compatible bindings.
- [Check return types of function types for well-formedness](https://github.com/rust-lang/rust/pull/115538)</changelog>
</package>
<package pkgid="01575d3bf378fad5c2f7a58e3dc733a666bfe6622c2779bded1b8136a4276fb3" name="cargo1.79" arch="ppc64le">
  <version epoch="0" ver="1.79.0" rel="150500.11.3.1"/>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">Version 1.79.0 (2024-06-13)
  Language
--------
- [Stabilize inline `const {}` expressions.](https://github.com/rust-lang/rust/pull/104087/)
- [Prevent opaque types being instantiated twice with different regions within the same function.](https://github.com/rust-lang/rust/pull/116935/)
- [Stabilize WebAssembly target features that are in phase 4 and 5.](https://github.com/rust-lang/rust/pull/117457/)
- [Add the `redundant_lifetimes` lint to detect lifetimes which are semantically redundant.](https://github.com/rust-lang/rust/pull/118391/)
- [Stabilize the `unnameable_types` lint for public types that can't be named.](https://github.com/rust-lang/rust/pull/120144/)
- [Enable debuginfo in macros, and stabilize `-C collapse-macro-debuginfo` and `#[collapse_debuginfo]`.](https://github.com/rust-lang/rust/pull/120845/)
- [Propagate temporary lifetime extension into `if` and `match` expressions.](https://github.com/rust-lang/rust/pull/121346/)
- [Restrict promotion of `const fn` calls.](https://github.com/rust-lang/rust/pull/121557/)
- [Warn against refining impls of crate-private traits with `refining_impl_trait` lint.](https://github.com/rust-lang/rust/pull/121720/)
- [Stabilize associated type bounds (RFC 2289).](https://github.com/rust-lang/rust/pull/122055/)
- [Stabilize importing `main` from other modules or crates.](https://github.com/rust-lang/rust/pull/122060/)
- [Check return types of function types for well-formedness](https://github.com/rust-lang/rust/pull/115538)
- [Rework `impl Trait` lifetime inference](https://github.com/rust-lang/rust/pull/116891/)
- [Change inductive trait solver cycles to be ambiguous](https://github.com/rust-lang/rust/pull/122791)
  Compiler
--------
- [Define `-C strip` to only affect binaries, not artifacts like `.pdb`.](https://github.com/rust-lang/rust/pull/115120/)
- [Stabilize `-Crelro-level` for controlling runtime link hardening.](https://github.com/rust-lang/rust/pull/121694/)
- [Stabilize checking of `cfg` names and values at compile-time with `--check-cfg`.](https://github.com/rust-lang/rust/pull/123501/)
  * Note that this only stabilizes the compiler part, the Cargo part is still unstable in this release.*
- [Add `aarch64-apple-visionos` and `aarch64-apple-visionos-sim` tier 3 targets.](https://github.com/rust-lang/rust/pull/121419/)
- [Add `riscv32ima-unknown-none-elf` tier 3 target.](https://github.com/rust-lang/rust/pull/122696/)
- [Promote several Windows targets to tier 2](https://github.com/rust-lang/rust/pull/121712): `aarch64-pc-windows-gnullvm`, `i686-pc-windows-gnullvm`, and `x86_64-pc-windows-gnullvm`.
  Refer to Rust's [platform support page][platform-support-doc]
  for more information on Rust's tiered platform support.
  Libraries
---------
- [Implement `FromIterator` for `(impl Default + Extend, impl Default + Extend)`.](https://github.com/rust-lang/rust/pull/107462/)
- [Implement `{Div,Rem}Assign&lt;NonZero&lt;X&gt;&gt;` on `X`.](https://github.com/rust-lang/rust/pull/121952/)
- [Document overrides of `clone_from()` in core/std.](https://github.com/rust-lang/rust/pull/122201/)
- [Link MSVC default lib in core.](https://github.com/rust-lang/rust/pull/122268/)
- [Caution against using `transmute` between pointers and integers.](https://github.com/rust-lang/rust/pull/122379/)
- [Enable frame pointers for the standard library.](https://github.com/rust-lang/rust/pull/122646/)
  Stabilized APIs
- [`{integer}::unchecked_add`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_add)
- [`{integer}::unchecked_mul`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_mul)
- [`{integer}::unchecked_sub`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_sub)
- [`&lt;[T]&gt;::split_at_unchecked`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.split_at_unchecked)
- [`&lt;[T]&gt;::split_at_mut_unchecked`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.split_at_mut_unchecked)
- [`&lt;[u8]&gt;::utf8_chunks`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.utf8_chunks)
- [`str::Utf8Chunks`](https://doc.rust-lang.org/stable/core/str/struct.Utf8Chunks.html)
- [`str::Utf8Chunk`](https://doc.rust-lang.org/stable/core/str/struct.Utf8Chunk.html)
- [`&lt;*const T&gt;::is_aligned`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_aligned)
- [`&lt;*mut T&gt;::is_aligned`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_aligned-1)
- [`NonNull::is_aligned`](https://doc.rust-lang.org/stable/core/ptr/struct.NonNull.html#method.is_aligned)
- [`&lt;*const [T]&gt;::len`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.len)
- [`&lt;*mut [T]&gt;::len`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.len-1)
- [`&lt;*const [T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_empty)
- [`&lt;*mut [T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_empty-1)
- [`NonNull::&lt;[T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/ptr/struct.NonNull.html#method.is_empty)
- [`CStr::count_bytes`](https://doc.rust-lang.org/stable/core/ffi/c_str/struct.CStr.html#method.count_bytes)
- [`io::Error::downcast`](https://doc.rust-lang.org/stable/std/io/struct.Error.html#method.downcast)
- [`num::NonZero&lt;T&gt;`](https://doc.rust-lang.org/stable/core/num/struct.NonZero.html)
- [`path::absolute`](https://doc.rust-lang.org/stable/std/path/fn.absolute.html)
- [`proc_macro::Literal::byte_character`](https://doc.rust-lang.org/stable/proc_macro/struct.Literal.html#method.byte_character)
- [`proc_macro::Literal::c_string`](https://doc.rust-lang.org/stable/proc_macro/struct.Literal.html#method.c_string)
  These APIs are now stable in const contexts:
- [`Atomic*::into_inner`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicUsize.html#method.into_inner)
- [`io::Cursor::new`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.new)
- [`io::Cursor::get_ref`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.get_ref)
- [`io::Cursor::position`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.position)
- [`io::empty`](https://doc.rust-lang.org/stable/std/io/fn.empty.html)
- [`io::repeat`](https://doc.rust-lang.org/stable/std/io/fn.repeat.html)
- [`io::sink`](https://doc.rust-lang.org/stable/std/io/fn.sink.html)
- [`panic::Location::caller`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.caller)
- [`panic::Location::file`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.file)
- [`panic::Location::line`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.line)
- [`panic::Location::column`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.column)
  Cargo
-----
- [Prevent dashes in `lib.name`, always normalizing to `_`.](https://github.com/rust-lang/cargo/pull/12783/)
- [Stabilize MSRV-aware version requirement selection in `cargo add`.](https://github.com/rust-lang/cargo/pull/13608/)
- [Switch to using `gitoxide` by default for listing files.](https://github.com/rust-lang/cargo/pull/13696/)
- [Error on `[project]` in Edition 2024; `cargo fix --edition` will change it to `[package]`.](https://github.com/rust-lang/cargo/pull/13747/)
  Rustdoc
-----
- [Always display stability version even if it's the same as the containing item.](https://github.com/rust-lang/rust/pull/118441/)
- [Show a single search result for items with multiple paths.](https://github.com/rust-lang/rust/pull/119912/)
- [Support typing `/` in docs to begin a search.](https://github.com/rust-lang/rust/pull/123355/)
  Misc
----
  Compatibility Notes
- [Update the minimum external LLVM to 17.](https://github.com/rust-lang/rust/pull/122649/)
- [`RustcEncodable` and `RustcDecodable` are soft-destabilized, to be removed
  from the prelude in next edition.](https://github.com/rust-lang/rust/pull/116016/)
- [The `wasm_c_abi` future-incompatibility lint will warn about use of the
  non-spec-compliant C ABI.](https://github.com/rust-lang/rust/pull/117918/)
  Use `wasm-bindgen v0.2.88` to generate forward-compatible bindings.
- [Check return types of function types for well-formedness](https://github.com/rust-lang/rust/pull/115538)</changelog>
</package>
<package pkgid="06c209d2e6509198a897d824604a9f54283568453328c5bb337db0b1ccdc3972" name="cargo1.79" arch="s390x">
  <version epoch="0" ver="1.79.0" rel="150500.11.3.1"/>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">Version 1.79.0 (2024-06-13)
  Language
--------
- [Stabilize inline `const {}` expressions.](https://github.com/rust-lang/rust/pull/104087/)
- [Prevent opaque types being instantiated twice with different regions within the same function.](https://github.com/rust-lang/rust/pull/116935/)
- [Stabilize WebAssembly target features that are in phase 4 and 5.](https://github.com/rust-lang/rust/pull/117457/)
- [Add the `redundant_lifetimes` lint to detect lifetimes which are semantically redundant.](https://github.com/rust-lang/rust/pull/118391/)
- [Stabilize the `unnameable_types` lint for public types that can't be named.](https://github.com/rust-lang/rust/pull/120144/)
- [Enable debuginfo in macros, and stabilize `-C collapse-macro-debuginfo` and `#[collapse_debuginfo]`.](https://github.com/rust-lang/rust/pull/120845/)
- [Propagate temporary lifetime extension into `if` and `match` expressions.](https://github.com/rust-lang/rust/pull/121346/)
- [Restrict promotion of `const fn` calls.](https://github.com/rust-lang/rust/pull/121557/)
- [Warn against refining impls of crate-private traits with `refining_impl_trait` lint.](https://github.com/rust-lang/rust/pull/121720/)
- [Stabilize associated type bounds (RFC 2289).](https://github.com/rust-lang/rust/pull/122055/)
- [Stabilize importing `main` from other modules or crates.](https://github.com/rust-lang/rust/pull/122060/)
- [Check return types of function types for well-formedness](https://github.com/rust-lang/rust/pull/115538)
- [Rework `impl Trait` lifetime inference](https://github.com/rust-lang/rust/pull/116891/)
- [Change inductive trait solver cycles to be ambiguous](https://github.com/rust-lang/rust/pull/122791)
  Compiler
--------
- [Define `-C strip` to only affect binaries, not artifacts like `.pdb`.](https://github.com/rust-lang/rust/pull/115120/)
- [Stabilize `-Crelro-level` for controlling runtime link hardening.](https://github.com/rust-lang/rust/pull/121694/)
- [Stabilize checking of `cfg` names and values at compile-time with `--check-cfg`.](https://github.com/rust-lang/rust/pull/123501/)
  * Note that this only stabilizes the compiler part, the Cargo part is still unstable in this release.*
- [Add `aarch64-apple-visionos` and `aarch64-apple-visionos-sim` tier 3 targets.](https://github.com/rust-lang/rust/pull/121419/)
- [Add `riscv32ima-unknown-none-elf` tier 3 target.](https://github.com/rust-lang/rust/pull/122696/)
- [Promote several Windows targets to tier 2](https://github.com/rust-lang/rust/pull/121712): `aarch64-pc-windows-gnullvm`, `i686-pc-windows-gnullvm`, and `x86_64-pc-windows-gnullvm`.
  Refer to Rust's [platform support page][platform-support-doc]
  for more information on Rust's tiered platform support.
  Libraries
---------
- [Implement `FromIterator` for `(impl Default + Extend, impl Default + Extend)`.](https://github.com/rust-lang/rust/pull/107462/)
- [Implement `{Div,Rem}Assign&lt;NonZero&lt;X&gt;&gt;` on `X`.](https://github.com/rust-lang/rust/pull/121952/)
- [Document overrides of `clone_from()` in core/std.](https://github.com/rust-lang/rust/pull/122201/)
- [Link MSVC default lib in core.](https://github.com/rust-lang/rust/pull/122268/)
- [Caution against using `transmute` between pointers and integers.](https://github.com/rust-lang/rust/pull/122379/)
- [Enable frame pointers for the standard library.](https://github.com/rust-lang/rust/pull/122646/)
  Stabilized APIs
- [`{integer}::unchecked_add`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_add)
- [`{integer}::unchecked_mul`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_mul)
- [`{integer}::unchecked_sub`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_sub)
- [`&lt;[T]&gt;::split_at_unchecked`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.split_at_unchecked)
- [`&lt;[T]&gt;::split_at_mut_unchecked`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.split_at_mut_unchecked)
- [`&lt;[u8]&gt;::utf8_chunks`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.utf8_chunks)
- [`str::Utf8Chunks`](https://doc.rust-lang.org/stable/core/str/struct.Utf8Chunks.html)
- [`str::Utf8Chunk`](https://doc.rust-lang.org/stable/core/str/struct.Utf8Chunk.html)
- [`&lt;*const T&gt;::is_aligned`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_aligned)
- [`&lt;*mut T&gt;::is_aligned`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_aligned-1)
- [`NonNull::is_aligned`](https://doc.rust-lang.org/stable/core/ptr/struct.NonNull.html#method.is_aligned)
- [`&lt;*const [T]&gt;::len`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.len)
- [`&lt;*mut [T]&gt;::len`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.len-1)
- [`&lt;*const [T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_empty)
- [`&lt;*mut [T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_empty-1)
- [`NonNull::&lt;[T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/ptr/struct.NonNull.html#method.is_empty)
- [`CStr::count_bytes`](https://doc.rust-lang.org/stable/core/ffi/c_str/struct.CStr.html#method.count_bytes)
- [`io::Error::downcast`](https://doc.rust-lang.org/stable/std/io/struct.Error.html#method.downcast)
- [`num::NonZero&lt;T&gt;`](https://doc.rust-lang.org/stable/core/num/struct.NonZero.html)
- [`path::absolute`](https://doc.rust-lang.org/stable/std/path/fn.absolute.html)
- [`proc_macro::Literal::byte_character`](https://doc.rust-lang.org/stable/proc_macro/struct.Literal.html#method.byte_character)
- [`proc_macro::Literal::c_string`](https://doc.rust-lang.org/stable/proc_macro/struct.Literal.html#method.c_string)
  These APIs are now stable in const contexts:
- [`Atomic*::into_inner`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicUsize.html#method.into_inner)
- [`io::Cursor::new`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.new)
- [`io::Cursor::get_ref`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.get_ref)
- [`io::Cursor::position`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.position)
- [`io::empty`](https://doc.rust-lang.org/stable/std/io/fn.empty.html)
- [`io::repeat`](https://doc.rust-lang.org/stable/std/io/fn.repeat.html)
- [`io::sink`](https://doc.rust-lang.org/stable/std/io/fn.sink.html)
- [`panic::Location::caller`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.caller)
- [`panic::Location::file`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.file)
- [`panic::Location::line`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.line)
- [`panic::Location::column`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.column)
  Cargo
-----
- [Prevent dashes in `lib.name`, always normalizing to `_`.](https://github.com/rust-lang/cargo/pull/12783/)
- [Stabilize MSRV-aware version requirement selection in `cargo add`.](https://github.com/rust-lang/cargo/pull/13608/)
- [Switch to using `gitoxide` by default for listing files.](https://github.com/rust-lang/cargo/pull/13696/)
- [Error on `[project]` in Edition 2024; `cargo fix --edition` will change it to `[package]`.](https://github.com/rust-lang/cargo/pull/13747/)
  Rustdoc
-----
- [Always display stability version even if it's the same as the containing item.](https://github.com/rust-lang/rust/pull/118441/)
- [Show a single search result for items with multiple paths.](https://github.com/rust-lang/rust/pull/119912/)
- [Support typing `/` in docs to begin a search.](https://github.com/rust-lang/rust/pull/123355/)
  Misc
----
  Compatibility Notes
- [Update the minimum external LLVM to 17.](https://github.com/rust-lang/rust/pull/122649/)
- [`RustcEncodable` and `RustcDecodable` are soft-destabilized, to be removed
  from the prelude in next edition.](https://github.com/rust-lang/rust/pull/116016/)
- [The `wasm_c_abi` future-incompatibility lint will warn about use of the
  non-spec-compliant C ABI.](https://github.com/rust-lang/rust/pull/117918/)
  Use `wasm-bindgen v0.2.88` to generate forward-compatible bindings.
- [Check return types of function types for well-formedness](https://github.com/rust-lang/rust/pull/115538)</changelog>
</package>
<package pkgid="afc42b0f3c22c0578ca7e4dc87135729458741c82d7b96e6171b990579a70377" name="cargo1.79" arch="x86_64">
  <version epoch="0" ver="1.79.0" rel="150500.11.3.1"/>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">Version 1.79.0 (2024-06-13)
  Language
--------
- [Stabilize inline `const {}` expressions.](https://github.com/rust-lang/rust/pull/104087/)
- [Prevent opaque types being instantiated twice with different regions within the same function.](https://github.com/rust-lang/rust/pull/116935/)
- [Stabilize WebAssembly target features that are in phase 4 and 5.](https://github.com/rust-lang/rust/pull/117457/)
- [Add the `redundant_lifetimes` lint to detect lifetimes which are semantically redundant.](https://github.com/rust-lang/rust/pull/118391/)
- [Stabilize the `unnameable_types` lint for public types that can't be named.](https://github.com/rust-lang/rust/pull/120144/)
- [Enable debuginfo in macros, and stabilize `-C collapse-macro-debuginfo` and `#[collapse_debuginfo]`.](https://github.com/rust-lang/rust/pull/120845/)
- [Propagate temporary lifetime extension into `if` and `match` expressions.](https://github.com/rust-lang/rust/pull/121346/)
- [Restrict promotion of `const fn` calls.](https://github.com/rust-lang/rust/pull/121557/)
- [Warn against refining impls of crate-private traits with `refining_impl_trait` lint.](https://github.com/rust-lang/rust/pull/121720/)
- [Stabilize associated type bounds (RFC 2289).](https://github.com/rust-lang/rust/pull/122055/)
- [Stabilize importing `main` from other modules or crates.](https://github.com/rust-lang/rust/pull/122060/)
- [Check return types of function types for well-formedness](https://github.com/rust-lang/rust/pull/115538)
- [Rework `impl Trait` lifetime inference](https://github.com/rust-lang/rust/pull/116891/)
- [Change inductive trait solver cycles to be ambiguous](https://github.com/rust-lang/rust/pull/122791)
  Compiler
--------
- [Define `-C strip` to only affect binaries, not artifacts like `.pdb`.](https://github.com/rust-lang/rust/pull/115120/)
- [Stabilize `-Crelro-level` for controlling runtime link hardening.](https://github.com/rust-lang/rust/pull/121694/)
- [Stabilize checking of `cfg` names and values at compile-time with `--check-cfg`.](https://github.com/rust-lang/rust/pull/123501/)
  * Note that this only stabilizes the compiler part, the Cargo part is still unstable in this release.*
- [Add `aarch64-apple-visionos` and `aarch64-apple-visionos-sim` tier 3 targets.](https://github.com/rust-lang/rust/pull/121419/)
- [Add `riscv32ima-unknown-none-elf` tier 3 target.](https://github.com/rust-lang/rust/pull/122696/)
- [Promote several Windows targets to tier 2](https://github.com/rust-lang/rust/pull/121712): `aarch64-pc-windows-gnullvm`, `i686-pc-windows-gnullvm`, and `x86_64-pc-windows-gnullvm`.
  Refer to Rust's [platform support page][platform-support-doc]
  for more information on Rust's tiered platform support.
  Libraries
---------
- [Implement `FromIterator` for `(impl Default + Extend, impl Default + Extend)`.](https://github.com/rust-lang/rust/pull/107462/)
- [Implement `{Div,Rem}Assign&lt;NonZero&lt;X&gt;&gt;` on `X`.](https://github.com/rust-lang/rust/pull/121952/)
- [Document overrides of `clone_from()` in core/std.](https://github.com/rust-lang/rust/pull/122201/)
- [Link MSVC default lib in core.](https://github.com/rust-lang/rust/pull/122268/)
- [Caution against using `transmute` between pointers and integers.](https://github.com/rust-lang/rust/pull/122379/)
- [Enable frame pointers for the standard library.](https://github.com/rust-lang/rust/pull/122646/)
  Stabilized APIs
- [`{integer}::unchecked_add`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_add)
- [`{integer}::unchecked_mul`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_mul)
- [`{integer}::unchecked_sub`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_sub)
- [`&lt;[T]&gt;::split_at_unchecked`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.split_at_unchecked)
- [`&lt;[T]&gt;::split_at_mut_unchecked`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.split_at_mut_unchecked)
- [`&lt;[u8]&gt;::utf8_chunks`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.utf8_chunks)
- [`str::Utf8Chunks`](https://doc.rust-lang.org/stable/core/str/struct.Utf8Chunks.html)
- [`str::Utf8Chunk`](https://doc.rust-lang.org/stable/core/str/struct.Utf8Chunk.html)
- [`&lt;*const T&gt;::is_aligned`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_aligned)
- [`&lt;*mut T&gt;::is_aligned`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_aligned-1)
- [`NonNull::is_aligned`](https://doc.rust-lang.org/stable/core/ptr/struct.NonNull.html#method.is_aligned)
- [`&lt;*const [T]&gt;::len`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.len)
- [`&lt;*mut [T]&gt;::len`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.len-1)
- [`&lt;*const [T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_empty)
- [`&lt;*mut [T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_empty-1)
- [`NonNull::&lt;[T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/ptr/struct.NonNull.html#method.is_empty)
- [`CStr::count_bytes`](https://doc.rust-lang.org/stable/core/ffi/c_str/struct.CStr.html#method.count_bytes)
- [`io::Error::downcast`](https://doc.rust-lang.org/stable/std/io/struct.Error.html#method.downcast)
- [`num::NonZero&lt;T&gt;`](https://doc.rust-lang.org/stable/core/num/struct.NonZero.html)
- [`path::absolute`](https://doc.rust-lang.org/stable/std/path/fn.absolute.html)
- [`proc_macro::Literal::byte_character`](https://doc.rust-lang.org/stable/proc_macro/struct.Literal.html#method.byte_character)
- [`proc_macro::Literal::c_string`](https://doc.rust-lang.org/stable/proc_macro/struct.Literal.html#method.c_string)
  These APIs are now stable in const contexts:
- [`Atomic*::into_inner`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicUsize.html#method.into_inner)
- [`io::Cursor::new`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.new)
- [`io::Cursor::get_ref`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.get_ref)
- [`io::Cursor::position`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.position)
- [`io::empty`](https://doc.rust-lang.org/stable/std/io/fn.empty.html)
- [`io::repeat`](https://doc.rust-lang.org/stable/std/io/fn.repeat.html)
- [`io::sink`](https://doc.rust-lang.org/stable/std/io/fn.sink.html)
- [`panic::Location::caller`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.caller)
- [`panic::Location::file`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.file)
- [`panic::Location::line`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.line)
- [`panic::Location::column`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.column)
  Cargo
-----
- [Prevent dashes in `lib.name`, always normalizing to `_`.](https://github.com/rust-lang/cargo/pull/12783/)
- [Stabilize MSRV-aware version requirement selection in `cargo add`.](https://github.com/rust-lang/cargo/pull/13608/)
- [Switch to using `gitoxide` by default for listing files.](https://github.com/rust-lang/cargo/pull/13696/)
- [Error on `[project]` in Edition 2024; `cargo fix --edition` will change it to `[package]`.](https://github.com/rust-lang/cargo/pull/13747/)
  Rustdoc
-----
- [Always display stability version even if it's the same as the containing item.](https://github.com/rust-lang/rust/pull/118441/)
- [Show a single search result for items with multiple paths.](https://github.com/rust-lang/rust/pull/119912/)
- [Support typing `/` in docs to begin a search.](https://github.com/rust-lang/rust/pull/123355/)
  Misc
----
  Compatibility Notes
- [Update the minimum external LLVM to 17.](https://github.com/rust-lang/rust/pull/122649/)
- [`RustcEncodable` and `RustcDecodable` are soft-destabilized, to be removed
  from the prelude in next edition.](https://github.com/rust-lang/rust/pull/116016/)
- [The `wasm_c_abi` future-incompatibility lint will warn about use of the
  non-spec-compliant C ABI.](https://github.com/rust-lang/rust/pull/117918/)
  Use `wasm-bindgen v0.2.88` to generate forward-compatible bindings.
- [Check return types of function types for well-formedness](https://github.com/rust-lang/rust/pull/115538)</changelog>
</package>
<package pkgid="a6df5a5bc81f36f3618a9616b75c8a156ac1cf3385690c779d91be318ee4b1db" name="cargo1.80" arch="aarch64">
  <version epoch="0" ver="1.80.0" rel="150500.11.3.1"/>
  <changelog author="william.brown@suse.com" date="1721995200">Version 1.80.0 (2024-07-25)
  Language
--------
- [Document maximum allocation size](https://github.com/rust-lang/rust/pull/116675/)
- [Allow zero-byte offsets and ZST read/writes on arbitrary pointers](https://github.com/rust-lang/rust/pull/117329/)
- [Support C23's variadics without a named parameter](https://github.com/rust-lang/rust/pull/124048/)
- [Stabilize `exclusive_range_pattern` feature](https://github.com/rust-lang/rust/pull/124459/)
- [Guarantee layout and ABI of `Result` in some scenarios](https://github.com/rust-lang/rust/pull/124870)
  Compiler
--------
- [Update cc crate to v1.0.97 allowing additional spectre mitigations on MSVC targets](https://github.com/rust-lang/rust/pull/124892/)
- [Allow field reordering on types marked `repr(packed(1))`](https://github.com/rust-lang/rust/pull/125360/)
- [Add a lint against never type fallback affecting unsafe code](https://github.com/rust-lang/rust/pull/123939/)
- [Disallow cast with trailing braced macro in let-else](https://github.com/rust-lang/rust/pull/125049/)
- [Expand `for_loops_over_fallibles` lint to lint on fallibles behind references.](https://github.com/rust-lang/rust/pull/125156/)
- [self-contained linker: retry linking without `-fuse-ld=lld` on CCs that don't support it](https://github.com/rust-lang/rust/pull/125417/)
- [Do not parse CVarArgs (`...`) as a type in trait bounds](https://github.com/rust-lang/rust/pull/125863/)
- Improvements to LLDB formatting [#124458](https://github.com/rust-lang/rust/pull/124458) [#124500](https://github.com/rust-lang/rust/pull/124500)
- [For the wasm32-wasip2 target default to PIC and do not use `-fuse-ld=lld`](https://github.com/rust-lang/rust/pull/124858/)
- [Add x86_64-unknown-linux-none as a tier 3 target](https://github.com/rust-lang/rust/pull/125023/)
- [Lint on `foo.into_iter()` resolving to `&amp;Box&lt;[T]&gt;: IntoIterator`](https://github.com/rust-lang/rust/pull/124097/)
  Libraries
---------
- [Add `size_of` and `size_of_val` and `align_of` and `align_of_val` to the prelude](https://github.com/rust-lang/rust/pull/123168/)
- [Abort a process when FD ownership is violated](https://github.com/rust-lang/rust/pull/124210/)
- [io::Write::write_fmt: panic if the formatter fails when the stream does not fail](https://github.com/rust-lang/rust/pull/125012/)
- [Panic if `PathBuf::set_extension` would add a path separator](https://github.com/rust-lang/rust/pull/125070/)
- [Add assert_unsafe_precondition to unchecked_{add,sub,neg,mul,shl,shr} methods](https://github.com/rust-lang/rust/pull/121571/)
- [Update `c_char` on AIX to use the correct type](https://github.com/rust-lang/rust/pull/122986/)
- [`offset_of!` no longer returns a temporary](https://github.com/rust-lang/rust/pull/124484/)
- [Handle sigma in `str.to_lowercase` correctly](https://github.com/rust-lang/rust/pull/124773/)
- [Raise `DEFAULT_MIN_STACK_SIZE` to at least 64KiB](https://github.com/rust-lang/rust/pull/126059/)
  Stabilized APIs
- [`impl Default for Rc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3CCStr%3E)
- [`impl Default for Rc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3Cstr%3E)
- [`impl Default for Rc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3C%5BT%5D%3E)
- [`impl Default for Arc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3Cstr%3E)
- [`impl Default for Arc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3CCStr%3E)
- [`impl Default for Arc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3C%5BT%5D%3E)
- [`impl IntoIterator for Box&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-IntoIterator-for-Box%3C%5BI%5D,+A%3E)
- [`impl FromIterator&lt;String&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3CString%3E-for-Box%3Cstr%3E)
- [`impl FromIterator&lt;char&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3Cchar%3E-for-Box%3Cstr%3E)
- [`LazyCell`](https://doc.rust-lang.org/beta/core/cell/struct.LazyCell.html)
- [`LazyLock`](https://doc.rust-lang.org/beta/std/sync/struct.LazyLock.html)
- [`Duration::div_duration_f32`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f32)
- [`Duration::div_duration_f64`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f64)
- [`Option::take_if`](https://doc.rust-lang.org/beta/std/option/enum.Option.html#method.take_if)
- [`Seek::seek_relative`](https://doc.rust-lang.org/beta/std/io/trait.Seek.html#method.seek_relative)
- [`BinaryHeap::as_slice`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.as_slice)
- [`NonNull::offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset)
- [`NonNull::byte_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset)
- [`NonNull::add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.add)
- [`NonNull::byte_add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_add)
- [`NonNull::sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.sub)
- [`NonNull::byte_sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_sub)
- [`NonNull::offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset_from)
- [`NonNull::byte_offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset_from)
- [`NonNull::read`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read)
- [`NonNull::read_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_volatile)
- [`NonNull::read_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_unaligned)
- [`NonNull::write`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write)
- [`NonNull::write_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_volatile)
- [`NonNull::write_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_unaligned)
- [`NonNull::write_bytes`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_bytes)
- [`NonNull::copy_to`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to)
- [`NonNull::copy_to_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to_nonoverlapping)
- [`NonNull::copy_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from)
- [`NonNull::copy_from_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from_nonoverlapping)
- [`NonNull::replace`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.replace)
- [`NonNull::swap`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.swap)
- [`NonNull::drop_in_place`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.drop_in_place)
- [`NonNull::align_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.align_offset)
- [`&lt;[T]&gt;::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_checked)
- [`&lt;[T]&gt;::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_mut_checked)
- [`str::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_checked)
- [`str::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_mut_checked)
- [`str::trim_ascii`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii)
- [`str::trim_ascii_start`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_start)
- [`str::trim_ascii_end`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_end)
- [`&lt;[u8]&gt;::trim_ascii`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii)
- [`&lt;[u8]&gt;::trim_ascii_start`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_start)
- [`&lt;[u8]&gt;::trim_ascii_end`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_end)
- [`Ipv4Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#associatedconstant.BITS)
- [`Ipv4Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.to_bits)
- [`Ipv4Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.from_bits)
- [`Ipv6Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#associatedconstant.BITS)
- [`Ipv6Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.to_bits)
- [`Ipv6Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.from_bits)
- [`Vec::&lt;[T; N]&gt;::into_flattened`](https://doc.rust-lang.org/beta/alloc/vec/struct.Vec.html#method.into_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened_mut`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened_mut)
  These APIs are now stable in const contexts:
- [`&lt;[T]&gt;::last_chunk`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.last_chunk)
- [`BinaryHeap::new`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.new)
  Cargo
-----
- [Stabilize `-Zcheck-cfg` as always enabled](https://github.com/rust-lang/cargo/pull/13571/)
- [Warn, rather than fail publish, if a target is excluded](https://github.com/rust-lang/cargo/pull/13713/)
- [Add special `check-cfg` lint config for the `unexpected_cfgs` lint](https://github.com/rust-lang/cargo/pull/13913/)
- [Stabilize `cargo update --precise &lt;yanked&gt;`](https://github.com/rust-lang/cargo/pull/13974/)
- [Don't change file permissions on `Cargo.toml` when using `cargo add`](https://github.com/rust-lang/cargo/pull/13898/)
- [Support using `cargo fix` on IPv6-only networks](https://github.com/rust-lang/cargo/pull/13907/)
  Rustdoc
-----
- [Allow searching for references](https://github.com/rust-lang/rust/pull/124148/)
- [Stabilize `custom_code_classes_in_docs` feature](https://github.com/rust-lang/rust/pull/124577/)
- [fix: In cross-crate scenarios show enum variants on type aliases of enums](https://github.com/rust-lang/rust/pull/125300/)
  Compatibility Notes
- [rustfmt estimates line lengths differently when using non-ascii characters](https://github.com/rust-lang/rustfmt/issues/6203)
- [Type aliases are now handled correctly in orphan check](https://github.com/rust-lang/rust/pull/117164/)
- [Allow instructing rustdoc to read from stdin via `-`](https://github.com/rust-lang/rust/pull/124611/)
- [`std::env::{set_var, remove_var}` can no longer be converted to safe function pointers and no longer implement the `Fn` family of traits](https://github.com/rust-lang/rust/pull/124636)
- [Warn (or error) when `Self` constructor from outer item is referenced in inner nested item](https://github.com/rust-lang/rust/pull/124187/)
- [Turn `indirect_structural_match` and `pointer_structural_match` lints into hard errors](https://github.com/rust-lang/rust/pull/124661/)
- [Make `where_clause_object_safety` lint a regular object safety violation](https://github.com/rust-lang/rust/pull/125380/)
- [Turn `proc_macro_back_compat` lint into a hard error.](https://github.com/rust-lang/rust/pull/125596/)
- [Detect unused structs even when implementing private traits](https://github.com/rust-lang/rust/pull/122382/)
- [`std::sync::ReentrantLockGuard&lt;T&gt;` is no longer `Sync` if `T: !Sync`](https://github.com/rust-lang/rust/pull/125527) which means [`std::io::StdoutLock` and `std::io::StderrLock` are no longer Sync](https://github.com/rust-lang/rust/issues/127340)
  Internal Changes
  These changes do not affect any public interfaces of Rust, but they represent
  significant improvements to the performance or internals of rustc and related
  tools.
- Misc improvements to size of generated html by rustdoc e.g. [#124738](https://github.com/rust-lang/rust/pull/124738/) and [#123734](https://github.com/rust-lang/rust/pull/123734/)
- [MSVC targets no longer depend on libc](https://github.com/rust-lang/rust/pull/124050/)</changelog>
</package>
<package pkgid="c43d211e865afb930235bbd03597f7ff0d338c48b2a93d06a19a2012b280706c" name="cargo1.80" arch="ppc64le">
  <version epoch="0" ver="1.80.0" rel="150500.11.3.1"/>
  <changelog author="william.brown@suse.com" date="1721995200">Version 1.80.0 (2024-07-25)
  Language
--------
- [Document maximum allocation size](https://github.com/rust-lang/rust/pull/116675/)
- [Allow zero-byte offsets and ZST read/writes on arbitrary pointers](https://github.com/rust-lang/rust/pull/117329/)
- [Support C23's variadics without a named parameter](https://github.com/rust-lang/rust/pull/124048/)
- [Stabilize `exclusive_range_pattern` feature](https://github.com/rust-lang/rust/pull/124459/)
- [Guarantee layout and ABI of `Result` in some scenarios](https://github.com/rust-lang/rust/pull/124870)
  Compiler
--------
- [Update cc crate to v1.0.97 allowing additional spectre mitigations on MSVC targets](https://github.com/rust-lang/rust/pull/124892/)
- [Allow field reordering on types marked `repr(packed(1))`](https://github.com/rust-lang/rust/pull/125360/)
- [Add a lint against never type fallback affecting unsafe code](https://github.com/rust-lang/rust/pull/123939/)
- [Disallow cast with trailing braced macro in let-else](https://github.com/rust-lang/rust/pull/125049/)
- [Expand `for_loops_over_fallibles` lint to lint on fallibles behind references.](https://github.com/rust-lang/rust/pull/125156/)
- [self-contained linker: retry linking without `-fuse-ld=lld` on CCs that don't support it](https://github.com/rust-lang/rust/pull/125417/)
- [Do not parse CVarArgs (`...`) as a type in trait bounds](https://github.com/rust-lang/rust/pull/125863/)
- Improvements to LLDB formatting [#124458](https://github.com/rust-lang/rust/pull/124458) [#124500](https://github.com/rust-lang/rust/pull/124500)
- [For the wasm32-wasip2 target default to PIC and do not use `-fuse-ld=lld`](https://github.com/rust-lang/rust/pull/124858/)
- [Add x86_64-unknown-linux-none as a tier 3 target](https://github.com/rust-lang/rust/pull/125023/)
- [Lint on `foo.into_iter()` resolving to `&amp;Box&lt;[T]&gt;: IntoIterator`](https://github.com/rust-lang/rust/pull/124097/)
  Libraries
---------
- [Add `size_of` and `size_of_val` and `align_of` and `align_of_val` to the prelude](https://github.com/rust-lang/rust/pull/123168/)
- [Abort a process when FD ownership is violated](https://github.com/rust-lang/rust/pull/124210/)
- [io::Write::write_fmt: panic if the formatter fails when the stream does not fail](https://github.com/rust-lang/rust/pull/125012/)
- [Panic if `PathBuf::set_extension` would add a path separator](https://github.com/rust-lang/rust/pull/125070/)
- [Add assert_unsafe_precondition to unchecked_{add,sub,neg,mul,shl,shr} methods](https://github.com/rust-lang/rust/pull/121571/)
- [Update `c_char` on AIX to use the correct type](https://github.com/rust-lang/rust/pull/122986/)
- [`offset_of!` no longer returns a temporary](https://github.com/rust-lang/rust/pull/124484/)
- [Handle sigma in `str.to_lowercase` correctly](https://github.com/rust-lang/rust/pull/124773/)
- [Raise `DEFAULT_MIN_STACK_SIZE` to at least 64KiB](https://github.com/rust-lang/rust/pull/126059/)
  Stabilized APIs
- [`impl Default for Rc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3CCStr%3E)
- [`impl Default for Rc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3Cstr%3E)
- [`impl Default for Rc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3C%5BT%5D%3E)
- [`impl Default for Arc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3Cstr%3E)
- [`impl Default for Arc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3CCStr%3E)
- [`impl Default for Arc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3C%5BT%5D%3E)
- [`impl IntoIterator for Box&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-IntoIterator-for-Box%3C%5BI%5D,+A%3E)
- [`impl FromIterator&lt;String&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3CString%3E-for-Box%3Cstr%3E)
- [`impl FromIterator&lt;char&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3Cchar%3E-for-Box%3Cstr%3E)
- [`LazyCell`](https://doc.rust-lang.org/beta/core/cell/struct.LazyCell.html)
- [`LazyLock`](https://doc.rust-lang.org/beta/std/sync/struct.LazyLock.html)
- [`Duration::div_duration_f32`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f32)
- [`Duration::div_duration_f64`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f64)
- [`Option::take_if`](https://doc.rust-lang.org/beta/std/option/enum.Option.html#method.take_if)
- [`Seek::seek_relative`](https://doc.rust-lang.org/beta/std/io/trait.Seek.html#method.seek_relative)
- [`BinaryHeap::as_slice`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.as_slice)
- [`NonNull::offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset)
- [`NonNull::byte_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset)
- [`NonNull::add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.add)
- [`NonNull::byte_add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_add)
- [`NonNull::sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.sub)
- [`NonNull::byte_sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_sub)
- [`NonNull::offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset_from)
- [`NonNull::byte_offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset_from)
- [`NonNull::read`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read)
- [`NonNull::read_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_volatile)
- [`NonNull::read_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_unaligned)
- [`NonNull::write`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write)
- [`NonNull::write_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_volatile)
- [`NonNull::write_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_unaligned)
- [`NonNull::write_bytes`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_bytes)
- [`NonNull::copy_to`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to)
- [`NonNull::copy_to_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to_nonoverlapping)
- [`NonNull::copy_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from)
- [`NonNull::copy_from_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from_nonoverlapping)
- [`NonNull::replace`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.replace)
- [`NonNull::swap`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.swap)
- [`NonNull::drop_in_place`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.drop_in_place)
- [`NonNull::align_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.align_offset)
- [`&lt;[T]&gt;::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_checked)
- [`&lt;[T]&gt;::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_mut_checked)
- [`str::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_checked)
- [`str::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_mut_checked)
- [`str::trim_ascii`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii)
- [`str::trim_ascii_start`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_start)
- [`str::trim_ascii_end`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_end)
- [`&lt;[u8]&gt;::trim_ascii`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii)
- [`&lt;[u8]&gt;::trim_ascii_start`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_start)
- [`&lt;[u8]&gt;::trim_ascii_end`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_end)
- [`Ipv4Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#associatedconstant.BITS)
- [`Ipv4Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.to_bits)
- [`Ipv4Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.from_bits)
- [`Ipv6Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#associatedconstant.BITS)
- [`Ipv6Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.to_bits)
- [`Ipv6Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.from_bits)
- [`Vec::&lt;[T; N]&gt;::into_flattened`](https://doc.rust-lang.org/beta/alloc/vec/struct.Vec.html#method.into_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened_mut`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened_mut)
  These APIs are now stable in const contexts:
- [`&lt;[T]&gt;::last_chunk`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.last_chunk)
- [`BinaryHeap::new`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.new)
  Cargo
-----
- [Stabilize `-Zcheck-cfg` as always enabled](https://github.com/rust-lang/cargo/pull/13571/)
- [Warn, rather than fail publish, if a target is excluded](https://github.com/rust-lang/cargo/pull/13713/)
- [Add special `check-cfg` lint config for the `unexpected_cfgs` lint](https://github.com/rust-lang/cargo/pull/13913/)
- [Stabilize `cargo update --precise &lt;yanked&gt;`](https://github.com/rust-lang/cargo/pull/13974/)
- [Don't change file permissions on `Cargo.toml` when using `cargo add`](https://github.com/rust-lang/cargo/pull/13898/)
- [Support using `cargo fix` on IPv6-only networks](https://github.com/rust-lang/cargo/pull/13907/)
  Rustdoc
-----
- [Allow searching for references](https://github.com/rust-lang/rust/pull/124148/)
- [Stabilize `custom_code_classes_in_docs` feature](https://github.com/rust-lang/rust/pull/124577/)
- [fix: In cross-crate scenarios show enum variants on type aliases of enums](https://github.com/rust-lang/rust/pull/125300/)
  Compatibility Notes
- [rustfmt estimates line lengths differently when using non-ascii characters](https://github.com/rust-lang/rustfmt/issues/6203)
- [Type aliases are now handled correctly in orphan check](https://github.com/rust-lang/rust/pull/117164/)
- [Allow instructing rustdoc to read from stdin via `-`](https://github.com/rust-lang/rust/pull/124611/)
- [`std::env::{set_var, remove_var}` can no longer be converted to safe function pointers and no longer implement the `Fn` family of traits](https://github.com/rust-lang/rust/pull/124636)
- [Warn (or error) when `Self` constructor from outer item is referenced in inner nested item](https://github.com/rust-lang/rust/pull/124187/)
- [Turn `indirect_structural_match` and `pointer_structural_match` lints into hard errors](https://github.com/rust-lang/rust/pull/124661/)
- [Make `where_clause_object_safety` lint a regular object safety violation](https://github.com/rust-lang/rust/pull/125380/)
- [Turn `proc_macro_back_compat` lint into a hard error.](https://github.com/rust-lang/rust/pull/125596/)
- [Detect unused structs even when implementing private traits](https://github.com/rust-lang/rust/pull/122382/)
- [`std::sync::ReentrantLockGuard&lt;T&gt;` is no longer `Sync` if `T: !Sync`](https://github.com/rust-lang/rust/pull/125527) which means [`std::io::StdoutLock` and `std::io::StderrLock` are no longer Sync](https://github.com/rust-lang/rust/issues/127340)
  Internal Changes
  These changes do not affect any public interfaces of Rust, but they represent
  significant improvements to the performance or internals of rustc and related
  tools.
- Misc improvements to size of generated html by rustdoc e.g. [#124738](https://github.com/rust-lang/rust/pull/124738/) and [#123734](https://github.com/rust-lang/rust/pull/123734/)
- [MSVC targets no longer depend on libc](https://github.com/rust-lang/rust/pull/124050/)</changelog>
</package>
<package pkgid="131abeb7de6b338f2488723be1fca584014f39b393ac0f1e41bc8c431de7a4c0" name="cargo1.80" arch="s390x">
  <version epoch="0" ver="1.80.0" rel="150500.11.3.1"/>
  <changelog author="william.brown@suse.com" date="1721995200">Version 1.80.0 (2024-07-25)
  Language
--------
- [Document maximum allocation size](https://github.com/rust-lang/rust/pull/116675/)
- [Allow zero-byte offsets and ZST read/writes on arbitrary pointers](https://github.com/rust-lang/rust/pull/117329/)
- [Support C23's variadics without a named parameter](https://github.com/rust-lang/rust/pull/124048/)
- [Stabilize `exclusive_range_pattern` feature](https://github.com/rust-lang/rust/pull/124459/)
- [Guarantee layout and ABI of `Result` in some scenarios](https://github.com/rust-lang/rust/pull/124870)
  Compiler
--------
- [Update cc crate to v1.0.97 allowing additional spectre mitigations on MSVC targets](https://github.com/rust-lang/rust/pull/124892/)
- [Allow field reordering on types marked `repr(packed(1))`](https://github.com/rust-lang/rust/pull/125360/)
- [Add a lint against never type fallback affecting unsafe code](https://github.com/rust-lang/rust/pull/123939/)
- [Disallow cast with trailing braced macro in let-else](https://github.com/rust-lang/rust/pull/125049/)
- [Expand `for_loops_over_fallibles` lint to lint on fallibles behind references.](https://github.com/rust-lang/rust/pull/125156/)
- [self-contained linker: retry linking without `-fuse-ld=lld` on CCs that don't support it](https://github.com/rust-lang/rust/pull/125417/)
- [Do not parse CVarArgs (`...`) as a type in trait bounds](https://github.com/rust-lang/rust/pull/125863/)
- Improvements to LLDB formatting [#124458](https://github.com/rust-lang/rust/pull/124458) [#124500](https://github.com/rust-lang/rust/pull/124500)
- [For the wasm32-wasip2 target default to PIC and do not use `-fuse-ld=lld`](https://github.com/rust-lang/rust/pull/124858/)
- [Add x86_64-unknown-linux-none as a tier 3 target](https://github.com/rust-lang/rust/pull/125023/)
- [Lint on `foo.into_iter()` resolving to `&amp;Box&lt;[T]&gt;: IntoIterator`](https://github.com/rust-lang/rust/pull/124097/)
  Libraries
---------
- [Add `size_of` and `size_of_val` and `align_of` and `align_of_val` to the prelude](https://github.com/rust-lang/rust/pull/123168/)
- [Abort a process when FD ownership is violated](https://github.com/rust-lang/rust/pull/124210/)
- [io::Write::write_fmt: panic if the formatter fails when the stream does not fail](https://github.com/rust-lang/rust/pull/125012/)
- [Panic if `PathBuf::set_extension` would add a path separator](https://github.com/rust-lang/rust/pull/125070/)
- [Add assert_unsafe_precondition to unchecked_{add,sub,neg,mul,shl,shr} methods](https://github.com/rust-lang/rust/pull/121571/)
- [Update `c_char` on AIX to use the correct type](https://github.com/rust-lang/rust/pull/122986/)
- [`offset_of!` no longer returns a temporary](https://github.com/rust-lang/rust/pull/124484/)
- [Handle sigma in `str.to_lowercase` correctly](https://github.com/rust-lang/rust/pull/124773/)
- [Raise `DEFAULT_MIN_STACK_SIZE` to at least 64KiB](https://github.com/rust-lang/rust/pull/126059/)
  Stabilized APIs
- [`impl Default for Rc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3CCStr%3E)
- [`impl Default for Rc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3Cstr%3E)
- [`impl Default for Rc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3C%5BT%5D%3E)
- [`impl Default for Arc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3Cstr%3E)
- [`impl Default for Arc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3CCStr%3E)
- [`impl Default for Arc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3C%5BT%5D%3E)
- [`impl IntoIterator for Box&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-IntoIterator-for-Box%3C%5BI%5D,+A%3E)
- [`impl FromIterator&lt;String&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3CString%3E-for-Box%3Cstr%3E)
- [`impl FromIterator&lt;char&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3Cchar%3E-for-Box%3Cstr%3E)
- [`LazyCell`](https://doc.rust-lang.org/beta/core/cell/struct.LazyCell.html)
- [`LazyLock`](https://doc.rust-lang.org/beta/std/sync/struct.LazyLock.html)
- [`Duration::div_duration_f32`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f32)
- [`Duration::div_duration_f64`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f64)
- [`Option::take_if`](https://doc.rust-lang.org/beta/std/option/enum.Option.html#method.take_if)
- [`Seek::seek_relative`](https://doc.rust-lang.org/beta/std/io/trait.Seek.html#method.seek_relative)
- [`BinaryHeap::as_slice`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.as_slice)
- [`NonNull::offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset)
- [`NonNull::byte_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset)
- [`NonNull::add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.add)
- [`NonNull::byte_add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_add)
- [`NonNull::sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.sub)
- [`NonNull::byte_sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_sub)
- [`NonNull::offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset_from)
- [`NonNull::byte_offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset_from)
- [`NonNull::read`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read)
- [`NonNull::read_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_volatile)
- [`NonNull::read_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_unaligned)
- [`NonNull::write`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write)
- [`NonNull::write_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_volatile)
- [`NonNull::write_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_unaligned)
- [`NonNull::write_bytes`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_bytes)
- [`NonNull::copy_to`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to)
- [`NonNull::copy_to_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to_nonoverlapping)
- [`NonNull::copy_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from)
- [`NonNull::copy_from_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from_nonoverlapping)
- [`NonNull::replace`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.replace)
- [`NonNull::swap`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.swap)
- [`NonNull::drop_in_place`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.drop_in_place)
- [`NonNull::align_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.align_offset)
- [`&lt;[T]&gt;::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_checked)
- [`&lt;[T]&gt;::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_mut_checked)
- [`str::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_checked)
- [`str::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_mut_checked)
- [`str::trim_ascii`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii)
- [`str::trim_ascii_start`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_start)
- [`str::trim_ascii_end`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_end)
- [`&lt;[u8]&gt;::trim_ascii`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii)
- [`&lt;[u8]&gt;::trim_ascii_start`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_start)
- [`&lt;[u8]&gt;::trim_ascii_end`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_end)
- [`Ipv4Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#associatedconstant.BITS)
- [`Ipv4Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.to_bits)
- [`Ipv4Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.from_bits)
- [`Ipv6Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#associatedconstant.BITS)
- [`Ipv6Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.to_bits)
- [`Ipv6Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.from_bits)
- [`Vec::&lt;[T; N]&gt;::into_flattened`](https://doc.rust-lang.org/beta/alloc/vec/struct.Vec.html#method.into_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened_mut`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened_mut)
  These APIs are now stable in const contexts:
- [`&lt;[T]&gt;::last_chunk`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.last_chunk)
- [`BinaryHeap::new`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.new)
  Cargo
-----
- [Stabilize `-Zcheck-cfg` as always enabled](https://github.com/rust-lang/cargo/pull/13571/)
- [Warn, rather than fail publish, if a target is excluded](https://github.com/rust-lang/cargo/pull/13713/)
- [Add special `check-cfg` lint config for the `unexpected_cfgs` lint](https://github.com/rust-lang/cargo/pull/13913/)
- [Stabilize `cargo update --precise &lt;yanked&gt;`](https://github.com/rust-lang/cargo/pull/13974/)
- [Don't change file permissions on `Cargo.toml` when using `cargo add`](https://github.com/rust-lang/cargo/pull/13898/)
- [Support using `cargo fix` on IPv6-only networks](https://github.com/rust-lang/cargo/pull/13907/)
  Rustdoc
-----
- [Allow searching for references](https://github.com/rust-lang/rust/pull/124148/)
- [Stabilize `custom_code_classes_in_docs` feature](https://github.com/rust-lang/rust/pull/124577/)
- [fix: In cross-crate scenarios show enum variants on type aliases of enums](https://github.com/rust-lang/rust/pull/125300/)
  Compatibility Notes
- [rustfmt estimates line lengths differently when using non-ascii characters](https://github.com/rust-lang/rustfmt/issues/6203)
- [Type aliases are now handled correctly in orphan check](https://github.com/rust-lang/rust/pull/117164/)
- [Allow instructing rustdoc to read from stdin via `-`](https://github.com/rust-lang/rust/pull/124611/)
- [`std::env::{set_var, remove_var}` can no longer be converted to safe function pointers and no longer implement the `Fn` family of traits](https://github.com/rust-lang/rust/pull/124636)
- [Warn (or error) when `Self` constructor from outer item is referenced in inner nested item](https://github.com/rust-lang/rust/pull/124187/)
- [Turn `indirect_structural_match` and `pointer_structural_match` lints into hard errors](https://github.com/rust-lang/rust/pull/124661/)
- [Make `where_clause_object_safety` lint a regular object safety violation](https://github.com/rust-lang/rust/pull/125380/)
- [Turn `proc_macro_back_compat` lint into a hard error.](https://github.com/rust-lang/rust/pull/125596/)
- [Detect unused structs even when implementing private traits](https://github.com/rust-lang/rust/pull/122382/)
- [`std::sync::ReentrantLockGuard&lt;T&gt;` is no longer `Sync` if `T: !Sync`](https://github.com/rust-lang/rust/pull/125527) which means [`std::io::StdoutLock` and `std::io::StderrLock` are no longer Sync](https://github.com/rust-lang/rust/issues/127340)
  Internal Changes
  These changes do not affect any public interfaces of Rust, but they represent
  significant improvements to the performance or internals of rustc and related
  tools.
- Misc improvements to size of generated html by rustdoc e.g. [#124738](https://github.com/rust-lang/rust/pull/124738/) and [#123734](https://github.com/rust-lang/rust/pull/123734/)
- [MSVC targets no longer depend on libc](https://github.com/rust-lang/rust/pull/124050/)</changelog>
</package>
<package pkgid="cf747767ff62d519e8ff16c384e7d0658caf94d966a121e3079305ef07fb0881" name="cargo1.80" arch="x86_64">
  <version epoch="0" ver="1.80.0" rel="150500.11.3.1"/>
  <changelog author="william.brown@suse.com" date="1721995200">Version 1.80.0 (2024-07-25)
  Language
--------
- [Document maximum allocation size](https://github.com/rust-lang/rust/pull/116675/)
- [Allow zero-byte offsets and ZST read/writes on arbitrary pointers](https://github.com/rust-lang/rust/pull/117329/)
- [Support C23's variadics without a named parameter](https://github.com/rust-lang/rust/pull/124048/)
- [Stabilize `exclusive_range_pattern` feature](https://github.com/rust-lang/rust/pull/124459/)
- [Guarantee layout and ABI of `Result` in some scenarios](https://github.com/rust-lang/rust/pull/124870)
  Compiler
--------
- [Update cc crate to v1.0.97 allowing additional spectre mitigations on MSVC targets](https://github.com/rust-lang/rust/pull/124892/)
- [Allow field reordering on types marked `repr(packed(1))`](https://github.com/rust-lang/rust/pull/125360/)
- [Add a lint against never type fallback affecting unsafe code](https://github.com/rust-lang/rust/pull/123939/)
- [Disallow cast with trailing braced macro in let-else](https://github.com/rust-lang/rust/pull/125049/)
- [Expand `for_loops_over_fallibles` lint to lint on fallibles behind references.](https://github.com/rust-lang/rust/pull/125156/)
- [self-contained linker: retry linking without `-fuse-ld=lld` on CCs that don't support it](https://github.com/rust-lang/rust/pull/125417/)
- [Do not parse CVarArgs (`...`) as a type in trait bounds](https://github.com/rust-lang/rust/pull/125863/)
- Improvements to LLDB formatting [#124458](https://github.com/rust-lang/rust/pull/124458) [#124500](https://github.com/rust-lang/rust/pull/124500)
- [For the wasm32-wasip2 target default to PIC and do not use `-fuse-ld=lld`](https://github.com/rust-lang/rust/pull/124858/)
- [Add x86_64-unknown-linux-none as a tier 3 target](https://github.com/rust-lang/rust/pull/125023/)
- [Lint on `foo.into_iter()` resolving to `&amp;Box&lt;[T]&gt;: IntoIterator`](https://github.com/rust-lang/rust/pull/124097/)
  Libraries
---------
- [Add `size_of` and `size_of_val` and `align_of` and `align_of_val` to the prelude](https://github.com/rust-lang/rust/pull/123168/)
- [Abort a process when FD ownership is violated](https://github.com/rust-lang/rust/pull/124210/)
- [io::Write::write_fmt: panic if the formatter fails when the stream does not fail](https://github.com/rust-lang/rust/pull/125012/)
- [Panic if `PathBuf::set_extension` would add a path separator](https://github.com/rust-lang/rust/pull/125070/)
- [Add assert_unsafe_precondition to unchecked_{add,sub,neg,mul,shl,shr} methods](https://github.com/rust-lang/rust/pull/121571/)
- [Update `c_char` on AIX to use the correct type](https://github.com/rust-lang/rust/pull/122986/)
- [`offset_of!` no longer returns a temporary](https://github.com/rust-lang/rust/pull/124484/)
- [Handle sigma in `str.to_lowercase` correctly](https://github.com/rust-lang/rust/pull/124773/)
- [Raise `DEFAULT_MIN_STACK_SIZE` to at least 64KiB](https://github.com/rust-lang/rust/pull/126059/)
  Stabilized APIs
- [`impl Default for Rc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3CCStr%3E)
- [`impl Default for Rc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3Cstr%3E)
- [`impl Default for Rc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3C%5BT%5D%3E)
- [`impl Default for Arc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3Cstr%3E)
- [`impl Default for Arc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3CCStr%3E)
- [`impl Default for Arc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3C%5BT%5D%3E)
- [`impl IntoIterator for Box&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-IntoIterator-for-Box%3C%5BI%5D,+A%3E)
- [`impl FromIterator&lt;String&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3CString%3E-for-Box%3Cstr%3E)
- [`impl FromIterator&lt;char&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3Cchar%3E-for-Box%3Cstr%3E)
- [`LazyCell`](https://doc.rust-lang.org/beta/core/cell/struct.LazyCell.html)
- [`LazyLock`](https://doc.rust-lang.org/beta/std/sync/struct.LazyLock.html)
- [`Duration::div_duration_f32`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f32)
- [`Duration::div_duration_f64`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f64)
- [`Option::take_if`](https://doc.rust-lang.org/beta/std/option/enum.Option.html#method.take_if)
- [`Seek::seek_relative`](https://doc.rust-lang.org/beta/std/io/trait.Seek.html#method.seek_relative)
- [`BinaryHeap::as_slice`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.as_slice)
- [`NonNull::offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset)
- [`NonNull::byte_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset)
- [`NonNull::add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.add)
- [`NonNull::byte_add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_add)
- [`NonNull::sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.sub)
- [`NonNull::byte_sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_sub)
- [`NonNull::offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset_from)
- [`NonNull::byte_offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset_from)
- [`NonNull::read`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read)
- [`NonNull::read_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_volatile)
- [`NonNull::read_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_unaligned)
- [`NonNull::write`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write)
- [`NonNull::write_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_volatile)
- [`NonNull::write_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_unaligned)
- [`NonNull::write_bytes`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_bytes)
- [`NonNull::copy_to`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to)
- [`NonNull::copy_to_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to_nonoverlapping)
- [`NonNull::copy_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from)
- [`NonNull::copy_from_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from_nonoverlapping)
- [`NonNull::replace`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.replace)
- [`NonNull::swap`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.swap)
- [`NonNull::drop_in_place`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.drop_in_place)
- [`NonNull::align_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.align_offset)
- [`&lt;[T]&gt;::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_checked)
- [`&lt;[T]&gt;::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_mut_checked)
- [`str::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_checked)
- [`str::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_mut_checked)
- [`str::trim_ascii`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii)
- [`str::trim_ascii_start`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_start)
- [`str::trim_ascii_end`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_end)
- [`&lt;[u8]&gt;::trim_ascii`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii)
- [`&lt;[u8]&gt;::trim_ascii_start`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_start)
- [`&lt;[u8]&gt;::trim_ascii_end`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_end)
- [`Ipv4Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#associatedconstant.BITS)
- [`Ipv4Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.to_bits)
- [`Ipv4Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.from_bits)
- [`Ipv6Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#associatedconstant.BITS)
- [`Ipv6Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.to_bits)
- [`Ipv6Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.from_bits)
- [`Vec::&lt;[T; N]&gt;::into_flattened`](https://doc.rust-lang.org/beta/alloc/vec/struct.Vec.html#method.into_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened_mut`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened_mut)
  These APIs are now stable in const contexts:
- [`&lt;[T]&gt;::last_chunk`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.last_chunk)
- [`BinaryHeap::new`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.new)
  Cargo
-----
- [Stabilize `-Zcheck-cfg` as always enabled](https://github.com/rust-lang/cargo/pull/13571/)
- [Warn, rather than fail publish, if a target is excluded](https://github.com/rust-lang/cargo/pull/13713/)
- [Add special `check-cfg` lint config for the `unexpected_cfgs` lint](https://github.com/rust-lang/cargo/pull/13913/)
- [Stabilize `cargo update --precise &lt;yanked&gt;`](https://github.com/rust-lang/cargo/pull/13974/)
- [Don't change file permissions on `Cargo.toml` when using `cargo add`](https://github.com/rust-lang/cargo/pull/13898/)
- [Support using `cargo fix` on IPv6-only networks](https://github.com/rust-lang/cargo/pull/13907/)
  Rustdoc
-----
- [Allow searching for references](https://github.com/rust-lang/rust/pull/124148/)
- [Stabilize `custom_code_classes_in_docs` feature](https://github.com/rust-lang/rust/pull/124577/)
- [fix: In cross-crate scenarios show enum variants on type aliases of enums](https://github.com/rust-lang/rust/pull/125300/)
  Compatibility Notes
- [rustfmt estimates line lengths differently when using non-ascii characters](https://github.com/rust-lang/rustfmt/issues/6203)
- [Type aliases are now handled correctly in orphan check](https://github.com/rust-lang/rust/pull/117164/)
- [Allow instructing rustdoc to read from stdin via `-`](https://github.com/rust-lang/rust/pull/124611/)
- [`std::env::{set_var, remove_var}` can no longer be converted to safe function pointers and no longer implement the `Fn` family of traits](https://github.com/rust-lang/rust/pull/124636)
- [Warn (or error) when `Self` constructor from outer item is referenced in inner nested item](https://github.com/rust-lang/rust/pull/124187/)
- [Turn `indirect_structural_match` and `pointer_structural_match` lints into hard errors](https://github.com/rust-lang/rust/pull/124661/)
- [Make `where_clause_object_safety` lint a regular object safety violation](https://github.com/rust-lang/rust/pull/125380/)
- [Turn `proc_macro_back_compat` lint into a hard error.](https://github.com/rust-lang/rust/pull/125596/)
- [Detect unused structs even when implementing private traits](https://github.com/rust-lang/rust/pull/122382/)
- [`std::sync::ReentrantLockGuard&lt;T&gt;` is no longer `Sync` if `T: !Sync`](https://github.com/rust-lang/rust/pull/125527) which means [`std::io::StdoutLock` and `std::io::StderrLock` are no longer Sync](https://github.com/rust-lang/rust/issues/127340)
  Internal Changes
  These changes do not affect any public interfaces of Rust, but they represent
  significant improvements to the performance or internals of rustc and related
  tools.
- Misc improvements to size of generated html by rustdoc e.g. [#124738](https://github.com/rust-lang/rust/pull/124738/) and [#123734](https://github.com/rust-lang/rust/pull/123734/)
- [MSVC targets no longer depend on libc](https://github.com/rust-lang/rust/pull/124050/)</changelog>
</package>
<package pkgid="5d12cd4ba0de8f94202a015d953c2d7697233c0bbd4d827591e48853c74a2626" name="cargo1.80" arch="aarch64">
  <version epoch="0" ver="1.80.1" rel="150500.11.6.1"/>
  <changelog author="william.brown@suse.com" date="1721995200">Version 1.80.0 (2024-07-25)
  Language
--------
- [Document maximum allocation size](https://github.com/rust-lang/rust/pull/116675/)
- [Allow zero-byte offsets and ZST read/writes on arbitrary pointers](https://github.com/rust-lang/rust/pull/117329/)
- [Support C23's variadics without a named parameter](https://github.com/rust-lang/rust/pull/124048/)
- [Stabilize `exclusive_range_pattern` feature](https://github.com/rust-lang/rust/pull/124459/)
- [Guarantee layout and ABI of `Result` in some scenarios](https://github.com/rust-lang/rust/pull/124870)
  Compiler
--------
- [Update cc crate to v1.0.97 allowing additional spectre mitigations on MSVC targets](https://github.com/rust-lang/rust/pull/124892/)
- [Allow field reordering on types marked `repr(packed(1))`](https://github.com/rust-lang/rust/pull/125360/)
- [Add a lint against never type fallback affecting unsafe code](https://github.com/rust-lang/rust/pull/123939/)
- [Disallow cast with trailing braced macro in let-else](https://github.com/rust-lang/rust/pull/125049/)
- [Expand `for_loops_over_fallibles` lint to lint on fallibles behind references.](https://github.com/rust-lang/rust/pull/125156/)
- [self-contained linker: retry linking without `-fuse-ld=lld` on CCs that don't support it](https://github.com/rust-lang/rust/pull/125417/)
- [Do not parse CVarArgs (`...`) as a type in trait bounds](https://github.com/rust-lang/rust/pull/125863/)
- Improvements to LLDB formatting [#124458](https://github.com/rust-lang/rust/pull/124458) [#124500](https://github.com/rust-lang/rust/pull/124500)
- [For the wasm32-wasip2 target default to PIC and do not use `-fuse-ld=lld`](https://github.com/rust-lang/rust/pull/124858/)
- [Add x86_64-unknown-linux-none as a tier 3 target](https://github.com/rust-lang/rust/pull/125023/)
- [Lint on `foo.into_iter()` resolving to `&amp;Box&lt;[T]&gt;: IntoIterator`](https://github.com/rust-lang/rust/pull/124097/)
  Libraries
---------
- [Add `size_of` and `size_of_val` and `align_of` and `align_of_val` to the prelude](https://github.com/rust-lang/rust/pull/123168/)
- [Abort a process when FD ownership is violated](https://github.com/rust-lang/rust/pull/124210/)
- [io::Write::write_fmt: panic if the formatter fails when the stream does not fail](https://github.com/rust-lang/rust/pull/125012/)
- [Panic if `PathBuf::set_extension` would add a path separator](https://github.com/rust-lang/rust/pull/125070/)
- [Add assert_unsafe_precondition to unchecked_{add,sub,neg,mul,shl,shr} methods](https://github.com/rust-lang/rust/pull/121571/)
- [Update `c_char` on AIX to use the correct type](https://github.com/rust-lang/rust/pull/122986/)
- [`offset_of!` no longer returns a temporary](https://github.com/rust-lang/rust/pull/124484/)
- [Handle sigma in `str.to_lowercase` correctly](https://github.com/rust-lang/rust/pull/124773/)
- [Raise `DEFAULT_MIN_STACK_SIZE` to at least 64KiB](https://github.com/rust-lang/rust/pull/126059/)
  Stabilized APIs
- [`impl Default for Rc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3CCStr%3E)
- [`impl Default for Rc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3Cstr%3E)
- [`impl Default for Rc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3C%5BT%5D%3E)
- [`impl Default for Arc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3Cstr%3E)
- [`impl Default for Arc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3CCStr%3E)
- [`impl Default for Arc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3C%5BT%5D%3E)
- [`impl IntoIterator for Box&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-IntoIterator-for-Box%3C%5BI%5D,+A%3E)
- [`impl FromIterator&lt;String&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3CString%3E-for-Box%3Cstr%3E)
- [`impl FromIterator&lt;char&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3Cchar%3E-for-Box%3Cstr%3E)
- [`LazyCell`](https://doc.rust-lang.org/beta/core/cell/struct.LazyCell.html)
- [`LazyLock`](https://doc.rust-lang.org/beta/std/sync/struct.LazyLock.html)
- [`Duration::div_duration_f32`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f32)
- [`Duration::div_duration_f64`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f64)
- [`Option::take_if`](https://doc.rust-lang.org/beta/std/option/enum.Option.html#method.take_if)
- [`Seek::seek_relative`](https://doc.rust-lang.org/beta/std/io/trait.Seek.html#method.seek_relative)
- [`BinaryHeap::as_slice`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.as_slice)
- [`NonNull::offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset)
- [`NonNull::byte_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset)
- [`NonNull::add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.add)
- [`NonNull::byte_add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_add)
- [`NonNull::sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.sub)
- [`NonNull::byte_sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_sub)
- [`NonNull::offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset_from)
- [`NonNull::byte_offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset_from)
- [`NonNull::read`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read)
- [`NonNull::read_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_volatile)
- [`NonNull::read_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_unaligned)
- [`NonNull::write`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write)
- [`NonNull::write_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_volatile)
- [`NonNull::write_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_unaligned)
- [`NonNull::write_bytes`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_bytes)
- [`NonNull::copy_to`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to)
- [`NonNull::copy_to_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to_nonoverlapping)
- [`NonNull::copy_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from)
- [`NonNull::copy_from_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from_nonoverlapping)
- [`NonNull::replace`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.replace)
- [`NonNull::swap`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.swap)
- [`NonNull::drop_in_place`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.drop_in_place)
- [`NonNull::align_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.align_offset)
- [`&lt;[T]&gt;::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_checked)
- [`&lt;[T]&gt;::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_mut_checked)
- [`str::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_checked)
- [`str::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_mut_checked)
- [`str::trim_ascii`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii)
- [`str::trim_ascii_start`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_start)
- [`str::trim_ascii_end`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_end)
- [`&lt;[u8]&gt;::trim_ascii`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii)
- [`&lt;[u8]&gt;::trim_ascii_start`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_start)
- [`&lt;[u8]&gt;::trim_ascii_end`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_end)
- [`Ipv4Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#associatedconstant.BITS)
- [`Ipv4Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.to_bits)
- [`Ipv4Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.from_bits)
- [`Ipv6Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#associatedconstant.BITS)
- [`Ipv6Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.to_bits)
- [`Ipv6Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.from_bits)
- [`Vec::&lt;[T; N]&gt;::into_flattened`](https://doc.rust-lang.org/beta/alloc/vec/struct.Vec.html#method.into_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened_mut`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened_mut)
  These APIs are now stable in const contexts:
- [`&lt;[T]&gt;::last_chunk`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.last_chunk)
- [`BinaryHeap::new`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.new)
  Cargo
-----
- [Stabilize `-Zcheck-cfg` as always enabled](https://github.com/rust-lang/cargo/pull/13571/)
- [Warn, rather than fail publish, if a target is excluded](https://github.com/rust-lang/cargo/pull/13713/)
- [Add special `check-cfg` lint config for the `unexpected_cfgs` lint](https://github.com/rust-lang/cargo/pull/13913/)
- [Stabilize `cargo update --precise &lt;yanked&gt;`](https://github.com/rust-lang/cargo/pull/13974/)
- [Don't change file permissions on `Cargo.toml` when using `cargo add`](https://github.com/rust-lang/cargo/pull/13898/)
- [Support using `cargo fix` on IPv6-only networks](https://github.com/rust-lang/cargo/pull/13907/)
  Rustdoc
-----
- [Allow searching for references](https://github.com/rust-lang/rust/pull/124148/)
- [Stabilize `custom_code_classes_in_docs` feature](https://github.com/rust-lang/rust/pull/124577/)
- [fix: In cross-crate scenarios show enum variants on type aliases of enums](https://github.com/rust-lang/rust/pull/125300/)
  Compatibility Notes
- [rustfmt estimates line lengths differently when using non-ascii characters](https://github.com/rust-lang/rustfmt/issues/6203)
- [Type aliases are now handled correctly in orphan check](https://github.com/rust-lang/rust/pull/117164/)
- [Allow instructing rustdoc to read from stdin via `-`](https://github.com/rust-lang/rust/pull/124611/)
- [`std::env::{set_var, remove_var}` can no longer be converted to safe function pointers and no longer implement the `Fn` family of traits](https://github.com/rust-lang/rust/pull/124636)
- [Warn (or error) when `Self` constructor from outer item is referenced in inner nested item](https://github.com/rust-lang/rust/pull/124187/)
- [Turn `indirect_structural_match` and `pointer_structural_match` lints into hard errors](https://github.com/rust-lang/rust/pull/124661/)
- [Make `where_clause_object_safety` lint a regular object safety violation](https://github.com/rust-lang/rust/pull/125380/)
- [Turn `proc_macro_back_compat` lint into a hard error.](https://github.com/rust-lang/rust/pull/125596/)
- [Detect unused structs even when implementing private traits](https://github.com/rust-lang/rust/pull/122382/)
- [`std::sync::ReentrantLockGuard&lt;T&gt;` is no longer `Sync` if `T: !Sync`](https://github.com/rust-lang/rust/pull/125527) which means [`std::io::StdoutLock` and `std::io::StderrLock` are no longer Sync](https://github.com/rust-lang/rust/issues/127340)
  Internal Changes
  These changes do not affect any public interfaces of Rust, but they represent
  significant improvements to the performance or internals of rustc and related
  tools.
- Misc improvements to size of generated html by rustdoc e.g. [#124738](https://github.com/rust-lang/rust/pull/124738/) and [#123734](https://github.com/rust-lang/rust/pull/123734/)
- [MSVC targets no longer depend on libc](https://github.com/rust-lang/rust/pull/124050/)</changelog>
  <changelog author="william.brown@suse.com" date="1723204800">Version 1.80.1 (2024-08-08)
- [Fix miscompilation in the jump threading MIR optimization when comparing floats](https://github.com/rust-lang/rust/pull/128271)
- [Revert changes to the `dead_code` lint from 1.80.0](https://github.com/rust-lang/rust/pull/128618)</changelog>
</package>
<package pkgid="ddd4a568924a3408c242b5795854c08b20ff854bfff30e2c20f088151b74dbd3" name="cargo1.80" arch="ppc64le">
  <version epoch="0" ver="1.80.1" rel="150500.11.6.1"/>
  <changelog author="william.brown@suse.com" date="1721995200">Version 1.80.0 (2024-07-25)
  Language
--------
- [Document maximum allocation size](https://github.com/rust-lang/rust/pull/116675/)
- [Allow zero-byte offsets and ZST read/writes on arbitrary pointers](https://github.com/rust-lang/rust/pull/117329/)
- [Support C23's variadics without a named parameter](https://github.com/rust-lang/rust/pull/124048/)
- [Stabilize `exclusive_range_pattern` feature](https://github.com/rust-lang/rust/pull/124459/)
- [Guarantee layout and ABI of `Result` in some scenarios](https://github.com/rust-lang/rust/pull/124870)
  Compiler
--------
- [Update cc crate to v1.0.97 allowing additional spectre mitigations on MSVC targets](https://github.com/rust-lang/rust/pull/124892/)
- [Allow field reordering on types marked `repr(packed(1))`](https://github.com/rust-lang/rust/pull/125360/)
- [Add a lint against never type fallback affecting unsafe code](https://github.com/rust-lang/rust/pull/123939/)
- [Disallow cast with trailing braced macro in let-else](https://github.com/rust-lang/rust/pull/125049/)
- [Expand `for_loops_over_fallibles` lint to lint on fallibles behind references.](https://github.com/rust-lang/rust/pull/125156/)
- [self-contained linker: retry linking without `-fuse-ld=lld` on CCs that don't support it](https://github.com/rust-lang/rust/pull/125417/)
- [Do not parse CVarArgs (`...`) as a type in trait bounds](https://github.com/rust-lang/rust/pull/125863/)
- Improvements to LLDB formatting [#124458](https://github.com/rust-lang/rust/pull/124458) [#124500](https://github.com/rust-lang/rust/pull/124500)
- [For the wasm32-wasip2 target default to PIC and do not use `-fuse-ld=lld`](https://github.com/rust-lang/rust/pull/124858/)
- [Add x86_64-unknown-linux-none as a tier 3 target](https://github.com/rust-lang/rust/pull/125023/)
- [Lint on `foo.into_iter()` resolving to `&amp;Box&lt;[T]&gt;: IntoIterator`](https://github.com/rust-lang/rust/pull/124097/)
  Libraries
---------
- [Add `size_of` and `size_of_val` and `align_of` and `align_of_val` to the prelude](https://github.com/rust-lang/rust/pull/123168/)
- [Abort a process when FD ownership is violated](https://github.com/rust-lang/rust/pull/124210/)
- [io::Write::write_fmt: panic if the formatter fails when the stream does not fail](https://github.com/rust-lang/rust/pull/125012/)
- [Panic if `PathBuf::set_extension` would add a path separator](https://github.com/rust-lang/rust/pull/125070/)
- [Add assert_unsafe_precondition to unchecked_{add,sub,neg,mul,shl,shr} methods](https://github.com/rust-lang/rust/pull/121571/)
- [Update `c_char` on AIX to use the correct type](https://github.com/rust-lang/rust/pull/122986/)
- [`offset_of!` no longer returns a temporary](https://github.com/rust-lang/rust/pull/124484/)
- [Handle sigma in `str.to_lowercase` correctly](https://github.com/rust-lang/rust/pull/124773/)
- [Raise `DEFAULT_MIN_STACK_SIZE` to at least 64KiB](https://github.com/rust-lang/rust/pull/126059/)
  Stabilized APIs
- [`impl Default for Rc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3CCStr%3E)
- [`impl Default for Rc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3Cstr%3E)
- [`impl Default for Rc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3C%5BT%5D%3E)
- [`impl Default for Arc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3Cstr%3E)
- [`impl Default for Arc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3CCStr%3E)
- [`impl Default for Arc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3C%5BT%5D%3E)
- [`impl IntoIterator for Box&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-IntoIterator-for-Box%3C%5BI%5D,+A%3E)
- [`impl FromIterator&lt;String&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3CString%3E-for-Box%3Cstr%3E)
- [`impl FromIterator&lt;char&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3Cchar%3E-for-Box%3Cstr%3E)
- [`LazyCell`](https://doc.rust-lang.org/beta/core/cell/struct.LazyCell.html)
- [`LazyLock`](https://doc.rust-lang.org/beta/std/sync/struct.LazyLock.html)
- [`Duration::div_duration_f32`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f32)
- [`Duration::div_duration_f64`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f64)
- [`Option::take_if`](https://doc.rust-lang.org/beta/std/option/enum.Option.html#method.take_if)
- [`Seek::seek_relative`](https://doc.rust-lang.org/beta/std/io/trait.Seek.html#method.seek_relative)
- [`BinaryHeap::as_slice`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.as_slice)
- [`NonNull::offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset)
- [`NonNull::byte_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset)
- [`NonNull::add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.add)
- [`NonNull::byte_add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_add)
- [`NonNull::sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.sub)
- [`NonNull::byte_sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_sub)
- [`NonNull::offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset_from)
- [`NonNull::byte_offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset_from)
- [`NonNull::read`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read)
- [`NonNull::read_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_volatile)
- [`NonNull::read_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_unaligned)
- [`NonNull::write`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write)
- [`NonNull::write_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_volatile)
- [`NonNull::write_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_unaligned)
- [`NonNull::write_bytes`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_bytes)
- [`NonNull::copy_to`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to)
- [`NonNull::copy_to_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to_nonoverlapping)
- [`NonNull::copy_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from)
- [`NonNull::copy_from_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from_nonoverlapping)
- [`NonNull::replace`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.replace)
- [`NonNull::swap`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.swap)
- [`NonNull::drop_in_place`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.drop_in_place)
- [`NonNull::align_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.align_offset)
- [`&lt;[T]&gt;::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_checked)
- [`&lt;[T]&gt;::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_mut_checked)
- [`str::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_checked)
- [`str::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_mut_checked)
- [`str::trim_ascii`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii)
- [`str::trim_ascii_start`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_start)
- [`str::trim_ascii_end`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_end)
- [`&lt;[u8]&gt;::trim_ascii`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii)
- [`&lt;[u8]&gt;::trim_ascii_start`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_start)
- [`&lt;[u8]&gt;::trim_ascii_end`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_end)
- [`Ipv4Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#associatedconstant.BITS)
- [`Ipv4Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.to_bits)
- [`Ipv4Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.from_bits)
- [`Ipv6Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#associatedconstant.BITS)
- [`Ipv6Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.to_bits)
- [`Ipv6Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.from_bits)
- [`Vec::&lt;[T; N]&gt;::into_flattened`](https://doc.rust-lang.org/beta/alloc/vec/struct.Vec.html#method.into_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened_mut`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened_mut)
  These APIs are now stable in const contexts:
- [`&lt;[T]&gt;::last_chunk`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.last_chunk)
- [`BinaryHeap::new`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.new)
  Cargo
-----
- [Stabilize `-Zcheck-cfg` as always enabled](https://github.com/rust-lang/cargo/pull/13571/)
- [Warn, rather than fail publish, if a target is excluded](https://github.com/rust-lang/cargo/pull/13713/)
- [Add special `check-cfg` lint config for the `unexpected_cfgs` lint](https://github.com/rust-lang/cargo/pull/13913/)
- [Stabilize `cargo update --precise &lt;yanked&gt;`](https://github.com/rust-lang/cargo/pull/13974/)
- [Don't change file permissions on `Cargo.toml` when using `cargo add`](https://github.com/rust-lang/cargo/pull/13898/)
- [Support using `cargo fix` on IPv6-only networks](https://github.com/rust-lang/cargo/pull/13907/)
  Rustdoc
-----
- [Allow searching for references](https://github.com/rust-lang/rust/pull/124148/)
- [Stabilize `custom_code_classes_in_docs` feature](https://github.com/rust-lang/rust/pull/124577/)
- [fix: In cross-crate scenarios show enum variants on type aliases of enums](https://github.com/rust-lang/rust/pull/125300/)
  Compatibility Notes
- [rustfmt estimates line lengths differently when using non-ascii characters](https://github.com/rust-lang/rustfmt/issues/6203)
- [Type aliases are now handled correctly in orphan check](https://github.com/rust-lang/rust/pull/117164/)
- [Allow instructing rustdoc to read from stdin via `-`](https://github.com/rust-lang/rust/pull/124611/)
- [`std::env::{set_var, remove_var}` can no longer be converted to safe function pointers and no longer implement the `Fn` family of traits](https://github.com/rust-lang/rust/pull/124636)
- [Warn (or error) when `Self` constructor from outer item is referenced in inner nested item](https://github.com/rust-lang/rust/pull/124187/)
- [Turn `indirect_structural_match` and `pointer_structural_match` lints into hard errors](https://github.com/rust-lang/rust/pull/124661/)
- [Make `where_clause_object_safety` lint a regular object safety violation](https://github.com/rust-lang/rust/pull/125380/)
- [Turn `proc_macro_back_compat` lint into a hard error.](https://github.com/rust-lang/rust/pull/125596/)
- [Detect unused structs even when implementing private traits](https://github.com/rust-lang/rust/pull/122382/)
- [`std::sync::ReentrantLockGuard&lt;T&gt;` is no longer `Sync` if `T: !Sync`](https://github.com/rust-lang/rust/pull/125527) which means [`std::io::StdoutLock` and `std::io::StderrLock` are no longer Sync](https://github.com/rust-lang/rust/issues/127340)
  Internal Changes
  These changes do not affect any public interfaces of Rust, but they represent
  significant improvements to the performance or internals of rustc and related
  tools.
- Misc improvements to size of generated html by rustdoc e.g. [#124738](https://github.com/rust-lang/rust/pull/124738/) and [#123734](https://github.com/rust-lang/rust/pull/123734/)
- [MSVC targets no longer depend on libc](https://github.com/rust-lang/rust/pull/124050/)</changelog>
  <changelog author="william.brown@suse.com" date="1723204800">Version 1.80.1 (2024-08-08)
- [Fix miscompilation in the jump threading MIR optimization when comparing floats](https://github.com/rust-lang/rust/pull/128271)
- [Revert changes to the `dead_code` lint from 1.80.0](https://github.com/rust-lang/rust/pull/128618)</changelog>
</package>
<package pkgid="b732ba930ddcf891c737135b31de0573dbad3bceebbc1c001e727724bf66ac36" name="cargo1.80" arch="s390x">
  <version epoch="0" ver="1.80.1" rel="150500.11.6.1"/>
  <changelog author="william.brown@suse.com" date="1721995200">Version 1.80.0 (2024-07-25)
  Language
--------
- [Document maximum allocation size](https://github.com/rust-lang/rust/pull/116675/)
- [Allow zero-byte offsets and ZST read/writes on arbitrary pointers](https://github.com/rust-lang/rust/pull/117329/)
- [Support C23's variadics without a named parameter](https://github.com/rust-lang/rust/pull/124048/)
- [Stabilize `exclusive_range_pattern` feature](https://github.com/rust-lang/rust/pull/124459/)
- [Guarantee layout and ABI of `Result` in some scenarios](https://github.com/rust-lang/rust/pull/124870)
  Compiler
--------
- [Update cc crate to v1.0.97 allowing additional spectre mitigations on MSVC targets](https://github.com/rust-lang/rust/pull/124892/)
- [Allow field reordering on types marked `repr(packed(1))`](https://github.com/rust-lang/rust/pull/125360/)
- [Add a lint against never type fallback affecting unsafe code](https://github.com/rust-lang/rust/pull/123939/)
- [Disallow cast with trailing braced macro in let-else](https://github.com/rust-lang/rust/pull/125049/)
- [Expand `for_loops_over_fallibles` lint to lint on fallibles behind references.](https://github.com/rust-lang/rust/pull/125156/)
- [self-contained linker: retry linking without `-fuse-ld=lld` on CCs that don't support it](https://github.com/rust-lang/rust/pull/125417/)
- [Do not parse CVarArgs (`...`) as a type in trait bounds](https://github.com/rust-lang/rust/pull/125863/)
- Improvements to LLDB formatting [#124458](https://github.com/rust-lang/rust/pull/124458) [#124500](https://github.com/rust-lang/rust/pull/124500)
- [For the wasm32-wasip2 target default to PIC and do not use `-fuse-ld=lld`](https://github.com/rust-lang/rust/pull/124858/)
- [Add x86_64-unknown-linux-none as a tier 3 target](https://github.com/rust-lang/rust/pull/125023/)
- [Lint on `foo.into_iter()` resolving to `&amp;Box&lt;[T]&gt;: IntoIterator`](https://github.com/rust-lang/rust/pull/124097/)
  Libraries
---------
- [Add `size_of` and `size_of_val` and `align_of` and `align_of_val` to the prelude](https://github.com/rust-lang/rust/pull/123168/)
- [Abort a process when FD ownership is violated](https://github.com/rust-lang/rust/pull/124210/)
- [io::Write::write_fmt: panic if the formatter fails when the stream does not fail](https://github.com/rust-lang/rust/pull/125012/)
- [Panic if `PathBuf::set_extension` would add a path separator](https://github.com/rust-lang/rust/pull/125070/)
- [Add assert_unsafe_precondition to unchecked_{add,sub,neg,mul,shl,shr} methods](https://github.com/rust-lang/rust/pull/121571/)
- [Update `c_char` on AIX to use the correct type](https://github.com/rust-lang/rust/pull/122986/)
- [`offset_of!` no longer returns a temporary](https://github.com/rust-lang/rust/pull/124484/)
- [Handle sigma in `str.to_lowercase` correctly](https://github.com/rust-lang/rust/pull/124773/)
- [Raise `DEFAULT_MIN_STACK_SIZE` to at least 64KiB](https://github.com/rust-lang/rust/pull/126059/)
  Stabilized APIs
- [`impl Default for Rc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3CCStr%3E)
- [`impl Default for Rc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3Cstr%3E)
- [`impl Default for Rc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3C%5BT%5D%3E)
- [`impl Default for Arc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3Cstr%3E)
- [`impl Default for Arc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3CCStr%3E)
- [`impl Default for Arc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3C%5BT%5D%3E)
- [`impl IntoIterator for Box&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-IntoIterator-for-Box%3C%5BI%5D,+A%3E)
- [`impl FromIterator&lt;String&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3CString%3E-for-Box%3Cstr%3E)
- [`impl FromIterator&lt;char&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3Cchar%3E-for-Box%3Cstr%3E)
- [`LazyCell`](https://doc.rust-lang.org/beta/core/cell/struct.LazyCell.html)
- [`LazyLock`](https://doc.rust-lang.org/beta/std/sync/struct.LazyLock.html)
- [`Duration::div_duration_f32`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f32)
- [`Duration::div_duration_f64`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f64)
- [`Option::take_if`](https://doc.rust-lang.org/beta/std/option/enum.Option.html#method.take_if)
- [`Seek::seek_relative`](https://doc.rust-lang.org/beta/std/io/trait.Seek.html#method.seek_relative)
- [`BinaryHeap::as_slice`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.as_slice)
- [`NonNull::offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset)
- [`NonNull::byte_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset)
- [`NonNull::add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.add)
- [`NonNull::byte_add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_add)
- [`NonNull::sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.sub)
- [`NonNull::byte_sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_sub)
- [`NonNull::offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset_from)
- [`NonNull::byte_offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset_from)
- [`NonNull::read`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read)
- [`NonNull::read_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_volatile)
- [`NonNull::read_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_unaligned)
- [`NonNull::write`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write)
- [`NonNull::write_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_volatile)
- [`NonNull::write_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_unaligned)
- [`NonNull::write_bytes`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_bytes)
- [`NonNull::copy_to`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to)
- [`NonNull::copy_to_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to_nonoverlapping)
- [`NonNull::copy_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from)
- [`NonNull::copy_from_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from_nonoverlapping)
- [`NonNull::replace`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.replace)
- [`NonNull::swap`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.swap)
- [`NonNull::drop_in_place`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.drop_in_place)
- [`NonNull::align_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.align_offset)
- [`&lt;[T]&gt;::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_checked)
- [`&lt;[T]&gt;::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_mut_checked)
- [`str::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_checked)
- [`str::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_mut_checked)
- [`str::trim_ascii`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii)
- [`str::trim_ascii_start`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_start)
- [`str::trim_ascii_end`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_end)
- [`&lt;[u8]&gt;::trim_ascii`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii)
- [`&lt;[u8]&gt;::trim_ascii_start`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_start)
- [`&lt;[u8]&gt;::trim_ascii_end`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_end)
- [`Ipv4Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#associatedconstant.BITS)
- [`Ipv4Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.to_bits)
- [`Ipv4Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.from_bits)
- [`Ipv6Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#associatedconstant.BITS)
- [`Ipv6Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.to_bits)
- [`Ipv6Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.from_bits)
- [`Vec::&lt;[T; N]&gt;::into_flattened`](https://doc.rust-lang.org/beta/alloc/vec/struct.Vec.html#method.into_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened_mut`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened_mut)
  These APIs are now stable in const contexts:
- [`&lt;[T]&gt;::last_chunk`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.last_chunk)
- [`BinaryHeap::new`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.new)
  Cargo
-----
- [Stabilize `-Zcheck-cfg` as always enabled](https://github.com/rust-lang/cargo/pull/13571/)
- [Warn, rather than fail publish, if a target is excluded](https://github.com/rust-lang/cargo/pull/13713/)
- [Add special `check-cfg` lint config for the `unexpected_cfgs` lint](https://github.com/rust-lang/cargo/pull/13913/)
- [Stabilize `cargo update --precise &lt;yanked&gt;`](https://github.com/rust-lang/cargo/pull/13974/)
- [Don't change file permissions on `Cargo.toml` when using `cargo add`](https://github.com/rust-lang/cargo/pull/13898/)
- [Support using `cargo fix` on IPv6-only networks](https://github.com/rust-lang/cargo/pull/13907/)
  Rustdoc
-----
- [Allow searching for references](https://github.com/rust-lang/rust/pull/124148/)
- [Stabilize `custom_code_classes_in_docs` feature](https://github.com/rust-lang/rust/pull/124577/)
- [fix: In cross-crate scenarios show enum variants on type aliases of enums](https://github.com/rust-lang/rust/pull/125300/)
  Compatibility Notes
- [rustfmt estimates line lengths differently when using non-ascii characters](https://github.com/rust-lang/rustfmt/issues/6203)
- [Type aliases are now handled correctly in orphan check](https://github.com/rust-lang/rust/pull/117164/)
- [Allow instructing rustdoc to read from stdin via `-`](https://github.com/rust-lang/rust/pull/124611/)
- [`std::env::{set_var, remove_var}` can no longer be converted to safe function pointers and no longer implement the `Fn` family of traits](https://github.com/rust-lang/rust/pull/124636)
- [Warn (or error) when `Self` constructor from outer item is referenced in inner nested item](https://github.com/rust-lang/rust/pull/124187/)
- [Turn `indirect_structural_match` and `pointer_structural_match` lints into hard errors](https://github.com/rust-lang/rust/pull/124661/)
- [Make `where_clause_object_safety` lint a regular object safety violation](https://github.com/rust-lang/rust/pull/125380/)
- [Turn `proc_macro_back_compat` lint into a hard error.](https://github.com/rust-lang/rust/pull/125596/)
- [Detect unused structs even when implementing private traits](https://github.com/rust-lang/rust/pull/122382/)
- [`std::sync::ReentrantLockGuard&lt;T&gt;` is no longer `Sync` if `T: !Sync`](https://github.com/rust-lang/rust/pull/125527) which means [`std::io::StdoutLock` and `std::io::StderrLock` are no longer Sync](https://github.com/rust-lang/rust/issues/127340)
  Internal Changes
  These changes do not affect any public interfaces of Rust, but they represent
  significant improvements to the performance or internals of rustc and related
  tools.
- Misc improvements to size of generated html by rustdoc e.g. [#124738](https://github.com/rust-lang/rust/pull/124738/) and [#123734](https://github.com/rust-lang/rust/pull/123734/)
- [MSVC targets no longer depend on libc](https://github.com/rust-lang/rust/pull/124050/)</changelog>
  <changelog author="william.brown@suse.com" date="1723204800">Version 1.80.1 (2024-08-08)
- [Fix miscompilation in the jump threading MIR optimization when comparing floats](https://github.com/rust-lang/rust/pull/128271)
- [Revert changes to the `dead_code` lint from 1.80.0](https://github.com/rust-lang/rust/pull/128618)</changelog>
</package>
<package pkgid="20f09a179965502a6b75d3418f8d48c1fa9edd8292fca31dac2dadf4fa72a4a1" name="cargo1.80" arch="x86_64">
  <version epoch="0" ver="1.80.1" rel="150500.11.6.1"/>
  <changelog author="william.brown@suse.com" date="1721995200">Version 1.80.0 (2024-07-25)
  Language
--------
- [Document maximum allocation size](https://github.com/rust-lang/rust/pull/116675/)
- [Allow zero-byte offsets and ZST read/writes on arbitrary pointers](https://github.com/rust-lang/rust/pull/117329/)
- [Support C23's variadics without a named parameter](https://github.com/rust-lang/rust/pull/124048/)
- [Stabilize `exclusive_range_pattern` feature](https://github.com/rust-lang/rust/pull/124459/)
- [Guarantee layout and ABI of `Result` in some scenarios](https://github.com/rust-lang/rust/pull/124870)
  Compiler
--------
- [Update cc crate to v1.0.97 allowing additional spectre mitigations on MSVC targets](https://github.com/rust-lang/rust/pull/124892/)
- [Allow field reordering on types marked `repr(packed(1))`](https://github.com/rust-lang/rust/pull/125360/)
- [Add a lint against never type fallback affecting unsafe code](https://github.com/rust-lang/rust/pull/123939/)
- [Disallow cast with trailing braced macro in let-else](https://github.com/rust-lang/rust/pull/125049/)
- [Expand `for_loops_over_fallibles` lint to lint on fallibles behind references.](https://github.com/rust-lang/rust/pull/125156/)
- [self-contained linker: retry linking without `-fuse-ld=lld` on CCs that don't support it](https://github.com/rust-lang/rust/pull/125417/)
- [Do not parse CVarArgs (`...`) as a type in trait bounds](https://github.com/rust-lang/rust/pull/125863/)
- Improvements to LLDB formatting [#124458](https://github.com/rust-lang/rust/pull/124458) [#124500](https://github.com/rust-lang/rust/pull/124500)
- [For the wasm32-wasip2 target default to PIC and do not use `-fuse-ld=lld`](https://github.com/rust-lang/rust/pull/124858/)
- [Add x86_64-unknown-linux-none as a tier 3 target](https://github.com/rust-lang/rust/pull/125023/)
- [Lint on `foo.into_iter()` resolving to `&amp;Box&lt;[T]&gt;: IntoIterator`](https://github.com/rust-lang/rust/pull/124097/)
  Libraries
---------
- [Add `size_of` and `size_of_val` and `align_of` and `align_of_val` to the prelude](https://github.com/rust-lang/rust/pull/123168/)
- [Abort a process when FD ownership is violated](https://github.com/rust-lang/rust/pull/124210/)
- [io::Write::write_fmt: panic if the formatter fails when the stream does not fail](https://github.com/rust-lang/rust/pull/125012/)
- [Panic if `PathBuf::set_extension` would add a path separator](https://github.com/rust-lang/rust/pull/125070/)
- [Add assert_unsafe_precondition to unchecked_{add,sub,neg,mul,shl,shr} methods](https://github.com/rust-lang/rust/pull/121571/)
- [Update `c_char` on AIX to use the correct type](https://github.com/rust-lang/rust/pull/122986/)
- [`offset_of!` no longer returns a temporary](https://github.com/rust-lang/rust/pull/124484/)
- [Handle sigma in `str.to_lowercase` correctly](https://github.com/rust-lang/rust/pull/124773/)
- [Raise `DEFAULT_MIN_STACK_SIZE` to at least 64KiB](https://github.com/rust-lang/rust/pull/126059/)
  Stabilized APIs
- [`impl Default for Rc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3CCStr%3E)
- [`impl Default for Rc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3Cstr%3E)
- [`impl Default for Rc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3C%5BT%5D%3E)
- [`impl Default for Arc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3Cstr%3E)
- [`impl Default for Arc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3CCStr%3E)
- [`impl Default for Arc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3C%5BT%5D%3E)
- [`impl IntoIterator for Box&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-IntoIterator-for-Box%3C%5BI%5D,+A%3E)
- [`impl FromIterator&lt;String&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3CString%3E-for-Box%3Cstr%3E)
- [`impl FromIterator&lt;char&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3Cchar%3E-for-Box%3Cstr%3E)
- [`LazyCell`](https://doc.rust-lang.org/beta/core/cell/struct.LazyCell.html)
- [`LazyLock`](https://doc.rust-lang.org/beta/std/sync/struct.LazyLock.html)
- [`Duration::div_duration_f32`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f32)
- [`Duration::div_duration_f64`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f64)
- [`Option::take_if`](https://doc.rust-lang.org/beta/std/option/enum.Option.html#method.take_if)
- [`Seek::seek_relative`](https://doc.rust-lang.org/beta/std/io/trait.Seek.html#method.seek_relative)
- [`BinaryHeap::as_slice`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.as_slice)
- [`NonNull::offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset)
- [`NonNull::byte_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset)
- [`NonNull::add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.add)
- [`NonNull::byte_add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_add)
- [`NonNull::sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.sub)
- [`NonNull::byte_sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_sub)
- [`NonNull::offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset_from)
- [`NonNull::byte_offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset_from)
- [`NonNull::read`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read)
- [`NonNull::read_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_volatile)
- [`NonNull::read_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_unaligned)
- [`NonNull::write`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write)
- [`NonNull::write_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_volatile)
- [`NonNull::write_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_unaligned)
- [`NonNull::write_bytes`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_bytes)
- [`NonNull::copy_to`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to)
- [`NonNull::copy_to_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to_nonoverlapping)
- [`NonNull::copy_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from)
- [`NonNull::copy_from_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from_nonoverlapping)
- [`NonNull::replace`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.replace)
- [`NonNull::swap`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.swap)
- [`NonNull::drop_in_place`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.drop_in_place)
- [`NonNull::align_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.align_offset)
- [`&lt;[T]&gt;::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_checked)
- [`&lt;[T]&gt;::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_mut_checked)
- [`str::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_checked)
- [`str::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_mut_checked)
- [`str::trim_ascii`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii)
- [`str::trim_ascii_start`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_start)
- [`str::trim_ascii_end`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_end)
- [`&lt;[u8]&gt;::trim_ascii`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii)
- [`&lt;[u8]&gt;::trim_ascii_start`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_start)
- [`&lt;[u8]&gt;::trim_ascii_end`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_end)
- [`Ipv4Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#associatedconstant.BITS)
- [`Ipv4Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.to_bits)
- [`Ipv4Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.from_bits)
- [`Ipv6Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#associatedconstant.BITS)
- [`Ipv6Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.to_bits)
- [`Ipv6Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.from_bits)
- [`Vec::&lt;[T; N]&gt;::into_flattened`](https://doc.rust-lang.org/beta/alloc/vec/struct.Vec.html#method.into_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened_mut`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened_mut)
  These APIs are now stable in const contexts:
- [`&lt;[T]&gt;::last_chunk`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.last_chunk)
- [`BinaryHeap::new`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.new)
  Cargo
-----
- [Stabilize `-Zcheck-cfg` as always enabled](https://github.com/rust-lang/cargo/pull/13571/)
- [Warn, rather than fail publish, if a target is excluded](https://github.com/rust-lang/cargo/pull/13713/)
- [Add special `check-cfg` lint config for the `unexpected_cfgs` lint](https://github.com/rust-lang/cargo/pull/13913/)
- [Stabilize `cargo update --precise &lt;yanked&gt;`](https://github.com/rust-lang/cargo/pull/13974/)
- [Don't change file permissions on `Cargo.toml` when using `cargo add`](https://github.com/rust-lang/cargo/pull/13898/)
- [Support using `cargo fix` on IPv6-only networks](https://github.com/rust-lang/cargo/pull/13907/)
  Rustdoc
-----
- [Allow searching for references](https://github.com/rust-lang/rust/pull/124148/)
- [Stabilize `custom_code_classes_in_docs` feature](https://github.com/rust-lang/rust/pull/124577/)
- [fix: In cross-crate scenarios show enum variants on type aliases of enums](https://github.com/rust-lang/rust/pull/125300/)
  Compatibility Notes
- [rustfmt estimates line lengths differently when using non-ascii characters](https://github.com/rust-lang/rustfmt/issues/6203)
- [Type aliases are now handled correctly in orphan check](https://github.com/rust-lang/rust/pull/117164/)
- [Allow instructing rustdoc to read from stdin via `-`](https://github.com/rust-lang/rust/pull/124611/)
- [`std::env::{set_var, remove_var}` can no longer be converted to safe function pointers and no longer implement the `Fn` family of traits](https://github.com/rust-lang/rust/pull/124636)
- [Warn (or error) when `Self` constructor from outer item is referenced in inner nested item](https://github.com/rust-lang/rust/pull/124187/)
- [Turn `indirect_structural_match` and `pointer_structural_match` lints into hard errors](https://github.com/rust-lang/rust/pull/124661/)
- [Make `where_clause_object_safety` lint a regular object safety violation](https://github.com/rust-lang/rust/pull/125380/)
- [Turn `proc_macro_back_compat` lint into a hard error.](https://github.com/rust-lang/rust/pull/125596/)
- [Detect unused structs even when implementing private traits](https://github.com/rust-lang/rust/pull/122382/)
- [`std::sync::ReentrantLockGuard&lt;T&gt;` is no longer `Sync` if `T: !Sync`](https://github.com/rust-lang/rust/pull/125527) which means [`std::io::StdoutLock` and `std::io::StderrLock` are no longer Sync](https://github.com/rust-lang/rust/issues/127340)
  Internal Changes
  These changes do not affect any public interfaces of Rust, but they represent
  significant improvements to the performance or internals of rustc and related
  tools.
- Misc improvements to size of generated html by rustdoc e.g. [#124738](https://github.com/rust-lang/rust/pull/124738/) and [#123734](https://github.com/rust-lang/rust/pull/123734/)
- [MSVC targets no longer depend on libc](https://github.com/rust-lang/rust/pull/124050/)</changelog>
  <changelog author="william.brown@suse.com" date="1723204800">Version 1.80.1 (2024-08-08)
- [Fix miscompilation in the jump threading MIR optimization when comparing floats](https://github.com/rust-lang/rust/pull/128271)
- [Revert changes to the `dead_code` lint from 1.80.0](https://github.com/rust-lang/rust/pull/128618)</changelog>
</package>
<package pkgid="b8eca413cc47b965f0139ddb31d5e1b4096f445a08fa4f1807defb46b48c94f5" name="cargo1.81" arch="aarch64">
  <version epoch="0" ver="1.81.0" rel="150500.11.3.1"/>
  <changelog author="xiaoguang.wang@suse.com" date="1725883200">Version 1.81.0 (2024-09-05)
  Language
--------
- [Abort on uncaught panics in `extern "C"` functions.](https://github.com/rust-lang/rust/pull/116088/)
- [Fix ambiguous cases of multiple `&amp;` in elided self lifetimes.](https://github.com/rust-lang/rust/pull/117967/)
- [Stabilize `#[expect]` for lints (RFC 2383),](https://github.com/rust-lang/rust/pull/120924/) like `#[allow]` with a warning if the lint is _not_ fulfilled.
- [Change method resolution to constrain hidden types instead of rejecting method candidates.](https://github.com/rust-lang/rust/pull/123962/)
- [Bump `elided_lifetimes_in_associated_constant` to deny.](https://github.com/rust-lang/rust/pull/124211/)
- [`offset_from`: always allow pointers to point to the same address.](https://github.com/rust-lang/rust/pull/124921/)
- [Allow constraining opaque types during subtyping in the trait system.](https://github.com/rust-lang/rust/pull/125447/)
- [Allow constraining opaque types during various unsizing casts.](https://github.com/rust-lang/rust/pull/125610/)
- [Deny keyword lifetimes pre-expansion.](https://github.com/rust-lang/rust/pull/126762/)
  Compiler
--------
- [Make casts of pointers to trait objects stricter.](https://github.com/rust-lang/rust/pull/120248/)
- [Check alias args for well-formedness even if they have escaping bound vars.](https://github.com/rust-lang/rust/pull/123737/)
- [Deprecate no-op codegen option `-Cinline-threshold=...`.](https://github.com/rust-lang/rust/pull/124712/)
- [Re-implement a type-size based limit.](https://github.com/rust-lang/rust/pull/125507/)
- [Properly account for alignment in `transmute` size checks.](https://github.com/rust-lang/rust/pull/125740/)
- [Remove the `box_pointers` lint.](https://github.com/rust-lang/rust/pull/126018/)
- [Ensure the interpreter checks bool/char for validity when they are used in a cast.](https://github.com/rust-lang/rust/pull/126265/)
- [Improve coverage instrumentation for functions containing nested items.](https://github.com/rust-lang/rust/pull/127199/)
- Target changes:
  - [Add Tier 3 `no_std` Xtensa targets:](https://github.com/rust-lang/rust/pull/125141/) `xtensa-esp32-none-elf`, `xtensa-esp32s2-none-elf`, `xtensa-esp32s3-none-elf`
  - [Add Tier 3 `std` Xtensa targets:](https://github.com/rust-lang/rust/pull/126380/) `xtensa-esp32-espidf`, `xtensa-esp32s2-espidf`, `xtensa-esp32s3-espidf`
  - [Add Tier 3 i686 Redox OS target:](https://github.com/rust-lang/rust/pull/126192/) `i686-unknown-redox`
  - [Promote `arm64ec-pc-windows-msvc` to Tier 2.](https://github.com/rust-lang/rust/pull/126039/)
  - [Promote `loongarch64-unknown-linux-musl` to Tier 2 with host tools.](https://github.com/rust-lang/rust/pull/126298/)
  - [Enable full tools and profiler for LoongArch Linux targets.](https://github.com/rust-lang/rust/pull/127078/)
  - [Unconditionally warn on usage of `wasm32-wasi`.](https://github.com/rust-lang/rust/pull/126662/) (see compatibility note below)
  - Refer to Rust's [platform support page][platform-support-doc] for more information on Rust's tiered platform support.
  Libraries
---------
- [Split core's `PanicInfo` and std's `PanicInfo`.](https://github.com/rust-lang/rust/pull/115974/) (see compatibility note below)
- [Generalize `{Rc,Arc}::make_mut()` to unsized types.](https://github.com/rust-lang/rust/pull/116113/)
- [Replace sort implementations with stable `driftsort` and unstable `ipnsort`.](https://github.com/rust-lang/rust/pull/124032/) All `slice::sort*` and `slice::select_nth*` methods are expected to see significant performance improvements. See the [research project](https://github.com/Voultapher/sort-research-rs) for more details.
- [Document behavior of `create_dir_all` with respect to empty paths.](https://github.com/rust-lang/rust/pull/125112/)
- [Fix interleaved output in the default panic hook when multiple threads panic simultaneously.](https://github.com/rust-lang/rust/pull/127397/)
  Stabilized APIs
- [`core::error`](https://doc.rust-lang.org/stable/core/error/index.html)
- [`hint::assert_unchecked`](https://doc.rust-lang.org/stable/core/hint/fn.assert_unchecked.html)
- [`fs::exists`](https://doc.rust-lang.org/stable/std/fs/fn.exists.html)
- [`AtomicBool::fetch_not`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicBool.html#method.fetch_not)
- [`Duration::abs_diff`](https://doc.rust-lang.org/stable/core/time/struct.Duration.html#method.abs_diff)
- [`IoSlice::advance`](https://doc.rust-lang.org/stable/std/io/struct.IoSlice.html#method.advance)
- [`IoSlice::advance_slices`](https://doc.rust-lang.org/stable/std/io/struct.IoSlice.html#method.advance_slices)
- [`IoSliceMut::advance`](https://doc.rust-lang.org/stable/std/io/struct.IoSliceMut.html#method.advance)
- [`IoSliceMut::advance_slices`](https://doc.rust-lang.org/stable/std/io/struct.IoSliceMut.html#method.advance_slices)
- [`PanicHookInfo`](https://doc.rust-lang.org/stable/std/panic/struct.PanicHookInfo.html)
- [`PanicInfo::message`](https://doc.rust-lang.org/stable/core/panic/struct.PanicInfo.html#method.message)
- [`PanicMessage`](https://doc.rust-lang.org/stable/core/panic/struct.PanicMessage.html)
  These APIs are now stable in const contexts:
- [`char::from_u32_unchecked`](https://doc.rust-lang.org/stable/core/char/fn.from_u32_unchecked.html) (function)
- [`char::from_u32_unchecked`](https://doc.rust-lang.org/stable/core/primitive.char.html#method.from_u32_unchecked) (method)
- [`CStr::count_bytes`](https://doc.rust-lang.org/stable/core/ffi/c_str/struct.CStr.html#method.count_bytes)
- [`CStr::from_ptr`](https://doc.rust-lang.org/stable/core/ffi/c_str/struct.CStr.html#method.from_ptr)
  Cargo
-----
- [Generated `.cargo_vcs_info.json` is always included, even when `--allow-dirty` is passed.](https://github.com/rust-lang/cargo/pull/13960/)
- [Disallow `package.license-file` and `package.readme` pointing to non-existent files during packaging.](https://github.com/rust-lang/cargo/pull/13921/)
- [Disallow passing `--release`/`--debug` flag along with the `--profile` flag.](https://github.com/rust-lang/cargo/pull/13971/)
- [Remove `lib.plugin` key support in `Cargo.toml`. Rust plugin support has been deprecated for four years and was removed in 1.75.0.](https://github.com/rust-lang/cargo/pull/13902/)
  Compatibility Notes
  * Usage of the `wasm32-wasi` target will now issue a compiler warning and request users switch to the `wasm32-wasip1` target instead. Both targets are the same, `wasm32-wasi` is only being renamed, and this [change to the WASI target](https://blog.rust-lang.org/2024/04/09/updates-to-rusts-wasi-targets.html) is being done to enable removing `wasm32-wasi` in January 2025.
  * We have renamed `std::panic::PanicInfo` to `std::panic::PanicHookInfo`. The old name will continue to work as an alias, but will result in a deprecation warning starting in Rust 1.82.0.
  `core::panic::PanicInfo` will remain unchanged, however, as this is now a *different type*.
  The reason is that these types have different roles: `std::panic::PanicHookInfo` is the argument to the [panic hook](https://doc.rust-lang.org/stable/std/panic/fn.set_hook.html) in std context (where panics can have an arbitrary payload), while `core::panic::PanicInfo` is the argument to the [`#[panic_handler]`](https://doc.rust-lang.org/nomicon/panic-handler.html) in no_std context (where panics always carry a formatted *message*). Separating these types allows us to add more useful methods to these types, such as `std::panic::PanicHookInfo::payload_as_str()` and `core::panic::PanicInfo::message()`.
  * The new sort implementations may panic if a type's implementation of [`Ord`](https://doc.rust-lang.org/std/cmp/trait.Ord.html) (or the given comparison function) does not implement a [total order](https://en.wikipedia.org/wiki/Total_order) as the trait requires. `Ord`'s supertraits (`PartialOrd`, `Eq`, and `PartialEq`) must also be consistent. The previous implementations would not "notice" any problem, but the new implementations have a good chance of detecting inconsistencies, throwing a panic rather than returning knowingly unsorted data.
  * [In very rare cases, a change in the internal evaluation order of the trait
  solver may result in new fatal overflow errors.](https://github.com/rust-lang/rust/pull/126128)
  Internal Changes
  These changes do not affect any public interfaces of Rust, but they represent
  significant improvements to the performance or internals of rustc and related
  tools.
- [Add a Rust-for Linux `auto` CI job to check kernel builds.](https://github.com/rust-lang/rust/pull/125209/)</changelog>
  <changelog author="william.brown@suse.com" date="1725969600">- Resolve wasm32-wasi build issues</changelog>
</package>
<package pkgid="69f16e700bb789d3b9e8eed0cd33b3f60e253bc740e3469e1fd03b446eccb139" name="cargo1.81" arch="ppc64le">
  <version epoch="0" ver="1.81.0" rel="150500.11.3.1"/>
  <changelog author="xiaoguang.wang@suse.com" date="1725883200">Version 1.81.0 (2024-09-05)
  Language
--------
- [Abort on uncaught panics in `extern "C"` functions.](https://github.com/rust-lang/rust/pull/116088/)
- [Fix ambiguous cases of multiple `&amp;` in elided self lifetimes.](https://github.com/rust-lang/rust/pull/117967/)
- [Stabilize `#[expect]` for lints (RFC 2383),](https://github.com/rust-lang/rust/pull/120924/) like `#[allow]` with a warning if the lint is _not_ fulfilled.
- [Change method resolution to constrain hidden types instead of rejecting method candidates.](https://github.com/rust-lang/rust/pull/123962/)
- [Bump `elided_lifetimes_in_associated_constant` to deny.](https://github.com/rust-lang/rust/pull/124211/)
- [`offset_from`: always allow pointers to point to the same address.](https://github.com/rust-lang/rust/pull/124921/)
- [Allow constraining opaque types during subtyping in the trait system.](https://github.com/rust-lang/rust/pull/125447/)
- [Allow constraining opaque types during various unsizing casts.](https://github.com/rust-lang/rust/pull/125610/)
- [Deny keyword lifetimes pre-expansion.](https://github.com/rust-lang/rust/pull/126762/)
  Compiler
--------
- [Make casts of pointers to trait objects stricter.](https://github.com/rust-lang/rust/pull/120248/)
- [Check alias args for well-formedness even if they have escaping bound vars.](https://github.com/rust-lang/rust/pull/123737/)
- [Deprecate no-op codegen option `-Cinline-threshold=...`.](https://github.com/rust-lang/rust/pull/124712/)
- [Re-implement a type-size based limit.](https://github.com/rust-lang/rust/pull/125507/)
- [Properly account for alignment in `transmute` size checks.](https://github.com/rust-lang/rust/pull/125740/)
- [Remove the `box_pointers` lint.](https://github.com/rust-lang/rust/pull/126018/)
- [Ensure the interpreter checks bool/char for validity when they are used in a cast.](https://github.com/rust-lang/rust/pull/126265/)
- [Improve coverage instrumentation for functions containing nested items.](https://github.com/rust-lang/rust/pull/127199/)
- Target changes:
  - [Add Tier 3 `no_std` Xtensa targets:](https://github.com/rust-lang/rust/pull/125141/) `xtensa-esp32-none-elf`, `xtensa-esp32s2-none-elf`, `xtensa-esp32s3-none-elf`
  - [Add Tier 3 `std` Xtensa targets:](https://github.com/rust-lang/rust/pull/126380/) `xtensa-esp32-espidf`, `xtensa-esp32s2-espidf`, `xtensa-esp32s3-espidf`
  - [Add Tier 3 i686 Redox OS target:](https://github.com/rust-lang/rust/pull/126192/) `i686-unknown-redox`
  - [Promote `arm64ec-pc-windows-msvc` to Tier 2.](https://github.com/rust-lang/rust/pull/126039/)
  - [Promote `loongarch64-unknown-linux-musl` to Tier 2 with host tools.](https://github.com/rust-lang/rust/pull/126298/)
  - [Enable full tools and profiler for LoongArch Linux targets.](https://github.com/rust-lang/rust/pull/127078/)
  - [Unconditionally warn on usage of `wasm32-wasi`.](https://github.com/rust-lang/rust/pull/126662/) (see compatibility note below)
  - Refer to Rust's [platform support page][platform-support-doc] for more information on Rust's tiered platform support.
  Libraries
---------
- [Split core's `PanicInfo` and std's `PanicInfo`.](https://github.com/rust-lang/rust/pull/115974/) (see compatibility note below)
- [Generalize `{Rc,Arc}::make_mut()` to unsized types.](https://github.com/rust-lang/rust/pull/116113/)
- [Replace sort implementations with stable `driftsort` and unstable `ipnsort`.](https://github.com/rust-lang/rust/pull/124032/) All `slice::sort*` and `slice::select_nth*` methods are expected to see significant performance improvements. See the [research project](https://github.com/Voultapher/sort-research-rs) for more details.
- [Document behavior of `create_dir_all` with respect to empty paths.](https://github.com/rust-lang/rust/pull/125112/)
- [Fix interleaved output in the default panic hook when multiple threads panic simultaneously.](https://github.com/rust-lang/rust/pull/127397/)
  Stabilized APIs
- [`core::error`](https://doc.rust-lang.org/stable/core/error/index.html)
- [`hint::assert_unchecked`](https://doc.rust-lang.org/stable/core/hint/fn.assert_unchecked.html)
- [`fs::exists`](https://doc.rust-lang.org/stable/std/fs/fn.exists.html)
- [`AtomicBool::fetch_not`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicBool.html#method.fetch_not)
- [`Duration::abs_diff`](https://doc.rust-lang.org/stable/core/time/struct.Duration.html#method.abs_diff)
- [`IoSlice::advance`](https://doc.rust-lang.org/stable/std/io/struct.IoSlice.html#method.advance)
- [`IoSlice::advance_slices`](https://doc.rust-lang.org/stable/std/io/struct.IoSlice.html#method.advance_slices)
- [`IoSliceMut::advance`](https://doc.rust-lang.org/stable/std/io/struct.IoSliceMut.html#method.advance)
- [`IoSliceMut::advance_slices`](https://doc.rust-lang.org/stable/std/io/struct.IoSliceMut.html#method.advance_slices)
- [`PanicHookInfo`](https://doc.rust-lang.org/stable/std/panic/struct.PanicHookInfo.html)
- [`PanicInfo::message`](https://doc.rust-lang.org/stable/core/panic/struct.PanicInfo.html#method.message)
- [`PanicMessage`](https://doc.rust-lang.org/stable/core/panic/struct.PanicMessage.html)
  These APIs are now stable in const contexts:
- [`char::from_u32_unchecked`](https://doc.rust-lang.org/stable/core/char/fn.from_u32_unchecked.html) (function)
- [`char::from_u32_unchecked`](https://doc.rust-lang.org/stable/core/primitive.char.html#method.from_u32_unchecked) (method)
- [`CStr::count_bytes`](https://doc.rust-lang.org/stable/core/ffi/c_str/struct.CStr.html#method.count_bytes)
- [`CStr::from_ptr`](https://doc.rust-lang.org/stable/core/ffi/c_str/struct.CStr.html#method.from_ptr)
  Cargo
-----
- [Generated `.cargo_vcs_info.json` is always included, even when `--allow-dirty` is passed.](https://github.com/rust-lang/cargo/pull/13960/)
- [Disallow `package.license-file` and `package.readme` pointing to non-existent files during packaging.](https://github.com/rust-lang/cargo/pull/13921/)
- [Disallow passing `--release`/`--debug` flag along with the `--profile` flag.](https://github.com/rust-lang/cargo/pull/13971/)
- [Remove `lib.plugin` key support in `Cargo.toml`. Rust plugin support has been deprecated for four years and was removed in 1.75.0.](https://github.com/rust-lang/cargo/pull/13902/)
  Compatibility Notes
  * Usage of the `wasm32-wasi` target will now issue a compiler warning and request users switch to the `wasm32-wasip1` target instead. Both targets are the same, `wasm32-wasi` is only being renamed, and this [change to the WASI target](https://blog.rust-lang.org/2024/04/09/updates-to-rusts-wasi-targets.html) is being done to enable removing `wasm32-wasi` in January 2025.
  * We have renamed `std::panic::PanicInfo` to `std::panic::PanicHookInfo`. The old name will continue to work as an alias, but will result in a deprecation warning starting in Rust 1.82.0.
  `core::panic::PanicInfo` will remain unchanged, however, as this is now a *different type*.
  The reason is that these types have different roles: `std::panic::PanicHookInfo` is the argument to the [panic hook](https://doc.rust-lang.org/stable/std/panic/fn.set_hook.html) in std context (where panics can have an arbitrary payload), while `core::panic::PanicInfo` is the argument to the [`#[panic_handler]`](https://doc.rust-lang.org/nomicon/panic-handler.html) in no_std context (where panics always carry a formatted *message*). Separating these types allows us to add more useful methods to these types, such as `std::panic::PanicHookInfo::payload_as_str()` and `core::panic::PanicInfo::message()`.
  * The new sort implementations may panic if a type's implementation of [`Ord`](https://doc.rust-lang.org/std/cmp/trait.Ord.html) (or the given comparison function) does not implement a [total order](https://en.wikipedia.org/wiki/Total_order) as the trait requires. `Ord`'s supertraits (`PartialOrd`, `Eq`, and `PartialEq`) must also be consistent. The previous implementations would not "notice" any problem, but the new implementations have a good chance of detecting inconsistencies, throwing a panic rather than returning knowingly unsorted data.
  * [In very rare cases, a change in the internal evaluation order of the trait
  solver may result in new fatal overflow errors.](https://github.com/rust-lang/rust/pull/126128)
  Internal Changes
  These changes do not affect any public interfaces of Rust, but they represent
  significant improvements to the performance or internals of rustc and related
  tools.
- [Add a Rust-for Linux `auto` CI job to check kernel builds.](https://github.com/rust-lang/rust/pull/125209/)</changelog>
  <changelog author="william.brown@suse.com" date="1725969600">- Resolve wasm32-wasi build issues</changelog>
</package>
<package pkgid="c0c0f063e994c3616689cd48a785a06ced03651b7cbd12d12713cd3bcf32df1c" name="cargo1.81" arch="s390x">
  <version epoch="0" ver="1.81.0" rel="150500.11.3.1"/>
  <changelog author="xiaoguang.wang@suse.com" date="1725883200">Version 1.81.0 (2024-09-05)
  Language
--------
- [Abort on uncaught panics in `extern "C"` functions.](https://github.com/rust-lang/rust/pull/116088/)
- [Fix ambiguous cases of multiple `&amp;` in elided self lifetimes.](https://github.com/rust-lang/rust/pull/117967/)
- [Stabilize `#[expect]` for lints (RFC 2383),](https://github.com/rust-lang/rust/pull/120924/) like `#[allow]` with a warning if the lint is _not_ fulfilled.
- [Change method resolution to constrain hidden types instead of rejecting method candidates.](https://github.com/rust-lang/rust/pull/123962/)
- [Bump `elided_lifetimes_in_associated_constant` to deny.](https://github.com/rust-lang/rust/pull/124211/)
- [`offset_from`: always allow pointers to point to the same address.](https://github.com/rust-lang/rust/pull/124921/)
- [Allow constraining opaque types during subtyping in the trait system.](https://github.com/rust-lang/rust/pull/125447/)
- [Allow constraining opaque types during various unsizing casts.](https://github.com/rust-lang/rust/pull/125610/)
- [Deny keyword lifetimes pre-expansion.](https://github.com/rust-lang/rust/pull/126762/)
  Compiler
--------
- [Make casts of pointers to trait objects stricter.](https://github.com/rust-lang/rust/pull/120248/)
- [Check alias args for well-formedness even if they have escaping bound vars.](https://github.com/rust-lang/rust/pull/123737/)
- [Deprecate no-op codegen option `-Cinline-threshold=...`.](https://github.com/rust-lang/rust/pull/124712/)
- [Re-implement a type-size based limit.](https://github.com/rust-lang/rust/pull/125507/)
- [Properly account for alignment in `transmute` size checks.](https://github.com/rust-lang/rust/pull/125740/)
- [Remove the `box_pointers` lint.](https://github.com/rust-lang/rust/pull/126018/)
- [Ensure the interpreter checks bool/char for validity when they are used in a cast.](https://github.com/rust-lang/rust/pull/126265/)
- [Improve coverage instrumentation for functions containing nested items.](https://github.com/rust-lang/rust/pull/127199/)
- Target changes:
  - [Add Tier 3 `no_std` Xtensa targets:](https://github.com/rust-lang/rust/pull/125141/) `xtensa-esp32-none-elf`, `xtensa-esp32s2-none-elf`, `xtensa-esp32s3-none-elf`
  - [Add Tier 3 `std` Xtensa targets:](https://github.com/rust-lang/rust/pull/126380/) `xtensa-esp32-espidf`, `xtensa-esp32s2-espidf`, `xtensa-esp32s3-espidf`
  - [Add Tier 3 i686 Redox OS target:](https://github.com/rust-lang/rust/pull/126192/) `i686-unknown-redox`
  - [Promote `arm64ec-pc-windows-msvc` to Tier 2.](https://github.com/rust-lang/rust/pull/126039/)
  - [Promote `loongarch64-unknown-linux-musl` to Tier 2 with host tools.](https://github.com/rust-lang/rust/pull/126298/)
  - [Enable full tools and profiler for LoongArch Linux targets.](https://github.com/rust-lang/rust/pull/127078/)
  - [Unconditionally warn on usage of `wasm32-wasi`.](https://github.com/rust-lang/rust/pull/126662/) (see compatibility note below)
  - Refer to Rust's [platform support page][platform-support-doc] for more information on Rust's tiered platform support.
  Libraries
---------
- [Split core's `PanicInfo` and std's `PanicInfo`.](https://github.com/rust-lang/rust/pull/115974/) (see compatibility note below)
- [Generalize `{Rc,Arc}::make_mut()` to unsized types.](https://github.com/rust-lang/rust/pull/116113/)
- [Replace sort implementations with stable `driftsort` and unstable `ipnsort`.](https://github.com/rust-lang/rust/pull/124032/) All `slice::sort*` and `slice::select_nth*` methods are expected to see significant performance improvements. See the [research project](https://github.com/Voultapher/sort-research-rs) for more details.
- [Document behavior of `create_dir_all` with respect to empty paths.](https://github.com/rust-lang/rust/pull/125112/)
- [Fix interleaved output in the default panic hook when multiple threads panic simultaneously.](https://github.com/rust-lang/rust/pull/127397/)
  Stabilized APIs
- [`core::error`](https://doc.rust-lang.org/stable/core/error/index.html)
- [`hint::assert_unchecked`](https://doc.rust-lang.org/stable/core/hint/fn.assert_unchecked.html)
- [`fs::exists`](https://doc.rust-lang.org/stable/std/fs/fn.exists.html)
- [`AtomicBool::fetch_not`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicBool.html#method.fetch_not)
- [`Duration::abs_diff`](https://doc.rust-lang.org/stable/core/time/struct.Duration.html#method.abs_diff)
- [`IoSlice::advance`](https://doc.rust-lang.org/stable/std/io/struct.IoSlice.html#method.advance)
- [`IoSlice::advance_slices`](https://doc.rust-lang.org/stable/std/io/struct.IoSlice.html#method.advance_slices)
- [`IoSliceMut::advance`](https://doc.rust-lang.org/stable/std/io/struct.IoSliceMut.html#method.advance)
- [`IoSliceMut::advance_slices`](https://doc.rust-lang.org/stable/std/io/struct.IoSliceMut.html#method.advance_slices)
- [`PanicHookInfo`](https://doc.rust-lang.org/stable/std/panic/struct.PanicHookInfo.html)
- [`PanicInfo::message`](https://doc.rust-lang.org/stable/core/panic/struct.PanicInfo.html#method.message)
- [`PanicMessage`](https://doc.rust-lang.org/stable/core/panic/struct.PanicMessage.html)
  These APIs are now stable in const contexts:
- [`char::from_u32_unchecked`](https://doc.rust-lang.org/stable/core/char/fn.from_u32_unchecked.html) (function)
- [`char::from_u32_unchecked`](https://doc.rust-lang.org/stable/core/primitive.char.html#method.from_u32_unchecked) (method)
- [`CStr::count_bytes`](https://doc.rust-lang.org/stable/core/ffi/c_str/struct.CStr.html#method.count_bytes)
- [`CStr::from_ptr`](https://doc.rust-lang.org/stable/core/ffi/c_str/struct.CStr.html#method.from_ptr)
  Cargo
-----
- [Generated `.cargo_vcs_info.json` is always included, even when `--allow-dirty` is passed.](https://github.com/rust-lang/cargo/pull/13960/)
- [Disallow `package.license-file` and `package.readme` pointing to non-existent files during packaging.](https://github.com/rust-lang/cargo/pull/13921/)
- [Disallow passing `--release`/`--debug` flag along with the `--profile` flag.](https://github.com/rust-lang/cargo/pull/13971/)
- [Remove `lib.plugin` key support in `Cargo.toml`. Rust plugin support has been deprecated for four years and was removed in 1.75.0.](https://github.com/rust-lang/cargo/pull/13902/)
  Compatibility Notes
  * Usage of the `wasm32-wasi` target will now issue a compiler warning and request users switch to the `wasm32-wasip1` target instead. Both targets are the same, `wasm32-wasi` is only being renamed, and this [change to the WASI target](https://blog.rust-lang.org/2024/04/09/updates-to-rusts-wasi-targets.html) is being done to enable removing `wasm32-wasi` in January 2025.
  * We have renamed `std::panic::PanicInfo` to `std::panic::PanicHookInfo`. The old name will continue to work as an alias, but will result in a deprecation warning starting in Rust 1.82.0.
  `core::panic::PanicInfo` will remain unchanged, however, as this is now a *different type*.
  The reason is that these types have different roles: `std::panic::PanicHookInfo` is the argument to the [panic hook](https://doc.rust-lang.org/stable/std/panic/fn.set_hook.html) in std context (where panics can have an arbitrary payload), while `core::panic::PanicInfo` is the argument to the [`#[panic_handler]`](https://doc.rust-lang.org/nomicon/panic-handler.html) in no_std context (where panics always carry a formatted *message*). Separating these types allows us to add more useful methods to these types, such as `std::panic::PanicHookInfo::payload_as_str()` and `core::panic::PanicInfo::message()`.
  * The new sort implementations may panic if a type's implementation of [`Ord`](https://doc.rust-lang.org/std/cmp/trait.Ord.html) (or the given comparison function) does not implement a [total order](https://en.wikipedia.org/wiki/Total_order) as the trait requires. `Ord`'s supertraits (`PartialOrd`, `Eq`, and `PartialEq`) must also be consistent. The previous implementations would not "notice" any problem, but the new implementations have a good chance of detecting inconsistencies, throwing a panic rather than returning knowingly unsorted data.
  * [In very rare cases, a change in the internal evaluation order of the trait
  solver may result in new fatal overflow errors.](https://github.com/rust-lang/rust/pull/126128)
  Internal Changes
  These changes do not affect any public interfaces of Rust, but they represent
  significant improvements to the performance or internals of rustc and related
  tools.
- [Add a Rust-for Linux `auto` CI job to check kernel builds.](https://github.com/rust-lang/rust/pull/125209/)</changelog>
  <changelog author="william.brown@suse.com" date="1725969600">- Resolve wasm32-wasi build issues</changelog>
</package>
<package pkgid="9722e367782e2231fbfee9e318e8f5f33a4a4409de63b9c8db519afce105bd98" name="cargo1.81" arch="x86_64">
  <version epoch="0" ver="1.81.0" rel="150500.11.3.1"/>
  <changelog author="xiaoguang.wang@suse.com" date="1725883200">Version 1.81.0 (2024-09-05)
  Language
--------
- [Abort on uncaught panics in `extern "C"` functions.](https://github.com/rust-lang/rust/pull/116088/)
- [Fix ambiguous cases of multiple `&amp;` in elided self lifetimes.](https://github.com/rust-lang/rust/pull/117967/)
- [Stabilize `#[expect]` for lints (RFC 2383),](https://github.com/rust-lang/rust/pull/120924/) like `#[allow]` with a warning if the lint is _not_ fulfilled.
- [Change method resolution to constrain hidden types instead of rejecting method candidates.](https://github.com/rust-lang/rust/pull/123962/)
- [Bump `elided_lifetimes_in_associated_constant` to deny.](https://github.com/rust-lang/rust/pull/124211/)
- [`offset_from`: always allow pointers to point to the same address.](https://github.com/rust-lang/rust/pull/124921/)
- [Allow constraining opaque types during subtyping in the trait system.](https://github.com/rust-lang/rust/pull/125447/)
- [Allow constraining opaque types during various unsizing casts.](https://github.com/rust-lang/rust/pull/125610/)
- [Deny keyword lifetimes pre-expansion.](https://github.com/rust-lang/rust/pull/126762/)
  Compiler
--------
- [Make casts of pointers to trait objects stricter.](https://github.com/rust-lang/rust/pull/120248/)
- [Check alias args for well-formedness even if they have escaping bound vars.](https://github.com/rust-lang/rust/pull/123737/)
- [Deprecate no-op codegen option `-Cinline-threshold=...`.](https://github.com/rust-lang/rust/pull/124712/)
- [Re-implement a type-size based limit.](https://github.com/rust-lang/rust/pull/125507/)
- [Properly account for alignment in `transmute` size checks.](https://github.com/rust-lang/rust/pull/125740/)
- [Remove the `box_pointers` lint.](https://github.com/rust-lang/rust/pull/126018/)
- [Ensure the interpreter checks bool/char for validity when they are used in a cast.](https://github.com/rust-lang/rust/pull/126265/)
- [Improve coverage instrumentation for functions containing nested items.](https://github.com/rust-lang/rust/pull/127199/)
- Target changes:
  - [Add Tier 3 `no_std` Xtensa targets:](https://github.com/rust-lang/rust/pull/125141/) `xtensa-esp32-none-elf`, `xtensa-esp32s2-none-elf`, `xtensa-esp32s3-none-elf`
  - [Add Tier 3 `std` Xtensa targets:](https://github.com/rust-lang/rust/pull/126380/) `xtensa-esp32-espidf`, `xtensa-esp32s2-espidf`, `xtensa-esp32s3-espidf`
  - [Add Tier 3 i686 Redox OS target:](https://github.com/rust-lang/rust/pull/126192/) `i686-unknown-redox`
  - [Promote `arm64ec-pc-windows-msvc` to Tier 2.](https://github.com/rust-lang/rust/pull/126039/)
  - [Promote `loongarch64-unknown-linux-musl` to Tier 2 with host tools.](https://github.com/rust-lang/rust/pull/126298/)
  - [Enable full tools and profiler for LoongArch Linux targets.](https://github.com/rust-lang/rust/pull/127078/)
  - [Unconditionally warn on usage of `wasm32-wasi`.](https://github.com/rust-lang/rust/pull/126662/) (see compatibility note below)
  - Refer to Rust's [platform support page][platform-support-doc] for more information on Rust's tiered platform support.
  Libraries
---------
- [Split core's `PanicInfo` and std's `PanicInfo`.](https://github.com/rust-lang/rust/pull/115974/) (see compatibility note below)
- [Generalize `{Rc,Arc}::make_mut()` to unsized types.](https://github.com/rust-lang/rust/pull/116113/)
- [Replace sort implementations with stable `driftsort` and unstable `ipnsort`.](https://github.com/rust-lang/rust/pull/124032/) All `slice::sort*` and `slice::select_nth*` methods are expected to see significant performance improvements. See the [research project](https://github.com/Voultapher/sort-research-rs) for more details.
- [Document behavior of `create_dir_all` with respect to empty paths.](https://github.com/rust-lang/rust/pull/125112/)
- [Fix interleaved output in the default panic hook when multiple threads panic simultaneously.](https://github.com/rust-lang/rust/pull/127397/)
  Stabilized APIs
- [`core::error`](https://doc.rust-lang.org/stable/core/error/index.html)
- [`hint::assert_unchecked`](https://doc.rust-lang.org/stable/core/hint/fn.assert_unchecked.html)
- [`fs::exists`](https://doc.rust-lang.org/stable/std/fs/fn.exists.html)
- [`AtomicBool::fetch_not`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicBool.html#method.fetch_not)
- [`Duration::abs_diff`](https://doc.rust-lang.org/stable/core/time/struct.Duration.html#method.abs_diff)
- [`IoSlice::advance`](https://doc.rust-lang.org/stable/std/io/struct.IoSlice.html#method.advance)
- [`IoSlice::advance_slices`](https://doc.rust-lang.org/stable/std/io/struct.IoSlice.html#method.advance_slices)
- [`IoSliceMut::advance`](https://doc.rust-lang.org/stable/std/io/struct.IoSliceMut.html#method.advance)
- [`IoSliceMut::advance_slices`](https://doc.rust-lang.org/stable/std/io/struct.IoSliceMut.html#method.advance_slices)
- [`PanicHookInfo`](https://doc.rust-lang.org/stable/std/panic/struct.PanicHookInfo.html)
- [`PanicInfo::message`](https://doc.rust-lang.org/stable/core/panic/struct.PanicInfo.html#method.message)
- [`PanicMessage`](https://doc.rust-lang.org/stable/core/panic/struct.PanicMessage.html)
  These APIs are now stable in const contexts:
- [`char::from_u32_unchecked`](https://doc.rust-lang.org/stable/core/char/fn.from_u32_unchecked.html) (function)
- [`char::from_u32_unchecked`](https://doc.rust-lang.org/stable/core/primitive.char.html#method.from_u32_unchecked) (method)
- [`CStr::count_bytes`](https://doc.rust-lang.org/stable/core/ffi/c_str/struct.CStr.html#method.count_bytes)
- [`CStr::from_ptr`](https://doc.rust-lang.org/stable/core/ffi/c_str/struct.CStr.html#method.from_ptr)
  Cargo
-----
- [Generated `.cargo_vcs_info.json` is always included, even when `--allow-dirty` is passed.](https://github.com/rust-lang/cargo/pull/13960/)
- [Disallow `package.license-file` and `package.readme` pointing to non-existent files during packaging.](https://github.com/rust-lang/cargo/pull/13921/)
- [Disallow passing `--release`/`--debug` flag along with the `--profile` flag.](https://github.com/rust-lang/cargo/pull/13971/)
- [Remove `lib.plugin` key support in `Cargo.toml`. Rust plugin support has been deprecated for four years and was removed in 1.75.0.](https://github.com/rust-lang/cargo/pull/13902/)
  Compatibility Notes
  * Usage of the `wasm32-wasi` target will now issue a compiler warning and request users switch to the `wasm32-wasip1` target instead. Both targets are the same, `wasm32-wasi` is only being renamed, and this [change to the WASI target](https://blog.rust-lang.org/2024/04/09/updates-to-rusts-wasi-targets.html) is being done to enable removing `wasm32-wasi` in January 2025.
  * We have renamed `std::panic::PanicInfo` to `std::panic::PanicHookInfo`. The old name will continue to work as an alias, but will result in a deprecation warning starting in Rust 1.82.0.
  `core::panic::PanicInfo` will remain unchanged, however, as this is now a *different type*.
  The reason is that these types have different roles: `std::panic::PanicHookInfo` is the argument to the [panic hook](https://doc.rust-lang.org/stable/std/panic/fn.set_hook.html) in std context (where panics can have an arbitrary payload), while `core::panic::PanicInfo` is the argument to the [`#[panic_handler]`](https://doc.rust-lang.org/nomicon/panic-handler.html) in no_std context (where panics always carry a formatted *message*). Separating these types allows us to add more useful methods to these types, such as `std::panic::PanicHookInfo::payload_as_str()` and `core::panic::PanicInfo::message()`.
  * The new sort implementations may panic if a type's implementation of [`Ord`](https://doc.rust-lang.org/std/cmp/trait.Ord.html) (or the given comparison function) does not implement a [total order](https://en.wikipedia.org/wiki/Total_order) as the trait requires. `Ord`'s supertraits (`PartialOrd`, `Eq`, and `PartialEq`) must also be consistent. The previous implementations would not "notice" any problem, but the new implementations have a good chance of detecting inconsistencies, throwing a panic rather than returning knowingly unsorted data.
  * [In very rare cases, a change in the internal evaluation order of the trait
  solver may result in new fatal overflow errors.](https://github.com/rust-lang/rust/pull/126128)
  Internal Changes
  These changes do not affect any public interfaces of Rust, but they represent
  significant improvements to the performance or internals of rustc and related
  tools.
- [Add a Rust-for Linux `auto` CI job to check kernel builds.](https://github.com/rust-lang/rust/pull/125209/)</changelog>
  <changelog author="william.brown@suse.com" date="1725969600">- Resolve wasm32-wasi build issues</changelog>
</package>
<package pkgid="70b6496b0d55b6df72616304ff0f09036fe7c9c439fdc95cd3c35c7b06e6c767" name="cargo1.82" arch="aarch64">
  <version epoch="0" ver="1.82.0" rel="150500.11.3.1"/>
  <changelog author="william.brown@suse.com" date="1729598400">Version 1.82.0 (2024-10-17)
  Language
--------
- [Don't make statement nonterminals match pattern nonterminals](https://github.com/rust-lang/rust/pull/120221/)
- [Patterns matching empty types can now be omitted in common cases](https://github.com/rust-lang/rust/pull/122792)
- [Enforce supertrait outlives obligations when using trait impls](https://github.com/rust-lang/rust/pull/124336)
- [`addr_of(_mut)!` macros and the newly stabilized `&amp;raw (const|mut)` are now safe to use with all static items](https://github.com/rust-lang/rust/pull/125834)
- [size_of_val_raw: for length 0 this is safe to call](https://github.com/rust-lang/rust/pull/126152/)
- [Reorder trait bound modifiers *after* `for&lt;...&gt;` binder in trait bounds](https://github.com/rust-lang/rust/pull/127054/)
- [Stabilize opaque type precise capturing (RFC 3617)](https://github.com/rust-lang/rust/pull/127672)
- [Stabilize `&amp;raw const` and `&amp;raw mut` operators (RFC 2582)](https://github.com/rust-lang/rust/pull/127679)
- [Stabilize unsafe extern blocks (RFC 3484)](https://github.com/rust-lang/rust/pull/127921)
- [Stabilize nested field access in `offset_of!`](https://github.com/rust-lang/rust/pull/128284)
- [Do not require `T` to be live when dropping `[T; 0]`](https://github.com/rust-lang/rust/pull/128438)
- [Stabilize `const` operands in inline assembly](https://github.com/rust-lang/rust/pull/128570)
- [Stabilize floating-point arithmetic in `const fn`](https://github.com/rust-lang/rust/pull/128596)
- [Stabilize explicit opt-in to unsafe attributes](https://github.com/rust-lang/rust/pull/128771)
- [Document NaN bit patterns guarantees](https://github.com/rust-lang/rust/pull/129559)
  Compiler
--------
- [Promote riscv64gc-unknown-linux-musl to tier 2](https://github.com/rust-lang/rust/pull/122049)
- [Promote Mac Catalyst targets `aarch64-apple-ios-macabi` and `x86_64-apple-ios-macabi` to Tier 2, and ship them with rustup](https://github.com/rust-lang/rust/pull/126450)
- [Add tier 3 NuttX based targets for RISC-V and ARM](https://github.com/rust-lang/rust/pull/127755)
- [Add tier 3 powerpc-unknown-linux-muslspe target](https://github.com/rust-lang/rust/pull/127905)
- [Improved diagnostics to explain why a pattern is unreachable](https://github.com/rust-lang/rust/pull/128034)
- [The compiler now triggers the unreachable code warning properly for async functions that don't return/are `-&gt; !`](https://github.com/rust-lang/rust/pull/128443)
- [Promote `aarch64-apple-darwin` to Tier 1](https://github.com/rust-lang/rust/pull/128592)
- [Add Trusty OS target `aarch64-unknown-trusty` and `armv7-unknown-trusty` as tier 3 targets](https://github.com/rust-lang/rust/pull/129490)
- [Promote `wasm32-wasip2` to Tier 2.](https://github.com/rust-lang/rust/pull/126967/)
  Libraries
---------
- [Generalize `{Rc,Arc}::make_mut()` to `Path`, `OsStr`, and `CStr`.](https://github.com/rust-lang/rust/pull/126877)
  Stabilized APIs
- [`std::thread::Builder::spawn_unchecked`](https://doc.rust-lang.org/stable/std/thread/struct.Builder.html#method.spawn_unchecked)
- [`std::str::CharIndices::offset`](https://doc.rust-lang.org/nightly/std/str/struct.CharIndices.html#method.offset)
- [`std::option::Option::is_none_or`](https://doc.rust-lang.org/nightly/std/option/enum.Option.html#method.is_none_or)
- [`[T]::is_sorted`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted)
- [`[T]::is_sorted_by`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted_by)
- [`[T]::is_sorted_by_key`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted_by_key)
- [`Iterator::is_sorted`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted)
- [`Iterator::is_sorted_by`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted_by)
- [`Iterator::is_sorted_by_key`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted_by_key)
- [`std::future::Ready::into_inner`](https://doc.rust-lang.org/nightly/std/future/struct.Ready.html#method.into_inner)
- [`std::iter::repeat_n`](https://doc.rust-lang.org/nightly/std/iter/fn.repeat_n.html)
- [`impl&lt;T: Clone&gt; DoubleEndedIterator for Take&lt;Repeat&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-DoubleEndedIterator-for-Take%3CRepeat%3CT%3E%3E)
- [`impl&lt;T: Clone&gt; ExactSizeIterator for Take&lt;Repeat&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-ExactSizeIterator-for-Take%3CRepeat%3CT%3E%3E)
- [`impl&lt;T: Clone&gt; ExactSizeIterator for Take&lt;RepeatWith&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-ExactSizeIterator-for-Take%3CRepeatWith%3CF%3E%3E)
- [`impl Default for std::collections::binary_heap::Iter`](https://doc.rust-lang.org/nightly/std/collections/binary_heap/struct.Iter.html#impl-Default-for-Iter%3C'_,+T%3E)
- [`impl Default for std::collections::btree_map::RangeMut`](https://doc.rust-lang.org/nightly/std/collections/btree_map/struct.RangeMut.html#impl-Default-for-RangeMut%3C'_,+K,+V%3E)
- [`impl Default for std::collections::btree_map::ValuesMut`](https://doc.rust-lang.org/nightly/std/collections/btree_map/struct.ValuesMut.html#impl-Default-for-ValuesMut%3C'_,+K,+V%3E)
- [`impl Default for std::collections::vec_deque::Iter`](https://doc.rust-lang.org/nightly/std/collections/vec_deque/struct.Iter.html#impl-Default-for-Iter%3C'_,+T%3E)
- [`impl Default for std::collections::vec_deque::IterMut`](https://doc.rust-lang.org/nightly/std/collections/vec_deque/struct.IterMut.html#impl-Default-for-IterMut%3C'_,+T%3E)
- [`Rc&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.new_uninit)
- [`Rc&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.assume_init)
- [`Rc&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.new_uninit_slice)
- [`Rc&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.assume_init-1)
- [`Arc&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.new_uninit)
- [`Arc&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.assume_init)
- [`Arc&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.new_uninit_slice)
- [`Arc&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.assume_init-1)
- [`Box&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.new_uninit)
- [`Box&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.assume_init)
- [`Box&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.new_uninit_slice)
- [`Box&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.assume_init-1)
- [`core::arch::x86_64::_bextri_u64`](https://doc.rust-lang.org/stable/core/arch/x86_64/fn._bextri_u64.html)
- [`core::arch::x86_64::_bextri_u32`](https://doc.rust-lang.org/stable/core/arch/x86_64/fn._bextri_u32.html)
- [`core::arch::x86::_mm_broadcastsi128_si256`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_broadcastsi128_si256.html)
- [`core::arch::x86::_mm256_stream_load_si256`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm256_stream_load_si256.html)
- [`core::arch::x86::_tzcnt_u16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._tzcnt_u16.html)
- [`core::arch::x86::_mm_extracti_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_extracti_si64.html)
- [`core::arch::x86::_mm_inserti_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_inserti_si64.html)
- [`core::arch::x86::_mm_storeu_si16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si16.html)
- [`core::arch::x86::_mm_storeu_si32`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si32.html)
- [`core::arch::x86::_mm_storeu_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si64.html)
- [`core::arch::x86::_mm_loadu_si16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_loadu_si16.html)
- [`core::arch::x86::_mm_loadu_si32`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_loadu_si32.html)
- [`core::arch::wasm32::u8x16_relaxed_swizzle`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u8x16_relaxed_swizzle.html)
- [`core::arch::wasm32::i8x16_relaxed_swizzle`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i8x16_relaxed_swizzle.html)
- [`core::arch::wasm32::i32x4_relaxed_trunc_f32x4`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_trunc_f32x4.html)
- [`core::arch::wasm32::u32x4_relaxed_trunc_f32x4`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_trunc_f32x4.html)
- [`core::arch::wasm32::i32x4_relaxed_trunc_f64x2_zero`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_trunc_f64x2_zero.html)
- [`core::arch::wasm32::u32x4_relaxed_trunc_f64x2_zero`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_trunc_f64x2_zero.html)
- [`core::arch::wasm32::f32x4_relaxed_madd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_madd.html)
- [`core::arch::wasm32::f32x4_relaxed_nmadd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_nmadd.html)
- [`core::arch::wasm32::f64x2_relaxed_madd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_madd.html)
- [`core::arch::wasm32::f64x2_relaxed_nmadd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_nmadd.html)
- [`core::arch::wasm32::i8x16_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i8x16_relaxed_laneselect.html)
- [`core::arch::wasm32::u8x16_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u8x16_relaxed_laneselect.html)
- [`core::arch::wasm32::i16x8_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_laneselect.html)
- [`core::arch::wasm32::u16x8_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_laneselect.html)
- [`core::arch::wasm32::i32x4_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_laneselect.html)
- [`core::arch::wasm32::u32x4_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_laneselect.html)
- [`core::arch::wasm32::i64x2_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i64x2_relaxed_laneselect.html)
- [`core::arch::wasm32::u64x2_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u64x2_relaxed_laneselect.html)
- [`core::arch::wasm32::f32x4_relaxed_min`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_min.html)
- [`core::arch::wasm32::f32x4_relaxed_max`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_max.html)
- [`core::arch::wasm32::f64x2_relaxed_min`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_min.html)
- [`core::arch::wasm32::f64x2_relaxed_max`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_max.html)
- [`core::arch::wasm32::i16x8_relaxed_q15mulr`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_q15mulr.html)
- [`core::arch::wasm32::u16x8_relaxed_q15mulr`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_q15mulr.html)
- [`core::arch::wasm32::i16x8_relaxed_dot_i8x16_i7x16`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_dot_i8x16_i7x16.html)
- [`core::arch::wasm32::u16x8_relaxed_dot_i8x16_i7x16`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_dot_i8x16_i7x16.html)
- [`core::arch::wasm32::i32x4_relaxed_dot_i8x16_i7x16_add`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_dot_i8x16_i7x16_add.html)
- [`core::arch::wasm32::u32x4_relaxed_dot_i8x16_i7x16_add`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_dot_i8x16_i7x16_add.html)
  These APIs are now stable in const contexts:
- [`std::task::Waker::from_raw`](https://doc.rust-lang.org/nightly/std/task/struct.Waker.html#method.from_raw)
- [`std::task::Context::from_waker`](https://doc.rust-lang.org/nightly/std/task/struct.Context.html#method.from_waker)
- [`std::task::Context::waker`](https://doc.rust-lang.org/nightly/std/task/struct.Context.html#method.waker)
- [`$integer::from_str_radix`](https://doc.rust-lang.org/nightly/std/primitive.u32.html#method.from_str_radix)
- [`std::num::ParseIntError::kind`](https://doc.rust-lang.org/nightly/std/num/struct.ParseIntError.html#method.kind)
  Cargo
-----
- [feat: Add `info` cargo subcommand](https://github.com/rust-lang/cargo/pull/14141/)
  Compatibility Notes
  - We now [disallow setting some built-in cfgs via the command-line](https://github.com/rust-lang/rust/pull/126158) with the newly added [`explicit_builtin_cfgs_in_flags`](https://doc.rust-lang.org/rustc/lints/listing/deny-by-default.html#explicit-builtin-cfgs-in-flags) lint in order to prevent incoherent state, eg. `windows` cfg active but target is Linux based. The appropriate [`rustc` flag](https://doc.rust-lang.org/rustc/command-line-arguments.html) should be used instead.
- The standard library has a new implementation of `binary_search` which is significantly improves performance ([#128254](https://github.com/rust-lang/rust/pull/128254)). However when a sorted slice has multiple values which compare equal, the new implementation may select a different value among the equal ones than the old implementation.
- [illumos/Solaris now sets `MSG_NOSIGNAL` when writing to sockets](https://github.com/rust-lang/rust/pull/128259). This avoids killing the process with SIGPIPE when writing to a closed socket, which matches the existing behavior on other UNIX targets.
- [Removes a problematic hack that always passed the --whole-archive linker flag for tests, which may cause linker errors for code accidentally relying on it.](https://github.com/rust-lang/rust/pull/128400)
- The WebAssembly target features `multivalue` and `reference-types` are now
  both enabled by default. These two features both have subtle changes implied
  for generated WebAssembly binaries. For the `multivalue` feature, WebAssembly
  target support has changed when upgrading to LLVM 19. Support for generating
  functions with multiple returns no longer works and
  `-Ctarget-feature=+multivalue` has a different meaning than it did in LLVM 18
  and prior. There is no longer any supported means to generate a module that has
  a function with multiple returns in WebAssembly from Rust source code. For the
  `reference-types` feature the encoding of immediates in the `call_indirect`, a
  commonly used instruction by the WebAssembly backend, has changed. Validators
  and parsers which don't understand the `reference-types` proposal will no
  longer accept modules produced by LLVM due to this change in encoding of
  immediates. Additionally these features being enabled are encoded in the
  `target_features` custom section and may affect downstream tooling such as
  `wasm-opt` consuming the module. Generating a WebAssembly module that disables
  default features requires `-Zbuild-std` support from Cargo and more information
  can be found at
  [rust-lang/rust#128511](https://github.com/rust-lang/rust/pull/128511).
- [Rust now raises unsafety errors for union patterns in parameter-position](https://github.com/rust-lang/rust/pull/130531)</changelog>
</package>
<package pkgid="911cf6b0e2fb6c4b699423700a5ce51e5d94c3c0111011f13497ebc23ff77006" name="cargo1.82" arch="ppc64le">
  <version epoch="0" ver="1.82.0" rel="150500.11.3.1"/>
  <changelog author="william.brown@suse.com" date="1729598400">Version 1.82.0 (2024-10-17)
  Language
--------
- [Don't make statement nonterminals match pattern nonterminals](https://github.com/rust-lang/rust/pull/120221/)
- [Patterns matching empty types can now be omitted in common cases](https://github.com/rust-lang/rust/pull/122792)
- [Enforce supertrait outlives obligations when using trait impls](https://github.com/rust-lang/rust/pull/124336)
- [`addr_of(_mut)!` macros and the newly stabilized `&amp;raw (const|mut)` are now safe to use with all static items](https://github.com/rust-lang/rust/pull/125834)
- [size_of_val_raw: for length 0 this is safe to call](https://github.com/rust-lang/rust/pull/126152/)
- [Reorder trait bound modifiers *after* `for&lt;...&gt;` binder in trait bounds](https://github.com/rust-lang/rust/pull/127054/)
- [Stabilize opaque type precise capturing (RFC 3617)](https://github.com/rust-lang/rust/pull/127672)
- [Stabilize `&amp;raw const` and `&amp;raw mut` operators (RFC 2582)](https://github.com/rust-lang/rust/pull/127679)
- [Stabilize unsafe extern blocks (RFC 3484)](https://github.com/rust-lang/rust/pull/127921)
- [Stabilize nested field access in `offset_of!`](https://github.com/rust-lang/rust/pull/128284)
- [Do not require `T` to be live when dropping `[T; 0]`](https://github.com/rust-lang/rust/pull/128438)
- [Stabilize `const` operands in inline assembly](https://github.com/rust-lang/rust/pull/128570)
- [Stabilize floating-point arithmetic in `const fn`](https://github.com/rust-lang/rust/pull/128596)
- [Stabilize explicit opt-in to unsafe attributes](https://github.com/rust-lang/rust/pull/128771)
- [Document NaN bit patterns guarantees](https://github.com/rust-lang/rust/pull/129559)
  Compiler
--------
- [Promote riscv64gc-unknown-linux-musl to tier 2](https://github.com/rust-lang/rust/pull/122049)
- [Promote Mac Catalyst targets `aarch64-apple-ios-macabi` and `x86_64-apple-ios-macabi` to Tier 2, and ship them with rustup](https://github.com/rust-lang/rust/pull/126450)
- [Add tier 3 NuttX based targets for RISC-V and ARM](https://github.com/rust-lang/rust/pull/127755)
- [Add tier 3 powerpc-unknown-linux-muslspe target](https://github.com/rust-lang/rust/pull/127905)
- [Improved diagnostics to explain why a pattern is unreachable](https://github.com/rust-lang/rust/pull/128034)
- [The compiler now triggers the unreachable code warning properly for async functions that don't return/are `-&gt; !`](https://github.com/rust-lang/rust/pull/128443)
- [Promote `aarch64-apple-darwin` to Tier 1](https://github.com/rust-lang/rust/pull/128592)
- [Add Trusty OS target `aarch64-unknown-trusty` and `armv7-unknown-trusty` as tier 3 targets](https://github.com/rust-lang/rust/pull/129490)
- [Promote `wasm32-wasip2` to Tier 2.](https://github.com/rust-lang/rust/pull/126967/)
  Libraries
---------
- [Generalize `{Rc,Arc}::make_mut()` to `Path`, `OsStr`, and `CStr`.](https://github.com/rust-lang/rust/pull/126877)
  Stabilized APIs
- [`std::thread::Builder::spawn_unchecked`](https://doc.rust-lang.org/stable/std/thread/struct.Builder.html#method.spawn_unchecked)
- [`std::str::CharIndices::offset`](https://doc.rust-lang.org/nightly/std/str/struct.CharIndices.html#method.offset)
- [`std::option::Option::is_none_or`](https://doc.rust-lang.org/nightly/std/option/enum.Option.html#method.is_none_or)
- [`[T]::is_sorted`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted)
- [`[T]::is_sorted_by`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted_by)
- [`[T]::is_sorted_by_key`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted_by_key)
- [`Iterator::is_sorted`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted)
- [`Iterator::is_sorted_by`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted_by)
- [`Iterator::is_sorted_by_key`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted_by_key)
- [`std::future::Ready::into_inner`](https://doc.rust-lang.org/nightly/std/future/struct.Ready.html#method.into_inner)
- [`std::iter::repeat_n`](https://doc.rust-lang.org/nightly/std/iter/fn.repeat_n.html)
- [`impl&lt;T: Clone&gt; DoubleEndedIterator for Take&lt;Repeat&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-DoubleEndedIterator-for-Take%3CRepeat%3CT%3E%3E)
- [`impl&lt;T: Clone&gt; ExactSizeIterator for Take&lt;Repeat&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-ExactSizeIterator-for-Take%3CRepeat%3CT%3E%3E)
- [`impl&lt;T: Clone&gt; ExactSizeIterator for Take&lt;RepeatWith&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-ExactSizeIterator-for-Take%3CRepeatWith%3CF%3E%3E)
- [`impl Default for std::collections::binary_heap::Iter`](https://doc.rust-lang.org/nightly/std/collections/binary_heap/struct.Iter.html#impl-Default-for-Iter%3C'_,+T%3E)
- [`impl Default for std::collections::btree_map::RangeMut`](https://doc.rust-lang.org/nightly/std/collections/btree_map/struct.RangeMut.html#impl-Default-for-RangeMut%3C'_,+K,+V%3E)
- [`impl Default for std::collections::btree_map::ValuesMut`](https://doc.rust-lang.org/nightly/std/collections/btree_map/struct.ValuesMut.html#impl-Default-for-ValuesMut%3C'_,+K,+V%3E)
- [`impl Default for std::collections::vec_deque::Iter`](https://doc.rust-lang.org/nightly/std/collections/vec_deque/struct.Iter.html#impl-Default-for-Iter%3C'_,+T%3E)
- [`impl Default for std::collections::vec_deque::IterMut`](https://doc.rust-lang.org/nightly/std/collections/vec_deque/struct.IterMut.html#impl-Default-for-IterMut%3C'_,+T%3E)
- [`Rc&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.new_uninit)
- [`Rc&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.assume_init)
- [`Rc&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.new_uninit_slice)
- [`Rc&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.assume_init-1)
- [`Arc&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.new_uninit)
- [`Arc&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.assume_init)
- [`Arc&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.new_uninit_slice)
- [`Arc&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.assume_init-1)
- [`Box&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.new_uninit)
- [`Box&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.assume_init)
- [`Box&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.new_uninit_slice)
- [`Box&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.assume_init-1)
- [`core::arch::x86_64::_bextri_u64`](https://doc.rust-lang.org/stable/core/arch/x86_64/fn._bextri_u64.html)
- [`core::arch::x86_64::_bextri_u32`](https://doc.rust-lang.org/stable/core/arch/x86_64/fn._bextri_u32.html)
- [`core::arch::x86::_mm_broadcastsi128_si256`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_broadcastsi128_si256.html)
- [`core::arch::x86::_mm256_stream_load_si256`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm256_stream_load_si256.html)
- [`core::arch::x86::_tzcnt_u16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._tzcnt_u16.html)
- [`core::arch::x86::_mm_extracti_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_extracti_si64.html)
- [`core::arch::x86::_mm_inserti_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_inserti_si64.html)
- [`core::arch::x86::_mm_storeu_si16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si16.html)
- [`core::arch::x86::_mm_storeu_si32`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si32.html)
- [`core::arch::x86::_mm_storeu_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si64.html)
- [`core::arch::x86::_mm_loadu_si16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_loadu_si16.html)
- [`core::arch::x86::_mm_loadu_si32`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_loadu_si32.html)
- [`core::arch::wasm32::u8x16_relaxed_swizzle`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u8x16_relaxed_swizzle.html)
- [`core::arch::wasm32::i8x16_relaxed_swizzle`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i8x16_relaxed_swizzle.html)
- [`core::arch::wasm32::i32x4_relaxed_trunc_f32x4`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_trunc_f32x4.html)
- [`core::arch::wasm32::u32x4_relaxed_trunc_f32x4`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_trunc_f32x4.html)
- [`core::arch::wasm32::i32x4_relaxed_trunc_f64x2_zero`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_trunc_f64x2_zero.html)
- [`core::arch::wasm32::u32x4_relaxed_trunc_f64x2_zero`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_trunc_f64x2_zero.html)
- [`core::arch::wasm32::f32x4_relaxed_madd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_madd.html)
- [`core::arch::wasm32::f32x4_relaxed_nmadd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_nmadd.html)
- [`core::arch::wasm32::f64x2_relaxed_madd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_madd.html)
- [`core::arch::wasm32::f64x2_relaxed_nmadd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_nmadd.html)
- [`core::arch::wasm32::i8x16_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i8x16_relaxed_laneselect.html)
- [`core::arch::wasm32::u8x16_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u8x16_relaxed_laneselect.html)
- [`core::arch::wasm32::i16x8_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_laneselect.html)
- [`core::arch::wasm32::u16x8_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_laneselect.html)
- [`core::arch::wasm32::i32x4_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_laneselect.html)
- [`core::arch::wasm32::u32x4_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_laneselect.html)
- [`core::arch::wasm32::i64x2_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i64x2_relaxed_laneselect.html)
- [`core::arch::wasm32::u64x2_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u64x2_relaxed_laneselect.html)
- [`core::arch::wasm32::f32x4_relaxed_min`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_min.html)
- [`core::arch::wasm32::f32x4_relaxed_max`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_max.html)
- [`core::arch::wasm32::f64x2_relaxed_min`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_min.html)
- [`core::arch::wasm32::f64x2_relaxed_max`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_max.html)
- [`core::arch::wasm32::i16x8_relaxed_q15mulr`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_q15mulr.html)
- [`core::arch::wasm32::u16x8_relaxed_q15mulr`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_q15mulr.html)
- [`core::arch::wasm32::i16x8_relaxed_dot_i8x16_i7x16`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_dot_i8x16_i7x16.html)
- [`core::arch::wasm32::u16x8_relaxed_dot_i8x16_i7x16`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_dot_i8x16_i7x16.html)
- [`core::arch::wasm32::i32x4_relaxed_dot_i8x16_i7x16_add`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_dot_i8x16_i7x16_add.html)
- [`core::arch::wasm32::u32x4_relaxed_dot_i8x16_i7x16_add`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_dot_i8x16_i7x16_add.html)
  These APIs are now stable in const contexts:
- [`std::task::Waker::from_raw`](https://doc.rust-lang.org/nightly/std/task/struct.Waker.html#method.from_raw)
- [`std::task::Context::from_waker`](https://doc.rust-lang.org/nightly/std/task/struct.Context.html#method.from_waker)
- [`std::task::Context::waker`](https://doc.rust-lang.org/nightly/std/task/struct.Context.html#method.waker)
- [`$integer::from_str_radix`](https://doc.rust-lang.org/nightly/std/primitive.u32.html#method.from_str_radix)
- [`std::num::ParseIntError::kind`](https://doc.rust-lang.org/nightly/std/num/struct.ParseIntError.html#method.kind)
  Cargo
-----
- [feat: Add `info` cargo subcommand](https://github.com/rust-lang/cargo/pull/14141/)
  Compatibility Notes
  - We now [disallow setting some built-in cfgs via the command-line](https://github.com/rust-lang/rust/pull/126158) with the newly added [`explicit_builtin_cfgs_in_flags`](https://doc.rust-lang.org/rustc/lints/listing/deny-by-default.html#explicit-builtin-cfgs-in-flags) lint in order to prevent incoherent state, eg. `windows` cfg active but target is Linux based. The appropriate [`rustc` flag](https://doc.rust-lang.org/rustc/command-line-arguments.html) should be used instead.
- The standard library has a new implementation of `binary_search` which is significantly improves performance ([#128254](https://github.com/rust-lang/rust/pull/128254)). However when a sorted slice has multiple values which compare equal, the new implementation may select a different value among the equal ones than the old implementation.
- [illumos/Solaris now sets `MSG_NOSIGNAL` when writing to sockets](https://github.com/rust-lang/rust/pull/128259). This avoids killing the process with SIGPIPE when writing to a closed socket, which matches the existing behavior on other UNIX targets.
- [Removes a problematic hack that always passed the --whole-archive linker flag for tests, which may cause linker errors for code accidentally relying on it.](https://github.com/rust-lang/rust/pull/128400)
- The WebAssembly target features `multivalue` and `reference-types` are now
  both enabled by default. These two features both have subtle changes implied
  for generated WebAssembly binaries. For the `multivalue` feature, WebAssembly
  target support has changed when upgrading to LLVM 19. Support for generating
  functions with multiple returns no longer works and
  `-Ctarget-feature=+multivalue` has a different meaning than it did in LLVM 18
  and prior. There is no longer any supported means to generate a module that has
  a function with multiple returns in WebAssembly from Rust source code. For the
  `reference-types` feature the encoding of immediates in the `call_indirect`, a
  commonly used instruction by the WebAssembly backend, has changed. Validators
  and parsers which don't understand the `reference-types` proposal will no
  longer accept modules produced by LLVM due to this change in encoding of
  immediates. Additionally these features being enabled are encoded in the
  `target_features` custom section and may affect downstream tooling such as
  `wasm-opt` consuming the module. Generating a WebAssembly module that disables
  default features requires `-Zbuild-std` support from Cargo and more information
  can be found at
  [rust-lang/rust#128511](https://github.com/rust-lang/rust/pull/128511).
- [Rust now raises unsafety errors for union patterns in parameter-position](https://github.com/rust-lang/rust/pull/130531)</changelog>
</package>
<package pkgid="f387c6317a12b436f885cbc7fb818f10567f5e6a3e007a82c0e268cc80e802b4" name="cargo1.82" arch="s390x">
  <version epoch="0" ver="1.82.0" rel="150500.11.3.1"/>
  <changelog author="william.brown@suse.com" date="1729598400">Version 1.82.0 (2024-10-17)
  Language
--------
- [Don't make statement nonterminals match pattern nonterminals](https://github.com/rust-lang/rust/pull/120221/)
- [Patterns matching empty types can now be omitted in common cases](https://github.com/rust-lang/rust/pull/122792)
- [Enforce supertrait outlives obligations when using trait impls](https://github.com/rust-lang/rust/pull/124336)
- [`addr_of(_mut)!` macros and the newly stabilized `&amp;raw (const|mut)` are now safe to use with all static items](https://github.com/rust-lang/rust/pull/125834)
- [size_of_val_raw: for length 0 this is safe to call](https://github.com/rust-lang/rust/pull/126152/)
- [Reorder trait bound modifiers *after* `for&lt;...&gt;` binder in trait bounds](https://github.com/rust-lang/rust/pull/127054/)
- [Stabilize opaque type precise capturing (RFC 3617)](https://github.com/rust-lang/rust/pull/127672)
- [Stabilize `&amp;raw const` and `&amp;raw mut` operators (RFC 2582)](https://github.com/rust-lang/rust/pull/127679)
- [Stabilize unsafe extern blocks (RFC 3484)](https://github.com/rust-lang/rust/pull/127921)
- [Stabilize nested field access in `offset_of!`](https://github.com/rust-lang/rust/pull/128284)
- [Do not require `T` to be live when dropping `[T; 0]`](https://github.com/rust-lang/rust/pull/128438)
- [Stabilize `const` operands in inline assembly](https://github.com/rust-lang/rust/pull/128570)
- [Stabilize floating-point arithmetic in `const fn`](https://github.com/rust-lang/rust/pull/128596)
- [Stabilize explicit opt-in to unsafe attributes](https://github.com/rust-lang/rust/pull/128771)
- [Document NaN bit patterns guarantees](https://github.com/rust-lang/rust/pull/129559)
  Compiler
--------
- [Promote riscv64gc-unknown-linux-musl to tier 2](https://github.com/rust-lang/rust/pull/122049)
- [Promote Mac Catalyst targets `aarch64-apple-ios-macabi` and `x86_64-apple-ios-macabi` to Tier 2, and ship them with rustup](https://github.com/rust-lang/rust/pull/126450)
- [Add tier 3 NuttX based targets for RISC-V and ARM](https://github.com/rust-lang/rust/pull/127755)
- [Add tier 3 powerpc-unknown-linux-muslspe target](https://github.com/rust-lang/rust/pull/127905)
- [Improved diagnostics to explain why a pattern is unreachable](https://github.com/rust-lang/rust/pull/128034)
- [The compiler now triggers the unreachable code warning properly for async functions that don't return/are `-&gt; !`](https://github.com/rust-lang/rust/pull/128443)
- [Promote `aarch64-apple-darwin` to Tier 1](https://github.com/rust-lang/rust/pull/128592)
- [Add Trusty OS target `aarch64-unknown-trusty` and `armv7-unknown-trusty` as tier 3 targets](https://github.com/rust-lang/rust/pull/129490)
- [Promote `wasm32-wasip2` to Tier 2.](https://github.com/rust-lang/rust/pull/126967/)
  Libraries
---------
- [Generalize `{Rc,Arc}::make_mut()` to `Path`, `OsStr`, and `CStr`.](https://github.com/rust-lang/rust/pull/126877)
  Stabilized APIs
- [`std::thread::Builder::spawn_unchecked`](https://doc.rust-lang.org/stable/std/thread/struct.Builder.html#method.spawn_unchecked)
- [`std::str::CharIndices::offset`](https://doc.rust-lang.org/nightly/std/str/struct.CharIndices.html#method.offset)
- [`std::option::Option::is_none_or`](https://doc.rust-lang.org/nightly/std/option/enum.Option.html#method.is_none_or)
- [`[T]::is_sorted`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted)
- [`[T]::is_sorted_by`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted_by)
- [`[T]::is_sorted_by_key`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted_by_key)
- [`Iterator::is_sorted`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted)
- [`Iterator::is_sorted_by`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted_by)
- [`Iterator::is_sorted_by_key`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted_by_key)
- [`std::future::Ready::into_inner`](https://doc.rust-lang.org/nightly/std/future/struct.Ready.html#method.into_inner)
- [`std::iter::repeat_n`](https://doc.rust-lang.org/nightly/std/iter/fn.repeat_n.html)
- [`impl&lt;T: Clone&gt; DoubleEndedIterator for Take&lt;Repeat&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-DoubleEndedIterator-for-Take%3CRepeat%3CT%3E%3E)
- [`impl&lt;T: Clone&gt; ExactSizeIterator for Take&lt;Repeat&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-ExactSizeIterator-for-Take%3CRepeat%3CT%3E%3E)
- [`impl&lt;T: Clone&gt; ExactSizeIterator for Take&lt;RepeatWith&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-ExactSizeIterator-for-Take%3CRepeatWith%3CF%3E%3E)
- [`impl Default for std::collections::binary_heap::Iter`](https://doc.rust-lang.org/nightly/std/collections/binary_heap/struct.Iter.html#impl-Default-for-Iter%3C'_,+T%3E)
- [`impl Default for std::collections::btree_map::RangeMut`](https://doc.rust-lang.org/nightly/std/collections/btree_map/struct.RangeMut.html#impl-Default-for-RangeMut%3C'_,+K,+V%3E)
- [`impl Default for std::collections::btree_map::ValuesMut`](https://doc.rust-lang.org/nightly/std/collections/btree_map/struct.ValuesMut.html#impl-Default-for-ValuesMut%3C'_,+K,+V%3E)
- [`impl Default for std::collections::vec_deque::Iter`](https://doc.rust-lang.org/nightly/std/collections/vec_deque/struct.Iter.html#impl-Default-for-Iter%3C'_,+T%3E)
- [`impl Default for std::collections::vec_deque::IterMut`](https://doc.rust-lang.org/nightly/std/collections/vec_deque/struct.IterMut.html#impl-Default-for-IterMut%3C'_,+T%3E)
- [`Rc&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.new_uninit)
- [`Rc&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.assume_init)
- [`Rc&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.new_uninit_slice)
- [`Rc&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.assume_init-1)
- [`Arc&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.new_uninit)
- [`Arc&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.assume_init)
- [`Arc&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.new_uninit_slice)
- [`Arc&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.assume_init-1)
- [`Box&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.new_uninit)
- [`Box&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.assume_init)
- [`Box&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.new_uninit_slice)
- [`Box&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.assume_init-1)
- [`core::arch::x86_64::_bextri_u64`](https://doc.rust-lang.org/stable/core/arch/x86_64/fn._bextri_u64.html)
- [`core::arch::x86_64::_bextri_u32`](https://doc.rust-lang.org/stable/core/arch/x86_64/fn._bextri_u32.html)
- [`core::arch::x86::_mm_broadcastsi128_si256`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_broadcastsi128_si256.html)
- [`core::arch::x86::_mm256_stream_load_si256`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm256_stream_load_si256.html)
- [`core::arch::x86::_tzcnt_u16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._tzcnt_u16.html)
- [`core::arch::x86::_mm_extracti_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_extracti_si64.html)
- [`core::arch::x86::_mm_inserti_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_inserti_si64.html)
- [`core::arch::x86::_mm_storeu_si16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si16.html)
- [`core::arch::x86::_mm_storeu_si32`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si32.html)
- [`core::arch::x86::_mm_storeu_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si64.html)
- [`core::arch::x86::_mm_loadu_si16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_loadu_si16.html)
- [`core::arch::x86::_mm_loadu_si32`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_loadu_si32.html)
- [`core::arch::wasm32::u8x16_relaxed_swizzle`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u8x16_relaxed_swizzle.html)
- [`core::arch::wasm32::i8x16_relaxed_swizzle`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i8x16_relaxed_swizzle.html)
- [`core::arch::wasm32::i32x4_relaxed_trunc_f32x4`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_trunc_f32x4.html)
- [`core::arch::wasm32::u32x4_relaxed_trunc_f32x4`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_trunc_f32x4.html)
- [`core::arch::wasm32::i32x4_relaxed_trunc_f64x2_zero`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_trunc_f64x2_zero.html)
- [`core::arch::wasm32::u32x4_relaxed_trunc_f64x2_zero`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_trunc_f64x2_zero.html)
- [`core::arch::wasm32::f32x4_relaxed_madd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_madd.html)
- [`core::arch::wasm32::f32x4_relaxed_nmadd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_nmadd.html)
- [`core::arch::wasm32::f64x2_relaxed_madd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_madd.html)
- [`core::arch::wasm32::f64x2_relaxed_nmadd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_nmadd.html)
- [`core::arch::wasm32::i8x16_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i8x16_relaxed_laneselect.html)
- [`core::arch::wasm32::u8x16_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u8x16_relaxed_laneselect.html)
- [`core::arch::wasm32::i16x8_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_laneselect.html)
- [`core::arch::wasm32::u16x8_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_laneselect.html)
- [`core::arch::wasm32::i32x4_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_laneselect.html)
- [`core::arch::wasm32::u32x4_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_laneselect.html)
- [`core::arch::wasm32::i64x2_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i64x2_relaxed_laneselect.html)
- [`core::arch::wasm32::u64x2_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u64x2_relaxed_laneselect.html)
- [`core::arch::wasm32::f32x4_relaxed_min`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_min.html)
- [`core::arch::wasm32::f32x4_relaxed_max`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_max.html)
- [`core::arch::wasm32::f64x2_relaxed_min`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_min.html)
- [`core::arch::wasm32::f64x2_relaxed_max`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_max.html)
- [`core::arch::wasm32::i16x8_relaxed_q15mulr`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_q15mulr.html)
- [`core::arch::wasm32::u16x8_relaxed_q15mulr`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_q15mulr.html)
- [`core::arch::wasm32::i16x8_relaxed_dot_i8x16_i7x16`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_dot_i8x16_i7x16.html)
- [`core::arch::wasm32::u16x8_relaxed_dot_i8x16_i7x16`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_dot_i8x16_i7x16.html)
- [`core::arch::wasm32::i32x4_relaxed_dot_i8x16_i7x16_add`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_dot_i8x16_i7x16_add.html)
- [`core::arch::wasm32::u32x4_relaxed_dot_i8x16_i7x16_add`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_dot_i8x16_i7x16_add.html)
  These APIs are now stable in const contexts:
- [`std::task::Waker::from_raw`](https://doc.rust-lang.org/nightly/std/task/struct.Waker.html#method.from_raw)
- [`std::task::Context::from_waker`](https://doc.rust-lang.org/nightly/std/task/struct.Context.html#method.from_waker)
- [`std::task::Context::waker`](https://doc.rust-lang.org/nightly/std/task/struct.Context.html#method.waker)
- [`$integer::from_str_radix`](https://doc.rust-lang.org/nightly/std/primitive.u32.html#method.from_str_radix)
- [`std::num::ParseIntError::kind`](https://doc.rust-lang.org/nightly/std/num/struct.ParseIntError.html#method.kind)
  Cargo
-----
- [feat: Add `info` cargo subcommand](https://github.com/rust-lang/cargo/pull/14141/)
  Compatibility Notes
  - We now [disallow setting some built-in cfgs via the command-line](https://github.com/rust-lang/rust/pull/126158) with the newly added [`explicit_builtin_cfgs_in_flags`](https://doc.rust-lang.org/rustc/lints/listing/deny-by-default.html#explicit-builtin-cfgs-in-flags) lint in order to prevent incoherent state, eg. `windows` cfg active but target is Linux based. The appropriate [`rustc` flag](https://doc.rust-lang.org/rustc/command-line-arguments.html) should be used instead.
- The standard library has a new implementation of `binary_search` which is significantly improves performance ([#128254](https://github.com/rust-lang/rust/pull/128254)). However when a sorted slice has multiple values which compare equal, the new implementation may select a different value among the equal ones than the old implementation.
- [illumos/Solaris now sets `MSG_NOSIGNAL` when writing to sockets](https://github.com/rust-lang/rust/pull/128259). This avoids killing the process with SIGPIPE when writing to a closed socket, which matches the existing behavior on other UNIX targets.
- [Removes a problematic hack that always passed the --whole-archive linker flag for tests, which may cause linker errors for code accidentally relying on it.](https://github.com/rust-lang/rust/pull/128400)
- The WebAssembly target features `multivalue` and `reference-types` are now
  both enabled by default. These two features both have subtle changes implied
  for generated WebAssembly binaries. For the `multivalue` feature, WebAssembly
  target support has changed when upgrading to LLVM 19. Support for generating
  functions with multiple returns no longer works and
  `-Ctarget-feature=+multivalue` has a different meaning than it did in LLVM 18
  and prior. There is no longer any supported means to generate a module that has
  a function with multiple returns in WebAssembly from Rust source code. For the
  `reference-types` feature the encoding of immediates in the `call_indirect`, a
  commonly used instruction by the WebAssembly backend, has changed. Validators
  and parsers which don't understand the `reference-types` proposal will no
  longer accept modules produced by LLVM due to this change in encoding of
  immediates. Additionally these features being enabled are encoded in the
  `target_features` custom section and may affect downstream tooling such as
  `wasm-opt` consuming the module. Generating a WebAssembly module that disables
  default features requires `-Zbuild-std` support from Cargo and more information
  can be found at
  [rust-lang/rust#128511](https://github.com/rust-lang/rust/pull/128511).
- [Rust now raises unsafety errors for union patterns in parameter-position](https://github.com/rust-lang/rust/pull/130531)</changelog>
</package>
<package pkgid="08dd4e8963433a06249d992c059ede8a405d3c726e248d45658feb826e4461f2" name="cargo1.82" arch="x86_64">
  <version epoch="0" ver="1.82.0" rel="150500.11.3.1"/>
  <changelog author="william.brown@suse.com" date="1729598400">Version 1.82.0 (2024-10-17)
  Language
--------
- [Don't make statement nonterminals match pattern nonterminals](https://github.com/rust-lang/rust/pull/120221/)
- [Patterns matching empty types can now be omitted in common cases](https://github.com/rust-lang/rust/pull/122792)
- [Enforce supertrait outlives obligations when using trait impls](https://github.com/rust-lang/rust/pull/124336)
- [`addr_of(_mut)!` macros and the newly stabilized `&amp;raw (const|mut)` are now safe to use with all static items](https://github.com/rust-lang/rust/pull/125834)
- [size_of_val_raw: for length 0 this is safe to call](https://github.com/rust-lang/rust/pull/126152/)
- [Reorder trait bound modifiers *after* `for&lt;...&gt;` binder in trait bounds](https://github.com/rust-lang/rust/pull/127054/)
- [Stabilize opaque type precise capturing (RFC 3617)](https://github.com/rust-lang/rust/pull/127672)
- [Stabilize `&amp;raw const` and `&amp;raw mut` operators (RFC 2582)](https://github.com/rust-lang/rust/pull/127679)
- [Stabilize unsafe extern blocks (RFC 3484)](https://github.com/rust-lang/rust/pull/127921)
- [Stabilize nested field access in `offset_of!`](https://github.com/rust-lang/rust/pull/128284)
- [Do not require `T` to be live when dropping `[T; 0]`](https://github.com/rust-lang/rust/pull/128438)
- [Stabilize `const` operands in inline assembly](https://github.com/rust-lang/rust/pull/128570)
- [Stabilize floating-point arithmetic in `const fn`](https://github.com/rust-lang/rust/pull/128596)
- [Stabilize explicit opt-in to unsafe attributes](https://github.com/rust-lang/rust/pull/128771)
- [Document NaN bit patterns guarantees](https://github.com/rust-lang/rust/pull/129559)
  Compiler
--------
- [Promote riscv64gc-unknown-linux-musl to tier 2](https://github.com/rust-lang/rust/pull/122049)
- [Promote Mac Catalyst targets `aarch64-apple-ios-macabi` and `x86_64-apple-ios-macabi` to Tier 2, and ship them with rustup](https://github.com/rust-lang/rust/pull/126450)
- [Add tier 3 NuttX based targets for RISC-V and ARM](https://github.com/rust-lang/rust/pull/127755)
- [Add tier 3 powerpc-unknown-linux-muslspe target](https://github.com/rust-lang/rust/pull/127905)
- [Improved diagnostics to explain why a pattern is unreachable](https://github.com/rust-lang/rust/pull/128034)
- [The compiler now triggers the unreachable code warning properly for async functions that don't return/are `-&gt; !`](https://github.com/rust-lang/rust/pull/128443)
- [Promote `aarch64-apple-darwin` to Tier 1](https://github.com/rust-lang/rust/pull/128592)
- [Add Trusty OS target `aarch64-unknown-trusty` and `armv7-unknown-trusty` as tier 3 targets](https://github.com/rust-lang/rust/pull/129490)
- [Promote `wasm32-wasip2` to Tier 2.](https://github.com/rust-lang/rust/pull/126967/)
  Libraries
---------
- [Generalize `{Rc,Arc}::make_mut()` to `Path`, `OsStr`, and `CStr`.](https://github.com/rust-lang/rust/pull/126877)
  Stabilized APIs
- [`std::thread::Builder::spawn_unchecked`](https://doc.rust-lang.org/stable/std/thread/struct.Builder.html#method.spawn_unchecked)
- [`std::str::CharIndices::offset`](https://doc.rust-lang.org/nightly/std/str/struct.CharIndices.html#method.offset)
- [`std::option::Option::is_none_or`](https://doc.rust-lang.org/nightly/std/option/enum.Option.html#method.is_none_or)
- [`[T]::is_sorted`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted)
- [`[T]::is_sorted_by`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted_by)
- [`[T]::is_sorted_by_key`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted_by_key)
- [`Iterator::is_sorted`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted)
- [`Iterator::is_sorted_by`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted_by)
- [`Iterator::is_sorted_by_key`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted_by_key)
- [`std::future::Ready::into_inner`](https://doc.rust-lang.org/nightly/std/future/struct.Ready.html#method.into_inner)
- [`std::iter::repeat_n`](https://doc.rust-lang.org/nightly/std/iter/fn.repeat_n.html)
- [`impl&lt;T: Clone&gt; DoubleEndedIterator for Take&lt;Repeat&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-DoubleEndedIterator-for-Take%3CRepeat%3CT%3E%3E)
- [`impl&lt;T: Clone&gt; ExactSizeIterator for Take&lt;Repeat&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-ExactSizeIterator-for-Take%3CRepeat%3CT%3E%3E)
- [`impl&lt;T: Clone&gt; ExactSizeIterator for Take&lt;RepeatWith&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-ExactSizeIterator-for-Take%3CRepeatWith%3CF%3E%3E)
- [`impl Default for std::collections::binary_heap::Iter`](https://doc.rust-lang.org/nightly/std/collections/binary_heap/struct.Iter.html#impl-Default-for-Iter%3C'_,+T%3E)
- [`impl Default for std::collections::btree_map::RangeMut`](https://doc.rust-lang.org/nightly/std/collections/btree_map/struct.RangeMut.html#impl-Default-for-RangeMut%3C'_,+K,+V%3E)
- [`impl Default for std::collections::btree_map::ValuesMut`](https://doc.rust-lang.org/nightly/std/collections/btree_map/struct.ValuesMut.html#impl-Default-for-ValuesMut%3C'_,+K,+V%3E)
- [`impl Default for std::collections::vec_deque::Iter`](https://doc.rust-lang.org/nightly/std/collections/vec_deque/struct.Iter.html#impl-Default-for-Iter%3C'_,+T%3E)
- [`impl Default for std::collections::vec_deque::IterMut`](https://doc.rust-lang.org/nightly/std/collections/vec_deque/struct.IterMut.html#impl-Default-for-IterMut%3C'_,+T%3E)
- [`Rc&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.new_uninit)
- [`Rc&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.assume_init)
- [`Rc&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.new_uninit_slice)
- [`Rc&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.assume_init-1)
- [`Arc&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.new_uninit)
- [`Arc&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.assume_init)
- [`Arc&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.new_uninit_slice)
- [`Arc&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.assume_init-1)
- [`Box&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.new_uninit)
- [`Box&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.assume_init)
- [`Box&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.new_uninit_slice)
- [`Box&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.assume_init-1)
- [`core::arch::x86_64::_bextri_u64`](https://doc.rust-lang.org/stable/core/arch/x86_64/fn._bextri_u64.html)
- [`core::arch::x86_64::_bextri_u32`](https://doc.rust-lang.org/stable/core/arch/x86_64/fn._bextri_u32.html)
- [`core::arch::x86::_mm_broadcastsi128_si256`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_broadcastsi128_si256.html)
- [`core::arch::x86::_mm256_stream_load_si256`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm256_stream_load_si256.html)
- [`core::arch::x86::_tzcnt_u16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._tzcnt_u16.html)
- [`core::arch::x86::_mm_extracti_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_extracti_si64.html)
- [`core::arch::x86::_mm_inserti_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_inserti_si64.html)
- [`core::arch::x86::_mm_storeu_si16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si16.html)
- [`core::arch::x86::_mm_storeu_si32`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si32.html)
- [`core::arch::x86::_mm_storeu_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si64.html)
- [`core::arch::x86::_mm_loadu_si16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_loadu_si16.html)
- [`core::arch::x86::_mm_loadu_si32`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_loadu_si32.html)
- [`core::arch::wasm32::u8x16_relaxed_swizzle`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u8x16_relaxed_swizzle.html)
- [`core::arch::wasm32::i8x16_relaxed_swizzle`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i8x16_relaxed_swizzle.html)
- [`core::arch::wasm32::i32x4_relaxed_trunc_f32x4`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_trunc_f32x4.html)
- [`core::arch::wasm32::u32x4_relaxed_trunc_f32x4`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_trunc_f32x4.html)
- [`core::arch::wasm32::i32x4_relaxed_trunc_f64x2_zero`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_trunc_f64x2_zero.html)
- [`core::arch::wasm32::u32x4_relaxed_trunc_f64x2_zero`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_trunc_f64x2_zero.html)
- [`core::arch::wasm32::f32x4_relaxed_madd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_madd.html)
- [`core::arch::wasm32::f32x4_relaxed_nmadd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_nmadd.html)
- [`core::arch::wasm32::f64x2_relaxed_madd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_madd.html)
- [`core::arch::wasm32::f64x2_relaxed_nmadd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_nmadd.html)
- [`core::arch::wasm32::i8x16_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i8x16_relaxed_laneselect.html)
- [`core::arch::wasm32::u8x16_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u8x16_relaxed_laneselect.html)
- [`core::arch::wasm32::i16x8_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_laneselect.html)
- [`core::arch::wasm32::u16x8_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_laneselect.html)
- [`core::arch::wasm32::i32x4_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_laneselect.html)
- [`core::arch::wasm32::u32x4_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_laneselect.html)
- [`core::arch::wasm32::i64x2_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i64x2_relaxed_laneselect.html)
- [`core::arch::wasm32::u64x2_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u64x2_relaxed_laneselect.html)
- [`core::arch::wasm32::f32x4_relaxed_min`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_min.html)
- [`core::arch::wasm32::f32x4_relaxed_max`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_max.html)
- [`core::arch::wasm32::f64x2_relaxed_min`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_min.html)
- [`core::arch::wasm32::f64x2_relaxed_max`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_max.html)
- [`core::arch::wasm32::i16x8_relaxed_q15mulr`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_q15mulr.html)
- [`core::arch::wasm32::u16x8_relaxed_q15mulr`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_q15mulr.html)
- [`core::arch::wasm32::i16x8_relaxed_dot_i8x16_i7x16`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_dot_i8x16_i7x16.html)
- [`core::arch::wasm32::u16x8_relaxed_dot_i8x16_i7x16`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_dot_i8x16_i7x16.html)
- [`core::arch::wasm32::i32x4_relaxed_dot_i8x16_i7x16_add`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_dot_i8x16_i7x16_add.html)
- [`core::arch::wasm32::u32x4_relaxed_dot_i8x16_i7x16_add`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_dot_i8x16_i7x16_add.html)
  These APIs are now stable in const contexts:
- [`std::task::Waker::from_raw`](https://doc.rust-lang.org/nightly/std/task/struct.Waker.html#method.from_raw)
- [`std::task::Context::from_waker`](https://doc.rust-lang.org/nightly/std/task/struct.Context.html#method.from_waker)
- [`std::task::Context::waker`](https://doc.rust-lang.org/nightly/std/task/struct.Context.html#method.waker)
- [`$integer::from_str_radix`](https://doc.rust-lang.org/nightly/std/primitive.u32.html#method.from_str_radix)
- [`std::num::ParseIntError::kind`](https://doc.rust-lang.org/nightly/std/num/struct.ParseIntError.html#method.kind)
  Cargo
-----
- [feat: Add `info` cargo subcommand](https://github.com/rust-lang/cargo/pull/14141/)
  Compatibility Notes
  - We now [disallow setting some built-in cfgs via the command-line](https://github.com/rust-lang/rust/pull/126158) with the newly added [`explicit_builtin_cfgs_in_flags`](https://doc.rust-lang.org/rustc/lints/listing/deny-by-default.html#explicit-builtin-cfgs-in-flags) lint in order to prevent incoherent state, eg. `windows` cfg active but target is Linux based. The appropriate [`rustc` flag](https://doc.rust-lang.org/rustc/command-line-arguments.html) should be used instead.
- The standard library has a new implementation of `binary_search` which is significantly improves performance ([#128254](https://github.com/rust-lang/rust/pull/128254)). However when a sorted slice has multiple values which compare equal, the new implementation may select a different value among the equal ones than the old implementation.
- [illumos/Solaris now sets `MSG_NOSIGNAL` when writing to sockets](https://github.com/rust-lang/rust/pull/128259). This avoids killing the process with SIGPIPE when writing to a closed socket, which matches the existing behavior on other UNIX targets.
- [Removes a problematic hack that always passed the --whole-archive linker flag for tests, which may cause linker errors for code accidentally relying on it.](https://github.com/rust-lang/rust/pull/128400)
- The WebAssembly target features `multivalue` and `reference-types` are now
  both enabled by default. These two features both have subtle changes implied
  for generated WebAssembly binaries. For the `multivalue` feature, WebAssembly
  target support has changed when upgrading to LLVM 19. Support for generating
  functions with multiple returns no longer works and
  `-Ctarget-feature=+multivalue` has a different meaning than it did in LLVM 18
  and prior. There is no longer any supported means to generate a module that has
  a function with multiple returns in WebAssembly from Rust source code. For the
  `reference-types` feature the encoding of immediates in the `call_indirect`, a
  commonly used instruction by the WebAssembly backend, has changed. Validators
  and parsers which don't understand the `reference-types` proposal will no
  longer accept modules produced by LLVM due to this change in encoding of
  immediates. Additionally these features being enabled are encoded in the
  `target_features` custom section and may affect downstream tooling such as
  `wasm-opt` consuming the module. Generating a WebAssembly module that disables
  default features requires `-Zbuild-std` support from Cargo and more information
  can be found at
  [rust-lang/rust#128511](https://github.com/rust-lang/rust/pull/128511).
- [Rust now raises unsafety errors for union patterns in parameter-position](https://github.com/rust-lang/rust/pull/130531)</changelog>
</package>
<package pkgid="740c43622470efd083f4550b1708be5e664c0011a7700daa43c036e1c194a249" name="cargo1.82" arch="aarch64">
  <version epoch="0" ver="1.82.0" rel="150500.11.6.1"/>
  <changelog author="william.brown@suse.com" date="1729598400">Version 1.82.0 (2024-10-17)
  Language
--------
- [Don't make statement nonterminals match pattern nonterminals](https://github.com/rust-lang/rust/pull/120221/)
- [Patterns matching empty types can now be omitted in common cases](https://github.com/rust-lang/rust/pull/122792)
- [Enforce supertrait outlives obligations when using trait impls](https://github.com/rust-lang/rust/pull/124336)
- [`addr_of(_mut)!` macros and the newly stabilized `&amp;raw (const|mut)` are now safe to use with all static items](https://github.com/rust-lang/rust/pull/125834)
- [size_of_val_raw: for length 0 this is safe to call](https://github.com/rust-lang/rust/pull/126152/)
- [Reorder trait bound modifiers *after* `for&lt;...&gt;` binder in trait bounds](https://github.com/rust-lang/rust/pull/127054/)
- [Stabilize opaque type precise capturing (RFC 3617)](https://github.com/rust-lang/rust/pull/127672)
- [Stabilize `&amp;raw const` and `&amp;raw mut` operators (RFC 2582)](https://github.com/rust-lang/rust/pull/127679)
- [Stabilize unsafe extern blocks (RFC 3484)](https://github.com/rust-lang/rust/pull/127921)
- [Stabilize nested field access in `offset_of!`](https://github.com/rust-lang/rust/pull/128284)
- [Do not require `T` to be live when dropping `[T; 0]`](https://github.com/rust-lang/rust/pull/128438)
- [Stabilize `const` operands in inline assembly](https://github.com/rust-lang/rust/pull/128570)
- [Stabilize floating-point arithmetic in `const fn`](https://github.com/rust-lang/rust/pull/128596)
- [Stabilize explicit opt-in to unsafe attributes](https://github.com/rust-lang/rust/pull/128771)
- [Document NaN bit patterns guarantees](https://github.com/rust-lang/rust/pull/129559)
  Compiler
--------
- [Promote riscv64gc-unknown-linux-musl to tier 2](https://github.com/rust-lang/rust/pull/122049)
- [Promote Mac Catalyst targets `aarch64-apple-ios-macabi` and `x86_64-apple-ios-macabi` to Tier 2, and ship them with rustup](https://github.com/rust-lang/rust/pull/126450)
- [Add tier 3 NuttX based targets for RISC-V and ARM](https://github.com/rust-lang/rust/pull/127755)
- [Add tier 3 powerpc-unknown-linux-muslspe target](https://github.com/rust-lang/rust/pull/127905)
- [Improved diagnostics to explain why a pattern is unreachable](https://github.com/rust-lang/rust/pull/128034)
- [The compiler now triggers the unreachable code warning properly for async functions that don't return/are `-&gt; !`](https://github.com/rust-lang/rust/pull/128443)
- [Promote `aarch64-apple-darwin` to Tier 1](https://github.com/rust-lang/rust/pull/128592)
- [Add Trusty OS target `aarch64-unknown-trusty` and `armv7-unknown-trusty` as tier 3 targets](https://github.com/rust-lang/rust/pull/129490)
- [Promote `wasm32-wasip2` to Tier 2.](https://github.com/rust-lang/rust/pull/126967/)
  Libraries
---------
- [Generalize `{Rc,Arc}::make_mut()` to `Path`, `OsStr`, and `CStr`.](https://github.com/rust-lang/rust/pull/126877)
  Stabilized APIs
- [`std::thread::Builder::spawn_unchecked`](https://doc.rust-lang.org/stable/std/thread/struct.Builder.html#method.spawn_unchecked)
- [`std::str::CharIndices::offset`](https://doc.rust-lang.org/nightly/std/str/struct.CharIndices.html#method.offset)
- [`std::option::Option::is_none_or`](https://doc.rust-lang.org/nightly/std/option/enum.Option.html#method.is_none_or)
- [`[T]::is_sorted`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted)
- [`[T]::is_sorted_by`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted_by)
- [`[T]::is_sorted_by_key`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted_by_key)
- [`Iterator::is_sorted`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted)
- [`Iterator::is_sorted_by`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted_by)
- [`Iterator::is_sorted_by_key`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted_by_key)
- [`std::future::Ready::into_inner`](https://doc.rust-lang.org/nightly/std/future/struct.Ready.html#method.into_inner)
- [`std::iter::repeat_n`](https://doc.rust-lang.org/nightly/std/iter/fn.repeat_n.html)
- [`impl&lt;T: Clone&gt; DoubleEndedIterator for Take&lt;Repeat&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-DoubleEndedIterator-for-Take%3CRepeat%3CT%3E%3E)
- [`impl&lt;T: Clone&gt; ExactSizeIterator for Take&lt;Repeat&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-ExactSizeIterator-for-Take%3CRepeat%3CT%3E%3E)
- [`impl&lt;T: Clone&gt; ExactSizeIterator for Take&lt;RepeatWith&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-ExactSizeIterator-for-Take%3CRepeatWith%3CF%3E%3E)
- [`impl Default for std::collections::binary_heap::Iter`](https://doc.rust-lang.org/nightly/std/collections/binary_heap/struct.Iter.html#impl-Default-for-Iter%3C'_,+T%3E)
- [`impl Default for std::collections::btree_map::RangeMut`](https://doc.rust-lang.org/nightly/std/collections/btree_map/struct.RangeMut.html#impl-Default-for-RangeMut%3C'_,+K,+V%3E)
- [`impl Default for std::collections::btree_map::ValuesMut`](https://doc.rust-lang.org/nightly/std/collections/btree_map/struct.ValuesMut.html#impl-Default-for-ValuesMut%3C'_,+K,+V%3E)
- [`impl Default for std::collections::vec_deque::Iter`](https://doc.rust-lang.org/nightly/std/collections/vec_deque/struct.Iter.html#impl-Default-for-Iter%3C'_,+T%3E)
- [`impl Default for std::collections::vec_deque::IterMut`](https://doc.rust-lang.org/nightly/std/collections/vec_deque/struct.IterMut.html#impl-Default-for-IterMut%3C'_,+T%3E)
- [`Rc&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.new_uninit)
- [`Rc&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.assume_init)
- [`Rc&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.new_uninit_slice)
- [`Rc&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.assume_init-1)
- [`Arc&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.new_uninit)
- [`Arc&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.assume_init)
- [`Arc&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.new_uninit_slice)
- [`Arc&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.assume_init-1)
- [`Box&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.new_uninit)
- [`Box&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.assume_init)
- [`Box&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.new_uninit_slice)
- [`Box&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.assume_init-1)
- [`core::arch::x86_64::_bextri_u64`](https://doc.rust-lang.org/stable/core/arch/x86_64/fn._bextri_u64.html)
- [`core::arch::x86_64::_bextri_u32`](https://doc.rust-lang.org/stable/core/arch/x86_64/fn._bextri_u32.html)
- [`core::arch::x86::_mm_broadcastsi128_si256`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_broadcastsi128_si256.html)
- [`core::arch::x86::_mm256_stream_load_si256`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm256_stream_load_si256.html)
- [`core::arch::x86::_tzcnt_u16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._tzcnt_u16.html)
- [`core::arch::x86::_mm_extracti_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_extracti_si64.html)
- [`core::arch::x86::_mm_inserti_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_inserti_si64.html)
- [`core::arch::x86::_mm_storeu_si16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si16.html)
- [`core::arch::x86::_mm_storeu_si32`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si32.html)
- [`core::arch::x86::_mm_storeu_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si64.html)
- [`core::arch::x86::_mm_loadu_si16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_loadu_si16.html)
- [`core::arch::x86::_mm_loadu_si32`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_loadu_si32.html)
- [`core::arch::wasm32::u8x16_relaxed_swizzle`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u8x16_relaxed_swizzle.html)
- [`core::arch::wasm32::i8x16_relaxed_swizzle`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i8x16_relaxed_swizzle.html)
- [`core::arch::wasm32::i32x4_relaxed_trunc_f32x4`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_trunc_f32x4.html)
- [`core::arch::wasm32::u32x4_relaxed_trunc_f32x4`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_trunc_f32x4.html)
- [`core::arch::wasm32::i32x4_relaxed_trunc_f64x2_zero`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_trunc_f64x2_zero.html)
- [`core::arch::wasm32::u32x4_relaxed_trunc_f64x2_zero`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_trunc_f64x2_zero.html)
- [`core::arch::wasm32::f32x4_relaxed_madd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_madd.html)
- [`core::arch::wasm32::f32x4_relaxed_nmadd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_nmadd.html)
- [`core::arch::wasm32::f64x2_relaxed_madd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_madd.html)
- [`core::arch::wasm32::f64x2_relaxed_nmadd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_nmadd.html)
- [`core::arch::wasm32::i8x16_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i8x16_relaxed_laneselect.html)
- [`core::arch::wasm32::u8x16_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u8x16_relaxed_laneselect.html)
- [`core::arch::wasm32::i16x8_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_laneselect.html)
- [`core::arch::wasm32::u16x8_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_laneselect.html)
- [`core::arch::wasm32::i32x4_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_laneselect.html)
- [`core::arch::wasm32::u32x4_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_laneselect.html)
- [`core::arch::wasm32::i64x2_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i64x2_relaxed_laneselect.html)
- [`core::arch::wasm32::u64x2_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u64x2_relaxed_laneselect.html)
- [`core::arch::wasm32::f32x4_relaxed_min`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_min.html)
- [`core::arch::wasm32::f32x4_relaxed_max`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_max.html)
- [`core::arch::wasm32::f64x2_relaxed_min`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_min.html)
- [`core::arch::wasm32::f64x2_relaxed_max`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_max.html)
- [`core::arch::wasm32::i16x8_relaxed_q15mulr`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_q15mulr.html)
- [`core::arch::wasm32::u16x8_relaxed_q15mulr`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_q15mulr.html)
- [`core::arch::wasm32::i16x8_relaxed_dot_i8x16_i7x16`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_dot_i8x16_i7x16.html)
- [`core::arch::wasm32::u16x8_relaxed_dot_i8x16_i7x16`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_dot_i8x16_i7x16.html)
- [`core::arch::wasm32::i32x4_relaxed_dot_i8x16_i7x16_add`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_dot_i8x16_i7x16_add.html)
- [`core::arch::wasm32::u32x4_relaxed_dot_i8x16_i7x16_add`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_dot_i8x16_i7x16_add.html)
  These APIs are now stable in const contexts:
- [`std::task::Waker::from_raw`](https://doc.rust-lang.org/nightly/std/task/struct.Waker.html#method.from_raw)
- [`std::task::Context::from_waker`](https://doc.rust-lang.org/nightly/std/task/struct.Context.html#method.from_waker)
- [`std::task::Context::waker`](https://doc.rust-lang.org/nightly/std/task/struct.Context.html#method.waker)
- [`$integer::from_str_radix`](https://doc.rust-lang.org/nightly/std/primitive.u32.html#method.from_str_radix)
- [`std::num::ParseIntError::kind`](https://doc.rust-lang.org/nightly/std/num/struct.ParseIntError.html#method.kind)
  Cargo
-----
- [feat: Add `info` cargo subcommand](https://github.com/rust-lang/cargo/pull/14141/)
  Compatibility Notes
  - We now [disallow setting some built-in cfgs via the command-line](https://github.com/rust-lang/rust/pull/126158) with the newly added [`explicit_builtin_cfgs_in_flags`](https://doc.rust-lang.org/rustc/lints/listing/deny-by-default.html#explicit-builtin-cfgs-in-flags) lint in order to prevent incoherent state, eg. `windows` cfg active but target is Linux based. The appropriate [`rustc` flag](https://doc.rust-lang.org/rustc/command-line-arguments.html) should be used instead.
- The standard library has a new implementation of `binary_search` which is significantly improves performance ([#128254](https://github.com/rust-lang/rust/pull/128254)). However when a sorted slice has multiple values which compare equal, the new implementation may select a different value among the equal ones than the old implementation.
- [illumos/Solaris now sets `MSG_NOSIGNAL` when writing to sockets](https://github.com/rust-lang/rust/pull/128259). This avoids killing the process with SIGPIPE when writing to a closed socket, which matches the existing behavior on other UNIX targets.
- [Removes a problematic hack that always passed the --whole-archive linker flag for tests, which may cause linker errors for code accidentally relying on it.](https://github.com/rust-lang/rust/pull/128400)
- The WebAssembly target features `multivalue` and `reference-types` are now
  both enabled by default. These two features both have subtle changes implied
  for generated WebAssembly binaries. For the `multivalue` feature, WebAssembly
  target support has changed when upgrading to LLVM 19. Support for generating
  functions with multiple returns no longer works and
  `-Ctarget-feature=+multivalue` has a different meaning than it did in LLVM 18
  and prior. There is no longer any supported means to generate a module that has
  a function with multiple returns in WebAssembly from Rust source code. For the
  `reference-types` feature the encoding of immediates in the `call_indirect`, a
  commonly used instruction by the WebAssembly backend, has changed. Validators
  and parsers which don't understand the `reference-types` proposal will no
  longer accept modules produced by LLVM due to this change in encoding of
  immediates. Additionally these features being enabled are encoded in the
  `target_features` custom section and may affect downstream tooling such as
  `wasm-opt` consuming the module. Generating a WebAssembly module that disables
  default features requires `-Zbuild-std` support from Cargo and more information
  can be found at
  [rust-lang/rust#128511](https://github.com/rust-lang/rust/pull/128511).
- [Rust now raises unsafety errors for union patterns in parameter-position](https://github.com/rust-lang/rust/pull/130531)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Resolve build failure on PPC64LE due to invalid float cast
  * ppc64le-float.patch</changelog>
</package>
<package pkgid="152e9dc441e182bbd260b4a5929d25a3fe938758b25f10584a6268b917d6a4ea" name="cargo1.82" arch="ppc64le">
  <version epoch="0" ver="1.82.0" rel="150500.11.6.1"/>
  <changelog author="william.brown@suse.com" date="1729598400">Version 1.82.0 (2024-10-17)
  Language
--------
- [Don't make statement nonterminals match pattern nonterminals](https://github.com/rust-lang/rust/pull/120221/)
- [Patterns matching empty types can now be omitted in common cases](https://github.com/rust-lang/rust/pull/122792)
- [Enforce supertrait outlives obligations when using trait impls](https://github.com/rust-lang/rust/pull/124336)
- [`addr_of(_mut)!` macros and the newly stabilized `&amp;raw (const|mut)` are now safe to use with all static items](https://github.com/rust-lang/rust/pull/125834)
- [size_of_val_raw: for length 0 this is safe to call](https://github.com/rust-lang/rust/pull/126152/)
- [Reorder trait bound modifiers *after* `for&lt;...&gt;` binder in trait bounds](https://github.com/rust-lang/rust/pull/127054/)
- [Stabilize opaque type precise capturing (RFC 3617)](https://github.com/rust-lang/rust/pull/127672)
- [Stabilize `&amp;raw const` and `&amp;raw mut` operators (RFC 2582)](https://github.com/rust-lang/rust/pull/127679)
- [Stabilize unsafe extern blocks (RFC 3484)](https://github.com/rust-lang/rust/pull/127921)
- [Stabilize nested field access in `offset_of!`](https://github.com/rust-lang/rust/pull/128284)
- [Do not require `T` to be live when dropping `[T; 0]`](https://github.com/rust-lang/rust/pull/128438)
- [Stabilize `const` operands in inline assembly](https://github.com/rust-lang/rust/pull/128570)
- [Stabilize floating-point arithmetic in `const fn`](https://github.com/rust-lang/rust/pull/128596)
- [Stabilize explicit opt-in to unsafe attributes](https://github.com/rust-lang/rust/pull/128771)
- [Document NaN bit patterns guarantees](https://github.com/rust-lang/rust/pull/129559)
  Compiler
--------
- [Promote riscv64gc-unknown-linux-musl to tier 2](https://github.com/rust-lang/rust/pull/122049)
- [Promote Mac Catalyst targets `aarch64-apple-ios-macabi` and `x86_64-apple-ios-macabi` to Tier 2, and ship them with rustup](https://github.com/rust-lang/rust/pull/126450)
- [Add tier 3 NuttX based targets for RISC-V and ARM](https://github.com/rust-lang/rust/pull/127755)
- [Add tier 3 powerpc-unknown-linux-muslspe target](https://github.com/rust-lang/rust/pull/127905)
- [Improved diagnostics to explain why a pattern is unreachable](https://github.com/rust-lang/rust/pull/128034)
- [The compiler now triggers the unreachable code warning properly for async functions that don't return/are `-&gt; !`](https://github.com/rust-lang/rust/pull/128443)
- [Promote `aarch64-apple-darwin` to Tier 1](https://github.com/rust-lang/rust/pull/128592)
- [Add Trusty OS target `aarch64-unknown-trusty` and `armv7-unknown-trusty` as tier 3 targets](https://github.com/rust-lang/rust/pull/129490)
- [Promote `wasm32-wasip2` to Tier 2.](https://github.com/rust-lang/rust/pull/126967/)
  Libraries
---------
- [Generalize `{Rc,Arc}::make_mut()` to `Path`, `OsStr`, and `CStr`.](https://github.com/rust-lang/rust/pull/126877)
  Stabilized APIs
- [`std::thread::Builder::spawn_unchecked`](https://doc.rust-lang.org/stable/std/thread/struct.Builder.html#method.spawn_unchecked)
- [`std::str::CharIndices::offset`](https://doc.rust-lang.org/nightly/std/str/struct.CharIndices.html#method.offset)
- [`std::option::Option::is_none_or`](https://doc.rust-lang.org/nightly/std/option/enum.Option.html#method.is_none_or)
- [`[T]::is_sorted`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted)
- [`[T]::is_sorted_by`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted_by)
- [`[T]::is_sorted_by_key`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted_by_key)
- [`Iterator::is_sorted`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted)
- [`Iterator::is_sorted_by`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted_by)
- [`Iterator::is_sorted_by_key`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted_by_key)
- [`std::future::Ready::into_inner`](https://doc.rust-lang.org/nightly/std/future/struct.Ready.html#method.into_inner)
- [`std::iter::repeat_n`](https://doc.rust-lang.org/nightly/std/iter/fn.repeat_n.html)
- [`impl&lt;T: Clone&gt; DoubleEndedIterator for Take&lt;Repeat&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-DoubleEndedIterator-for-Take%3CRepeat%3CT%3E%3E)
- [`impl&lt;T: Clone&gt; ExactSizeIterator for Take&lt;Repeat&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-ExactSizeIterator-for-Take%3CRepeat%3CT%3E%3E)
- [`impl&lt;T: Clone&gt; ExactSizeIterator for Take&lt;RepeatWith&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-ExactSizeIterator-for-Take%3CRepeatWith%3CF%3E%3E)
- [`impl Default for std::collections::binary_heap::Iter`](https://doc.rust-lang.org/nightly/std/collections/binary_heap/struct.Iter.html#impl-Default-for-Iter%3C'_,+T%3E)
- [`impl Default for std::collections::btree_map::RangeMut`](https://doc.rust-lang.org/nightly/std/collections/btree_map/struct.RangeMut.html#impl-Default-for-RangeMut%3C'_,+K,+V%3E)
- [`impl Default for std::collections::btree_map::ValuesMut`](https://doc.rust-lang.org/nightly/std/collections/btree_map/struct.ValuesMut.html#impl-Default-for-ValuesMut%3C'_,+K,+V%3E)
- [`impl Default for std::collections::vec_deque::Iter`](https://doc.rust-lang.org/nightly/std/collections/vec_deque/struct.Iter.html#impl-Default-for-Iter%3C'_,+T%3E)
- [`impl Default for std::collections::vec_deque::IterMut`](https://doc.rust-lang.org/nightly/std/collections/vec_deque/struct.IterMut.html#impl-Default-for-IterMut%3C'_,+T%3E)
- [`Rc&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.new_uninit)
- [`Rc&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.assume_init)
- [`Rc&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.new_uninit_slice)
- [`Rc&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.assume_init-1)
- [`Arc&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.new_uninit)
- [`Arc&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.assume_init)
- [`Arc&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.new_uninit_slice)
- [`Arc&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.assume_init-1)
- [`Box&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.new_uninit)
- [`Box&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.assume_init)
- [`Box&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.new_uninit_slice)
- [`Box&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.assume_init-1)
- [`core::arch::x86_64::_bextri_u64`](https://doc.rust-lang.org/stable/core/arch/x86_64/fn._bextri_u64.html)
- [`core::arch::x86_64::_bextri_u32`](https://doc.rust-lang.org/stable/core/arch/x86_64/fn._bextri_u32.html)
- [`core::arch::x86::_mm_broadcastsi128_si256`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_broadcastsi128_si256.html)
- [`core::arch::x86::_mm256_stream_load_si256`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm256_stream_load_si256.html)
- [`core::arch::x86::_tzcnt_u16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._tzcnt_u16.html)
- [`core::arch::x86::_mm_extracti_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_extracti_si64.html)
- [`core::arch::x86::_mm_inserti_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_inserti_si64.html)
- [`core::arch::x86::_mm_storeu_si16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si16.html)
- [`core::arch::x86::_mm_storeu_si32`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si32.html)
- [`core::arch::x86::_mm_storeu_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si64.html)
- [`core::arch::x86::_mm_loadu_si16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_loadu_si16.html)
- [`core::arch::x86::_mm_loadu_si32`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_loadu_si32.html)
- [`core::arch::wasm32::u8x16_relaxed_swizzle`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u8x16_relaxed_swizzle.html)
- [`core::arch::wasm32::i8x16_relaxed_swizzle`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i8x16_relaxed_swizzle.html)
- [`core::arch::wasm32::i32x4_relaxed_trunc_f32x4`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_trunc_f32x4.html)
- [`core::arch::wasm32::u32x4_relaxed_trunc_f32x4`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_trunc_f32x4.html)
- [`core::arch::wasm32::i32x4_relaxed_trunc_f64x2_zero`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_trunc_f64x2_zero.html)
- [`core::arch::wasm32::u32x4_relaxed_trunc_f64x2_zero`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_trunc_f64x2_zero.html)
- [`core::arch::wasm32::f32x4_relaxed_madd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_madd.html)
- [`core::arch::wasm32::f32x4_relaxed_nmadd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_nmadd.html)
- [`core::arch::wasm32::f64x2_relaxed_madd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_madd.html)
- [`core::arch::wasm32::f64x2_relaxed_nmadd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_nmadd.html)
- [`core::arch::wasm32::i8x16_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i8x16_relaxed_laneselect.html)
- [`core::arch::wasm32::u8x16_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u8x16_relaxed_laneselect.html)
- [`core::arch::wasm32::i16x8_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_laneselect.html)
- [`core::arch::wasm32::u16x8_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_laneselect.html)
- [`core::arch::wasm32::i32x4_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_laneselect.html)
- [`core::arch::wasm32::u32x4_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_laneselect.html)
- [`core::arch::wasm32::i64x2_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i64x2_relaxed_laneselect.html)
- [`core::arch::wasm32::u64x2_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u64x2_relaxed_laneselect.html)
- [`core::arch::wasm32::f32x4_relaxed_min`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_min.html)
- [`core::arch::wasm32::f32x4_relaxed_max`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_max.html)
- [`core::arch::wasm32::f64x2_relaxed_min`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_min.html)
- [`core::arch::wasm32::f64x2_relaxed_max`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_max.html)
- [`core::arch::wasm32::i16x8_relaxed_q15mulr`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_q15mulr.html)
- [`core::arch::wasm32::u16x8_relaxed_q15mulr`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_q15mulr.html)
- [`core::arch::wasm32::i16x8_relaxed_dot_i8x16_i7x16`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_dot_i8x16_i7x16.html)
- [`core::arch::wasm32::u16x8_relaxed_dot_i8x16_i7x16`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_dot_i8x16_i7x16.html)
- [`core::arch::wasm32::i32x4_relaxed_dot_i8x16_i7x16_add`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_dot_i8x16_i7x16_add.html)
- [`core::arch::wasm32::u32x4_relaxed_dot_i8x16_i7x16_add`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_dot_i8x16_i7x16_add.html)
  These APIs are now stable in const contexts:
- [`std::task::Waker::from_raw`](https://doc.rust-lang.org/nightly/std/task/struct.Waker.html#method.from_raw)
- [`std::task::Context::from_waker`](https://doc.rust-lang.org/nightly/std/task/struct.Context.html#method.from_waker)
- [`std::task::Context::waker`](https://doc.rust-lang.org/nightly/std/task/struct.Context.html#method.waker)
- [`$integer::from_str_radix`](https://doc.rust-lang.org/nightly/std/primitive.u32.html#method.from_str_radix)
- [`std::num::ParseIntError::kind`](https://doc.rust-lang.org/nightly/std/num/struct.ParseIntError.html#method.kind)
  Cargo
-----
- [feat: Add `info` cargo subcommand](https://github.com/rust-lang/cargo/pull/14141/)
  Compatibility Notes
  - We now [disallow setting some built-in cfgs via the command-line](https://github.com/rust-lang/rust/pull/126158) with the newly added [`explicit_builtin_cfgs_in_flags`](https://doc.rust-lang.org/rustc/lints/listing/deny-by-default.html#explicit-builtin-cfgs-in-flags) lint in order to prevent incoherent state, eg. `windows` cfg active but target is Linux based. The appropriate [`rustc` flag](https://doc.rust-lang.org/rustc/command-line-arguments.html) should be used instead.
- The standard library has a new implementation of `binary_search` which is significantly improves performance ([#128254](https://github.com/rust-lang/rust/pull/128254)). However when a sorted slice has multiple values which compare equal, the new implementation may select a different value among the equal ones than the old implementation.
- [illumos/Solaris now sets `MSG_NOSIGNAL` when writing to sockets](https://github.com/rust-lang/rust/pull/128259). This avoids killing the process with SIGPIPE when writing to a closed socket, which matches the existing behavior on other UNIX targets.
- [Removes a problematic hack that always passed the --whole-archive linker flag for tests, which may cause linker errors for code accidentally relying on it.](https://github.com/rust-lang/rust/pull/128400)
- The WebAssembly target features `multivalue` and `reference-types` are now
  both enabled by default. These two features both have subtle changes implied
  for generated WebAssembly binaries. For the `multivalue` feature, WebAssembly
  target support has changed when upgrading to LLVM 19. Support for generating
  functions with multiple returns no longer works and
  `-Ctarget-feature=+multivalue` has a different meaning than it did in LLVM 18
  and prior. There is no longer any supported means to generate a module that has
  a function with multiple returns in WebAssembly from Rust source code. For the
  `reference-types` feature the encoding of immediates in the `call_indirect`, a
  commonly used instruction by the WebAssembly backend, has changed. Validators
  and parsers which don't understand the `reference-types` proposal will no
  longer accept modules produced by LLVM due to this change in encoding of
  immediates. Additionally these features being enabled are encoded in the
  `target_features` custom section and may affect downstream tooling such as
  `wasm-opt` consuming the module. Generating a WebAssembly module that disables
  default features requires `-Zbuild-std` support from Cargo and more information
  can be found at
  [rust-lang/rust#128511](https://github.com/rust-lang/rust/pull/128511).
- [Rust now raises unsafety errors for union patterns in parameter-position](https://github.com/rust-lang/rust/pull/130531)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Resolve build failure on PPC64LE due to invalid float cast
  * ppc64le-float.patch</changelog>
</package>
<package pkgid="0d9b0cd0e151ff33c399d631dc6eea21446df2bd84774a0c038093709a7c2800" name="cargo1.82" arch="s390x">
  <version epoch="0" ver="1.82.0" rel="150500.11.6.1"/>
  <changelog author="william.brown@suse.com" date="1729598400">Version 1.82.0 (2024-10-17)
  Language
--------
- [Don't make statement nonterminals match pattern nonterminals](https://github.com/rust-lang/rust/pull/120221/)
- [Patterns matching empty types can now be omitted in common cases](https://github.com/rust-lang/rust/pull/122792)
- [Enforce supertrait outlives obligations when using trait impls](https://github.com/rust-lang/rust/pull/124336)
- [`addr_of(_mut)!` macros and the newly stabilized `&amp;raw (const|mut)` are now safe to use with all static items](https://github.com/rust-lang/rust/pull/125834)
- [size_of_val_raw: for length 0 this is safe to call](https://github.com/rust-lang/rust/pull/126152/)
- [Reorder trait bound modifiers *after* `for&lt;...&gt;` binder in trait bounds](https://github.com/rust-lang/rust/pull/127054/)
- [Stabilize opaque type precise capturing (RFC 3617)](https://github.com/rust-lang/rust/pull/127672)
- [Stabilize `&amp;raw const` and `&amp;raw mut` operators (RFC 2582)](https://github.com/rust-lang/rust/pull/127679)
- [Stabilize unsafe extern blocks (RFC 3484)](https://github.com/rust-lang/rust/pull/127921)
- [Stabilize nested field access in `offset_of!`](https://github.com/rust-lang/rust/pull/128284)
- [Do not require `T` to be live when dropping `[T; 0]`](https://github.com/rust-lang/rust/pull/128438)
- [Stabilize `const` operands in inline assembly](https://github.com/rust-lang/rust/pull/128570)
- [Stabilize floating-point arithmetic in `const fn`](https://github.com/rust-lang/rust/pull/128596)
- [Stabilize explicit opt-in to unsafe attributes](https://github.com/rust-lang/rust/pull/128771)
- [Document NaN bit patterns guarantees](https://github.com/rust-lang/rust/pull/129559)
  Compiler
--------
- [Promote riscv64gc-unknown-linux-musl to tier 2](https://github.com/rust-lang/rust/pull/122049)
- [Promote Mac Catalyst targets `aarch64-apple-ios-macabi` and `x86_64-apple-ios-macabi` to Tier 2, and ship them with rustup](https://github.com/rust-lang/rust/pull/126450)
- [Add tier 3 NuttX based targets for RISC-V and ARM](https://github.com/rust-lang/rust/pull/127755)
- [Add tier 3 powerpc-unknown-linux-muslspe target](https://github.com/rust-lang/rust/pull/127905)
- [Improved diagnostics to explain why a pattern is unreachable](https://github.com/rust-lang/rust/pull/128034)
- [The compiler now triggers the unreachable code warning properly for async functions that don't return/are `-&gt; !`](https://github.com/rust-lang/rust/pull/128443)
- [Promote `aarch64-apple-darwin` to Tier 1](https://github.com/rust-lang/rust/pull/128592)
- [Add Trusty OS target `aarch64-unknown-trusty` and `armv7-unknown-trusty` as tier 3 targets](https://github.com/rust-lang/rust/pull/129490)
- [Promote `wasm32-wasip2` to Tier 2.](https://github.com/rust-lang/rust/pull/126967/)
  Libraries
---------
- [Generalize `{Rc,Arc}::make_mut()` to `Path`, `OsStr`, and `CStr`.](https://github.com/rust-lang/rust/pull/126877)
  Stabilized APIs
- [`std::thread::Builder::spawn_unchecked`](https://doc.rust-lang.org/stable/std/thread/struct.Builder.html#method.spawn_unchecked)
- [`std::str::CharIndices::offset`](https://doc.rust-lang.org/nightly/std/str/struct.CharIndices.html#method.offset)
- [`std::option::Option::is_none_or`](https://doc.rust-lang.org/nightly/std/option/enum.Option.html#method.is_none_or)
- [`[T]::is_sorted`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted)
- [`[T]::is_sorted_by`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted_by)
- [`[T]::is_sorted_by_key`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted_by_key)
- [`Iterator::is_sorted`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted)
- [`Iterator::is_sorted_by`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted_by)
- [`Iterator::is_sorted_by_key`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted_by_key)
- [`std::future::Ready::into_inner`](https://doc.rust-lang.org/nightly/std/future/struct.Ready.html#method.into_inner)
- [`std::iter::repeat_n`](https://doc.rust-lang.org/nightly/std/iter/fn.repeat_n.html)
- [`impl&lt;T: Clone&gt; DoubleEndedIterator for Take&lt;Repeat&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-DoubleEndedIterator-for-Take%3CRepeat%3CT%3E%3E)
- [`impl&lt;T: Clone&gt; ExactSizeIterator for Take&lt;Repeat&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-ExactSizeIterator-for-Take%3CRepeat%3CT%3E%3E)
- [`impl&lt;T: Clone&gt; ExactSizeIterator for Take&lt;RepeatWith&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-ExactSizeIterator-for-Take%3CRepeatWith%3CF%3E%3E)
- [`impl Default for std::collections::binary_heap::Iter`](https://doc.rust-lang.org/nightly/std/collections/binary_heap/struct.Iter.html#impl-Default-for-Iter%3C'_,+T%3E)
- [`impl Default for std::collections::btree_map::RangeMut`](https://doc.rust-lang.org/nightly/std/collections/btree_map/struct.RangeMut.html#impl-Default-for-RangeMut%3C'_,+K,+V%3E)
- [`impl Default for std::collections::btree_map::ValuesMut`](https://doc.rust-lang.org/nightly/std/collections/btree_map/struct.ValuesMut.html#impl-Default-for-ValuesMut%3C'_,+K,+V%3E)
- [`impl Default for std::collections::vec_deque::Iter`](https://doc.rust-lang.org/nightly/std/collections/vec_deque/struct.Iter.html#impl-Default-for-Iter%3C'_,+T%3E)
- [`impl Default for std::collections::vec_deque::IterMut`](https://doc.rust-lang.org/nightly/std/collections/vec_deque/struct.IterMut.html#impl-Default-for-IterMut%3C'_,+T%3E)
- [`Rc&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.new_uninit)
- [`Rc&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.assume_init)
- [`Rc&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.new_uninit_slice)
- [`Rc&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.assume_init-1)
- [`Arc&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.new_uninit)
- [`Arc&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.assume_init)
- [`Arc&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.new_uninit_slice)
- [`Arc&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.assume_init-1)
- [`Box&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.new_uninit)
- [`Box&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.assume_init)
- [`Box&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.new_uninit_slice)
- [`Box&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.assume_init-1)
- [`core::arch::x86_64::_bextri_u64`](https://doc.rust-lang.org/stable/core/arch/x86_64/fn._bextri_u64.html)
- [`core::arch::x86_64::_bextri_u32`](https://doc.rust-lang.org/stable/core/arch/x86_64/fn._bextri_u32.html)
- [`core::arch::x86::_mm_broadcastsi128_si256`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_broadcastsi128_si256.html)
- [`core::arch::x86::_mm256_stream_load_si256`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm256_stream_load_si256.html)
- [`core::arch::x86::_tzcnt_u16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._tzcnt_u16.html)
- [`core::arch::x86::_mm_extracti_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_extracti_si64.html)
- [`core::arch::x86::_mm_inserti_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_inserti_si64.html)
- [`core::arch::x86::_mm_storeu_si16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si16.html)
- [`core::arch::x86::_mm_storeu_si32`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si32.html)
- [`core::arch::x86::_mm_storeu_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si64.html)
- [`core::arch::x86::_mm_loadu_si16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_loadu_si16.html)
- [`core::arch::x86::_mm_loadu_si32`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_loadu_si32.html)
- [`core::arch::wasm32::u8x16_relaxed_swizzle`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u8x16_relaxed_swizzle.html)
- [`core::arch::wasm32::i8x16_relaxed_swizzle`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i8x16_relaxed_swizzle.html)
- [`core::arch::wasm32::i32x4_relaxed_trunc_f32x4`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_trunc_f32x4.html)
- [`core::arch::wasm32::u32x4_relaxed_trunc_f32x4`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_trunc_f32x4.html)
- [`core::arch::wasm32::i32x4_relaxed_trunc_f64x2_zero`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_trunc_f64x2_zero.html)
- [`core::arch::wasm32::u32x4_relaxed_trunc_f64x2_zero`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_trunc_f64x2_zero.html)
- [`core::arch::wasm32::f32x4_relaxed_madd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_madd.html)
- [`core::arch::wasm32::f32x4_relaxed_nmadd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_nmadd.html)
- [`core::arch::wasm32::f64x2_relaxed_madd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_madd.html)
- [`core::arch::wasm32::f64x2_relaxed_nmadd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_nmadd.html)
- [`core::arch::wasm32::i8x16_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i8x16_relaxed_laneselect.html)
- [`core::arch::wasm32::u8x16_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u8x16_relaxed_laneselect.html)
- [`core::arch::wasm32::i16x8_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_laneselect.html)
- [`core::arch::wasm32::u16x8_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_laneselect.html)
- [`core::arch::wasm32::i32x4_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_laneselect.html)
- [`core::arch::wasm32::u32x4_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_laneselect.html)
- [`core::arch::wasm32::i64x2_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i64x2_relaxed_laneselect.html)
- [`core::arch::wasm32::u64x2_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u64x2_relaxed_laneselect.html)
- [`core::arch::wasm32::f32x4_relaxed_min`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_min.html)
- [`core::arch::wasm32::f32x4_relaxed_max`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_max.html)
- [`core::arch::wasm32::f64x2_relaxed_min`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_min.html)
- [`core::arch::wasm32::f64x2_relaxed_max`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_max.html)
- [`core::arch::wasm32::i16x8_relaxed_q15mulr`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_q15mulr.html)
- [`core::arch::wasm32::u16x8_relaxed_q15mulr`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_q15mulr.html)
- [`core::arch::wasm32::i16x8_relaxed_dot_i8x16_i7x16`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_dot_i8x16_i7x16.html)
- [`core::arch::wasm32::u16x8_relaxed_dot_i8x16_i7x16`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_dot_i8x16_i7x16.html)
- [`core::arch::wasm32::i32x4_relaxed_dot_i8x16_i7x16_add`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_dot_i8x16_i7x16_add.html)
- [`core::arch::wasm32::u32x4_relaxed_dot_i8x16_i7x16_add`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_dot_i8x16_i7x16_add.html)
  These APIs are now stable in const contexts:
- [`std::task::Waker::from_raw`](https://doc.rust-lang.org/nightly/std/task/struct.Waker.html#method.from_raw)
- [`std::task::Context::from_waker`](https://doc.rust-lang.org/nightly/std/task/struct.Context.html#method.from_waker)
- [`std::task::Context::waker`](https://doc.rust-lang.org/nightly/std/task/struct.Context.html#method.waker)
- [`$integer::from_str_radix`](https://doc.rust-lang.org/nightly/std/primitive.u32.html#method.from_str_radix)
- [`std::num::ParseIntError::kind`](https://doc.rust-lang.org/nightly/std/num/struct.ParseIntError.html#method.kind)
  Cargo
-----
- [feat: Add `info` cargo subcommand](https://github.com/rust-lang/cargo/pull/14141/)
  Compatibility Notes
  - We now [disallow setting some built-in cfgs via the command-line](https://github.com/rust-lang/rust/pull/126158) with the newly added [`explicit_builtin_cfgs_in_flags`](https://doc.rust-lang.org/rustc/lints/listing/deny-by-default.html#explicit-builtin-cfgs-in-flags) lint in order to prevent incoherent state, eg. `windows` cfg active but target is Linux based. The appropriate [`rustc` flag](https://doc.rust-lang.org/rustc/command-line-arguments.html) should be used instead.
- The standard library has a new implementation of `binary_search` which is significantly improves performance ([#128254](https://github.com/rust-lang/rust/pull/128254)). However when a sorted slice has multiple values which compare equal, the new implementation may select a different value among the equal ones than the old implementation.
- [illumos/Solaris now sets `MSG_NOSIGNAL` when writing to sockets](https://github.com/rust-lang/rust/pull/128259). This avoids killing the process with SIGPIPE when writing to a closed socket, which matches the existing behavior on other UNIX targets.
- [Removes a problematic hack that always passed the --whole-archive linker flag for tests, which may cause linker errors for code accidentally relying on it.](https://github.com/rust-lang/rust/pull/128400)
- The WebAssembly target features `multivalue` and `reference-types` are now
  both enabled by default. These two features both have subtle changes implied
  for generated WebAssembly binaries. For the `multivalue` feature, WebAssembly
  target support has changed when upgrading to LLVM 19. Support for generating
  functions with multiple returns no longer works and
  `-Ctarget-feature=+multivalue` has a different meaning than it did in LLVM 18
  and prior. There is no longer any supported means to generate a module that has
  a function with multiple returns in WebAssembly from Rust source code. For the
  `reference-types` feature the encoding of immediates in the `call_indirect`, a
  commonly used instruction by the WebAssembly backend, has changed. Validators
  and parsers which don't understand the `reference-types` proposal will no
  longer accept modules produced by LLVM due to this change in encoding of
  immediates. Additionally these features being enabled are encoded in the
  `target_features` custom section and may affect downstream tooling such as
  `wasm-opt` consuming the module. Generating a WebAssembly module that disables
  default features requires `-Zbuild-std` support from Cargo and more information
  can be found at
  [rust-lang/rust#128511](https://github.com/rust-lang/rust/pull/128511).
- [Rust now raises unsafety errors for union patterns in parameter-position](https://github.com/rust-lang/rust/pull/130531)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Resolve build failure on PPC64LE due to invalid float cast
  * ppc64le-float.patch</changelog>
</package>
<package pkgid="3a2d81f4eae18d2664e9a587c11de04d22fd81170d26e5be4e9dadbcb91b2f57" name="cargo1.82" arch="x86_64">
  <version epoch="0" ver="1.82.0" rel="150500.11.6.1"/>
  <changelog author="william.brown@suse.com" date="1729598400">Version 1.82.0 (2024-10-17)
  Language
--------
- [Don't make statement nonterminals match pattern nonterminals](https://github.com/rust-lang/rust/pull/120221/)
- [Patterns matching empty types can now be omitted in common cases](https://github.com/rust-lang/rust/pull/122792)
- [Enforce supertrait outlives obligations when using trait impls](https://github.com/rust-lang/rust/pull/124336)
- [`addr_of(_mut)!` macros and the newly stabilized `&amp;raw (const|mut)` are now safe to use with all static items](https://github.com/rust-lang/rust/pull/125834)
- [size_of_val_raw: for length 0 this is safe to call](https://github.com/rust-lang/rust/pull/126152/)
- [Reorder trait bound modifiers *after* `for&lt;...&gt;` binder in trait bounds](https://github.com/rust-lang/rust/pull/127054/)
- [Stabilize opaque type precise capturing (RFC 3617)](https://github.com/rust-lang/rust/pull/127672)
- [Stabilize `&amp;raw const` and `&amp;raw mut` operators (RFC 2582)](https://github.com/rust-lang/rust/pull/127679)
- [Stabilize unsafe extern blocks (RFC 3484)](https://github.com/rust-lang/rust/pull/127921)
- [Stabilize nested field access in `offset_of!`](https://github.com/rust-lang/rust/pull/128284)
- [Do not require `T` to be live when dropping `[T; 0]`](https://github.com/rust-lang/rust/pull/128438)
- [Stabilize `const` operands in inline assembly](https://github.com/rust-lang/rust/pull/128570)
- [Stabilize floating-point arithmetic in `const fn`](https://github.com/rust-lang/rust/pull/128596)
- [Stabilize explicit opt-in to unsafe attributes](https://github.com/rust-lang/rust/pull/128771)
- [Document NaN bit patterns guarantees](https://github.com/rust-lang/rust/pull/129559)
  Compiler
--------
- [Promote riscv64gc-unknown-linux-musl to tier 2](https://github.com/rust-lang/rust/pull/122049)
- [Promote Mac Catalyst targets `aarch64-apple-ios-macabi` and `x86_64-apple-ios-macabi` to Tier 2, and ship them with rustup](https://github.com/rust-lang/rust/pull/126450)
- [Add tier 3 NuttX based targets for RISC-V and ARM](https://github.com/rust-lang/rust/pull/127755)
- [Add tier 3 powerpc-unknown-linux-muslspe target](https://github.com/rust-lang/rust/pull/127905)
- [Improved diagnostics to explain why a pattern is unreachable](https://github.com/rust-lang/rust/pull/128034)
- [The compiler now triggers the unreachable code warning properly for async functions that don't return/are `-&gt; !`](https://github.com/rust-lang/rust/pull/128443)
- [Promote `aarch64-apple-darwin` to Tier 1](https://github.com/rust-lang/rust/pull/128592)
- [Add Trusty OS target `aarch64-unknown-trusty` and `armv7-unknown-trusty` as tier 3 targets](https://github.com/rust-lang/rust/pull/129490)
- [Promote `wasm32-wasip2` to Tier 2.](https://github.com/rust-lang/rust/pull/126967/)
  Libraries
---------
- [Generalize `{Rc,Arc}::make_mut()` to `Path`, `OsStr`, and `CStr`.](https://github.com/rust-lang/rust/pull/126877)
  Stabilized APIs
- [`std::thread::Builder::spawn_unchecked`](https://doc.rust-lang.org/stable/std/thread/struct.Builder.html#method.spawn_unchecked)
- [`std::str::CharIndices::offset`](https://doc.rust-lang.org/nightly/std/str/struct.CharIndices.html#method.offset)
- [`std::option::Option::is_none_or`](https://doc.rust-lang.org/nightly/std/option/enum.Option.html#method.is_none_or)
- [`[T]::is_sorted`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted)
- [`[T]::is_sorted_by`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted_by)
- [`[T]::is_sorted_by_key`](https://doc.rust-lang.org/nightly/std/primitive.slice.html#method.is_sorted_by_key)
- [`Iterator::is_sorted`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted)
- [`Iterator::is_sorted_by`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted_by)
- [`Iterator::is_sorted_by_key`](https://doc.rust-lang.org/nightly/std/iter/trait.Iterator.html#method.is_sorted_by_key)
- [`std::future::Ready::into_inner`](https://doc.rust-lang.org/nightly/std/future/struct.Ready.html#method.into_inner)
- [`std::iter::repeat_n`](https://doc.rust-lang.org/nightly/std/iter/fn.repeat_n.html)
- [`impl&lt;T: Clone&gt; DoubleEndedIterator for Take&lt;Repeat&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-DoubleEndedIterator-for-Take%3CRepeat%3CT%3E%3E)
- [`impl&lt;T: Clone&gt; ExactSizeIterator for Take&lt;Repeat&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-ExactSizeIterator-for-Take%3CRepeat%3CT%3E%3E)
- [`impl&lt;T: Clone&gt; ExactSizeIterator for Take&lt;RepeatWith&lt;T&gt;&gt;`](https://doc.rust-lang.org/nightly/std/iter/struct.Take.html#impl-ExactSizeIterator-for-Take%3CRepeatWith%3CF%3E%3E)
- [`impl Default for std::collections::binary_heap::Iter`](https://doc.rust-lang.org/nightly/std/collections/binary_heap/struct.Iter.html#impl-Default-for-Iter%3C'_,+T%3E)
- [`impl Default for std::collections::btree_map::RangeMut`](https://doc.rust-lang.org/nightly/std/collections/btree_map/struct.RangeMut.html#impl-Default-for-RangeMut%3C'_,+K,+V%3E)
- [`impl Default for std::collections::btree_map::ValuesMut`](https://doc.rust-lang.org/nightly/std/collections/btree_map/struct.ValuesMut.html#impl-Default-for-ValuesMut%3C'_,+K,+V%3E)
- [`impl Default for std::collections::vec_deque::Iter`](https://doc.rust-lang.org/nightly/std/collections/vec_deque/struct.Iter.html#impl-Default-for-Iter%3C'_,+T%3E)
- [`impl Default for std::collections::vec_deque::IterMut`](https://doc.rust-lang.org/nightly/std/collections/vec_deque/struct.IterMut.html#impl-Default-for-IterMut%3C'_,+T%3E)
- [`Rc&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.new_uninit)
- [`Rc&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.assume_init)
- [`Rc&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.new_uninit_slice)
- [`Rc&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/rc/struct.Rc.html#method.assume_init-1)
- [`Arc&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.new_uninit)
- [`Arc&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.assume_init)
- [`Arc&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.new_uninit_slice)
- [`Arc&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/sync/struct.Arc.html#method.assume_init-1)
- [`Box&lt;T&gt;::new_uninit`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.new_uninit)
- [`Box&lt;T&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.assume_init)
- [`Box&lt;[T]&gt;::new_uninit_slice`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.new_uninit_slice)
- [`Box&lt;[MaybeUninit&lt;T&gt;]&gt;::assume_init`](https://doc.rust-lang.org/nightly/std/boxed/struct.Box.html#method.assume_init-1)
- [`core::arch::x86_64::_bextri_u64`](https://doc.rust-lang.org/stable/core/arch/x86_64/fn._bextri_u64.html)
- [`core::arch::x86_64::_bextri_u32`](https://doc.rust-lang.org/stable/core/arch/x86_64/fn._bextri_u32.html)
- [`core::arch::x86::_mm_broadcastsi128_si256`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_broadcastsi128_si256.html)
- [`core::arch::x86::_mm256_stream_load_si256`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm256_stream_load_si256.html)
- [`core::arch::x86::_tzcnt_u16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._tzcnt_u16.html)
- [`core::arch::x86::_mm_extracti_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_extracti_si64.html)
- [`core::arch::x86::_mm_inserti_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_inserti_si64.html)
- [`core::arch::x86::_mm_storeu_si16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si16.html)
- [`core::arch::x86::_mm_storeu_si32`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si32.html)
- [`core::arch::x86::_mm_storeu_si64`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_storeu_si64.html)
- [`core::arch::x86::_mm_loadu_si16`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_loadu_si16.html)
- [`core::arch::x86::_mm_loadu_si32`](https://doc.rust-lang.org/stable/core/arch/x86/fn._mm_loadu_si32.html)
- [`core::arch::wasm32::u8x16_relaxed_swizzle`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u8x16_relaxed_swizzle.html)
- [`core::arch::wasm32::i8x16_relaxed_swizzle`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i8x16_relaxed_swizzle.html)
- [`core::arch::wasm32::i32x4_relaxed_trunc_f32x4`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_trunc_f32x4.html)
- [`core::arch::wasm32::u32x4_relaxed_trunc_f32x4`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_trunc_f32x4.html)
- [`core::arch::wasm32::i32x4_relaxed_trunc_f64x2_zero`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_trunc_f64x2_zero.html)
- [`core::arch::wasm32::u32x4_relaxed_trunc_f64x2_zero`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_trunc_f64x2_zero.html)
- [`core::arch::wasm32::f32x4_relaxed_madd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_madd.html)
- [`core::arch::wasm32::f32x4_relaxed_nmadd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_nmadd.html)
- [`core::arch::wasm32::f64x2_relaxed_madd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_madd.html)
- [`core::arch::wasm32::f64x2_relaxed_nmadd`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_nmadd.html)
- [`core::arch::wasm32::i8x16_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i8x16_relaxed_laneselect.html)
- [`core::arch::wasm32::u8x16_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u8x16_relaxed_laneselect.html)
- [`core::arch::wasm32::i16x8_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_laneselect.html)
- [`core::arch::wasm32::u16x8_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_laneselect.html)
- [`core::arch::wasm32::i32x4_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_laneselect.html)
- [`core::arch::wasm32::u32x4_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_laneselect.html)
- [`core::arch::wasm32::i64x2_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i64x2_relaxed_laneselect.html)
- [`core::arch::wasm32::u64x2_relaxed_laneselect`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u64x2_relaxed_laneselect.html)
- [`core::arch::wasm32::f32x4_relaxed_min`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_min.html)
- [`core::arch::wasm32::f32x4_relaxed_max`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f32x4_relaxed_max.html)
- [`core::arch::wasm32::f64x2_relaxed_min`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_min.html)
- [`core::arch::wasm32::f64x2_relaxed_max`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.f64x2_relaxed_max.html)
- [`core::arch::wasm32::i16x8_relaxed_q15mulr`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_q15mulr.html)
- [`core::arch::wasm32::u16x8_relaxed_q15mulr`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_q15mulr.html)
- [`core::arch::wasm32::i16x8_relaxed_dot_i8x16_i7x16`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i16x8_relaxed_dot_i8x16_i7x16.html)
- [`core::arch::wasm32::u16x8_relaxed_dot_i8x16_i7x16`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u16x8_relaxed_dot_i8x16_i7x16.html)
- [`core::arch::wasm32::i32x4_relaxed_dot_i8x16_i7x16_add`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.i32x4_relaxed_dot_i8x16_i7x16_add.html)
- [`core::arch::wasm32::u32x4_relaxed_dot_i8x16_i7x16_add`](https://doc.rust-lang.org/nightly/core/arch/wasm32/fn.u32x4_relaxed_dot_i8x16_i7x16_add.html)
  These APIs are now stable in const contexts:
- [`std::task::Waker::from_raw`](https://doc.rust-lang.org/nightly/std/task/struct.Waker.html#method.from_raw)
- [`std::task::Context::from_waker`](https://doc.rust-lang.org/nightly/std/task/struct.Context.html#method.from_waker)
- [`std::task::Context::waker`](https://doc.rust-lang.org/nightly/std/task/struct.Context.html#method.waker)
- [`$integer::from_str_radix`](https://doc.rust-lang.org/nightly/std/primitive.u32.html#method.from_str_radix)
- [`std::num::ParseIntError::kind`](https://doc.rust-lang.org/nightly/std/num/struct.ParseIntError.html#method.kind)
  Cargo
-----
- [feat: Add `info` cargo subcommand](https://github.com/rust-lang/cargo/pull/14141/)
  Compatibility Notes
  - We now [disallow setting some built-in cfgs via the command-line](https://github.com/rust-lang/rust/pull/126158) with the newly added [`explicit_builtin_cfgs_in_flags`](https://doc.rust-lang.org/rustc/lints/listing/deny-by-default.html#explicit-builtin-cfgs-in-flags) lint in order to prevent incoherent state, eg. `windows` cfg active but target is Linux based. The appropriate [`rustc` flag](https://doc.rust-lang.org/rustc/command-line-arguments.html) should be used instead.
- The standard library has a new implementation of `binary_search` which is significantly improves performance ([#128254](https://github.com/rust-lang/rust/pull/128254)). However when a sorted slice has multiple values which compare equal, the new implementation may select a different value among the equal ones than the old implementation.
- [illumos/Solaris now sets `MSG_NOSIGNAL` when writing to sockets](https://github.com/rust-lang/rust/pull/128259). This avoids killing the process with SIGPIPE when writing to a closed socket, which matches the existing behavior on other UNIX targets.
- [Removes a problematic hack that always passed the --whole-archive linker flag for tests, which may cause linker errors for code accidentally relying on it.](https://github.com/rust-lang/rust/pull/128400)
- The WebAssembly target features `multivalue` and `reference-types` are now
  both enabled by default. These two features both have subtle changes implied
  for generated WebAssembly binaries. For the `multivalue` feature, WebAssembly
  target support has changed when upgrading to LLVM 19. Support for generating
  functions with multiple returns no longer works and
  `-Ctarget-feature=+multivalue` has a different meaning than it did in LLVM 18
  and prior. There is no longer any supported means to generate a module that has
  a function with multiple returns in WebAssembly from Rust source code. For the
  `reference-types` feature the encoding of immediates in the `call_indirect`, a
  commonly used instruction by the WebAssembly backend, has changed. Validators
  and parsers which don't understand the `reference-types` proposal will no
  longer accept modules produced by LLVM due to this change in encoding of
  immediates. Additionally these features being enabled are encoded in the
  `target_features` custom section and may affect downstream tooling such as
  `wasm-opt` consuming the module. Generating a WebAssembly module that disables
  default features requires `-Zbuild-std` support from Cargo and more information
  can be found at
  [rust-lang/rust#128511](https://github.com/rust-lang/rust/pull/128511).
- [Rust now raises unsafety errors for union patterns in parameter-position](https://github.com/rust-lang/rust/pull/130531)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Resolve build failure on PPC64LE due to invalid float cast
  * ppc64le-float.patch</changelog>
</package>
<package pkgid="0c918716dd3133b0c9a42b6c6ad16229652af8e8f6d16bf151a11fc07449fe59" name="catatonit" arch="aarch64">
  <version epoch="0" ver="0.2.0" rel="150500.3.3.1"/>
  <changelog author="asarai@suse.com" date="1522152000">- Initial import of catatonit v0.1.0.</changelog>
  <changelog author="asarai@suse.com" date="1522152001">- Update to catatonit v0.1.1, which includes a fix for the libtool requirement.
  This lets us build on much older distributions.</changelog>
  <changelog author="asarai@suse.com" date="1522324800">- Update to catatonit v0.1.2 and update links to point to openSUSE repo.</changelog>
  <changelog author="jengelh@inai.de" date="1522756800">- Update package descriptions.</changelog>
  <changelog author="asarai@suse.com" date="1523016000">- Fix build to correctly build a static binary (which will allow it to work in
  all containers). This was caused by forgetting to include
  'glibc-devel-static'. I've added a check to ensure it doesn't happen by
  accident again.
- Add catatonit-rpmlintrc to include filters for "static binary" warnings,
  since this is intentional.</changelog>
  <changelog author="asarai@suse.com" date="1524052800">- Update to catatonit v0.1.3, which includes a fix for docker compatiblity so
  that dockerd doesn't give spurrious warnings.</changelog>
  <changelog author="asarai@suse.com" date="1548763200">- Update to catatonit v0.1.4, which includes support for "-g".</changelog>
  <changelog author="asarai@suse.com" date="1583150400">- Update to catatonit v0.1.5, which fixes two bugs where catatonit would hang
  endlessly when pid1 died in very specific ways. bsc#1176155</changelog>
  <changelog author="asarai@suse.com" date="1631793600">- Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to
  socket activation or features somewhat adjacent to socket activation (such as
  passing file descriptors).
- Update catatonit-rpmlintrc in order to cover that static binaries are now an
  error not a warning.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637841600">- Add 99bb9048f.patch: configure.ac: call AM_INIT_AUTOMAKE only
  once. Fix build with autocnf 2.71 / automake 1.16.5.</changelog>
  <changelog author="rbrown@suse.com" date="1649678400">- Update to catatont v0.1.7
- This release adds the ability for catatonit to be used as the only
  process in a pause container, by passing the -P flag (in this mode no
  subprocess is spawned and thus no signal forwarding is done).</changelog>
  <changelog author="asarai@suse.com" date="1696248000">- Update to catatonit v0.2.0.
  * Change license to GPL-2.0-or-later.
- Remove upstreamed patches:
  - 99bb9048f.patch</changelog>
</package>
<package pkgid="c2188074196a8465a35210167a5d8a302da22b01afc7949a053ad95c480a6a8c" name="catatonit" arch="ppc64le">
  <version epoch="0" ver="0.2.0" rel="150500.3.3.1"/>
  <changelog author="asarai@suse.com" date="1522152000">- Initial import of catatonit v0.1.0.</changelog>
  <changelog author="asarai@suse.com" date="1522152001">- Update to catatonit v0.1.1, which includes a fix for the libtool requirement.
  This lets us build on much older distributions.</changelog>
  <changelog author="asarai@suse.com" date="1522324800">- Update to catatonit v0.1.2 and update links to point to openSUSE repo.</changelog>
  <changelog author="jengelh@inai.de" date="1522756800">- Update package descriptions.</changelog>
  <changelog author="asarai@suse.com" date="1523016000">- Fix build to correctly build a static binary (which will allow it to work in
  all containers). This was caused by forgetting to include
  'glibc-devel-static'. I've added a check to ensure it doesn't happen by
  accident again.
- Add catatonit-rpmlintrc to include filters for "static binary" warnings,
  since this is intentional.</changelog>
  <changelog author="asarai@suse.com" date="1524052800">- Update to catatonit v0.1.3, which includes a fix for docker compatiblity so
  that dockerd doesn't give spurrious warnings.</changelog>
  <changelog author="asarai@suse.com" date="1548763200">- Update to catatonit v0.1.4, which includes support for "-g".</changelog>
  <changelog author="asarai@suse.com" date="1583150400">- Update to catatonit v0.1.5, which fixes two bugs where catatonit would hang
  endlessly when pid1 died in very specific ways. bsc#1176155</changelog>
  <changelog author="asarai@suse.com" date="1631793600">- Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to
  socket activation or features somewhat adjacent to socket activation (such as
  passing file descriptors).
- Update catatonit-rpmlintrc in order to cover that static binaries are now an
  error not a warning.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637841600">- Add 99bb9048f.patch: configure.ac: call AM_INIT_AUTOMAKE only
  once. Fix build with autocnf 2.71 / automake 1.16.5.</changelog>
  <changelog author="rbrown@suse.com" date="1649678400">- Update to catatont v0.1.7
- This release adds the ability for catatonit to be used as the only
  process in a pause container, by passing the -P flag (in this mode no
  subprocess is spawned and thus no signal forwarding is done).</changelog>
  <changelog author="asarai@suse.com" date="1696248000">- Update to catatonit v0.2.0.
  * Change license to GPL-2.0-or-later.
- Remove upstreamed patches:
  - 99bb9048f.patch</changelog>
</package>
<package pkgid="55d041394501c44e7fbbbe51106167887d8ff69ea672bdba48527e9ad9c26640" name="catatonit" arch="s390x">
  <version epoch="0" ver="0.2.0" rel="150500.3.3.1"/>
  <changelog author="asarai@suse.com" date="1522152000">- Initial import of catatonit v0.1.0.</changelog>
  <changelog author="asarai@suse.com" date="1522152001">- Update to catatonit v0.1.1, which includes a fix for the libtool requirement.
  This lets us build on much older distributions.</changelog>
  <changelog author="asarai@suse.com" date="1522324800">- Update to catatonit v0.1.2 and update links to point to openSUSE repo.</changelog>
  <changelog author="jengelh@inai.de" date="1522756800">- Update package descriptions.</changelog>
  <changelog author="asarai@suse.com" date="1523016000">- Fix build to correctly build a static binary (which will allow it to work in
  all containers). This was caused by forgetting to include
  'glibc-devel-static'. I've added a check to ensure it doesn't happen by
  accident again.
- Add catatonit-rpmlintrc to include filters for "static binary" warnings,
  since this is intentional.</changelog>
  <changelog author="asarai@suse.com" date="1524052800">- Update to catatonit v0.1.3, which includes a fix for docker compatiblity so
  that dockerd doesn't give spurrious warnings.</changelog>
  <changelog author="asarai@suse.com" date="1548763200">- Update to catatonit v0.1.4, which includes support for "-g".</changelog>
  <changelog author="asarai@suse.com" date="1583150400">- Update to catatonit v0.1.5, which fixes two bugs where catatonit would hang
  endlessly when pid1 died in very specific ways. bsc#1176155</changelog>
  <changelog author="asarai@suse.com" date="1631793600">- Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to
  socket activation or features somewhat adjacent to socket activation (such as
  passing file descriptors).
- Update catatonit-rpmlintrc in order to cover that static binaries are now an
  error not a warning.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637841600">- Add 99bb9048f.patch: configure.ac: call AM_INIT_AUTOMAKE only
  once. Fix build with autocnf 2.71 / automake 1.16.5.</changelog>
  <changelog author="rbrown@suse.com" date="1649678400">- Update to catatont v0.1.7
- This release adds the ability for catatonit to be used as the only
  process in a pause container, by passing the -P flag (in this mode no
  subprocess is spawned and thus no signal forwarding is done).</changelog>
  <changelog author="asarai@suse.com" date="1696248000">- Update to catatonit v0.2.0.
  * Change license to GPL-2.0-or-later.
- Remove upstreamed patches:
  - 99bb9048f.patch</changelog>
</package>
<package pkgid="d920b241cc0190598a79d71c42adc1996e25a16167a5807bf35603ba874b8ebb" name="catatonit" arch="src">
  <version epoch="0" ver="0.2.0" rel="150500.3.3.1"/>
  <changelog author="asarai@suse.com" date="1522152000">- Initial import of catatonit v0.1.0.</changelog>
  <changelog author="asarai@suse.com" date="1522152001">- Update to catatonit v0.1.1, which includes a fix for the libtool requirement.
  This lets us build on much older distributions.</changelog>
  <changelog author="asarai@suse.com" date="1522324800">- Update to catatonit v0.1.2 and update links to point to openSUSE repo.</changelog>
  <changelog author="jengelh@inai.de" date="1522756800">- Update package descriptions.</changelog>
  <changelog author="asarai@suse.com" date="1523016000">- Fix build to correctly build a static binary (which will allow it to work in
  all containers). This was caused by forgetting to include
  'glibc-devel-static'. I've added a check to ensure it doesn't happen by
  accident again.
- Add catatonit-rpmlintrc to include filters for "static binary" warnings,
  since this is intentional.</changelog>
  <changelog author="asarai@suse.com" date="1524052800">- Update to catatonit v0.1.3, which includes a fix for docker compatiblity so
  that dockerd doesn't give spurrious warnings.</changelog>
  <changelog author="asarai@suse.com" date="1548763200">- Update to catatonit v0.1.4, which includes support for "-g".</changelog>
  <changelog author="asarai@suse.com" date="1583150400">- Update to catatonit v0.1.5, which fixes two bugs where catatonit would hang
  endlessly when pid1 died in very specific ways. bsc#1176155</changelog>
  <changelog author="asarai@suse.com" date="1631793600">- Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to
  socket activation or features somewhat adjacent to socket activation (such as
  passing file descriptors).
- Update catatonit-rpmlintrc in order to cover that static binaries are now an
  error not a warning.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637841600">- Add 99bb9048f.patch: configure.ac: call AM_INIT_AUTOMAKE only
  once. Fix build with autocnf 2.71 / automake 1.16.5.</changelog>
  <changelog author="rbrown@suse.com" date="1649678400">- Update to catatont v0.1.7
- This release adds the ability for catatonit to be used as the only
  process in a pause container, by passing the -P flag (in this mode no
  subprocess is spawned and thus no signal forwarding is done).</changelog>
  <changelog author="asarai@suse.com" date="1696248000">- Update to catatonit v0.2.0.
  * Change license to GPL-2.0-or-later.
- Remove upstreamed patches:
  - 99bb9048f.patch</changelog>
</package>
<package pkgid="0825a0191a963f7b04cd740fc07e1f0420dcff4e24bf9d5bb97b53ac97adaeaf" name="catatonit" arch="x86_64">
  <version epoch="0" ver="0.2.0" rel="150500.3.3.1"/>
  <changelog author="asarai@suse.com" date="1522152000">- Initial import of catatonit v0.1.0.</changelog>
  <changelog author="asarai@suse.com" date="1522152001">- Update to catatonit v0.1.1, which includes a fix for the libtool requirement.
  This lets us build on much older distributions.</changelog>
  <changelog author="asarai@suse.com" date="1522324800">- Update to catatonit v0.1.2 and update links to point to openSUSE repo.</changelog>
  <changelog author="jengelh@inai.de" date="1522756800">- Update package descriptions.</changelog>
  <changelog author="asarai@suse.com" date="1523016000">- Fix build to correctly build a static binary (which will allow it to work in
  all containers). This was caused by forgetting to include
  'glibc-devel-static'. I've added a check to ensure it doesn't happen by
  accident again.
- Add catatonit-rpmlintrc to include filters for "static binary" warnings,
  since this is intentional.</changelog>
  <changelog author="asarai@suse.com" date="1524052800">- Update to catatonit v0.1.3, which includes a fix for docker compatiblity so
  that dockerd doesn't give spurrious warnings.</changelog>
  <changelog author="asarai@suse.com" date="1548763200">- Update to catatonit v0.1.4, which includes support for "-g".</changelog>
  <changelog author="asarai@suse.com" date="1583150400">- Update to catatonit v0.1.5, which fixes two bugs where catatonit would hang
  endlessly when pid1 died in very specific ways. bsc#1176155</changelog>
  <changelog author="asarai@suse.com" date="1631793600">- Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to
  socket activation or features somewhat adjacent to socket activation (such as
  passing file descriptors).
- Update catatonit-rpmlintrc in order to cover that static binaries are now an
  error not a warning.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637841600">- Add 99bb9048f.patch: configure.ac: call AM_INIT_AUTOMAKE only
  once. Fix build with autocnf 2.71 / automake 1.16.5.</changelog>
  <changelog author="rbrown@suse.com" date="1649678400">- Update to catatont v0.1.7
- This release adds the ability for catatonit to be used as the only
  process in a pause container, by passing the -P flag (in this mode no
  subprocess is spawned and thus no signal forwarding is done).</changelog>
  <changelog author="asarai@suse.com" date="1696248000">- Update to catatonit v0.2.0.
  * Change license to GPL-2.0-or-later.
- Remove upstreamed patches:
  - 99bb9048f.patch</changelog>
</package>
<package pkgid="7c95b10c5af2d20a5bc59fbb4d8f51b6b9edf682ed28cb130f36493de677b2cf" name="cdi-api" arch="noarch">
  <version epoch="0" ver="2.0.2" rel="150200.3.11.2"/>
  <changelog author="fstrba@suse.com" date="1553688000">- Initial packaging of cdi-api 1.2
- Generate and customize the ant build.xml file</changelog>
  <changelog author="jengelh@inai.de" date="1553688001">- Replace summary by something that speaks more than two
  acronyms.</changelog>
  <changelog author="fstrba@suse.com" date="1554292800">- Generate the tarball and pack only the api part, to avoid
  distributing non-distribuable content</changelog>
  <changelog author="jengelh@inai.de" date="1554552000">- Use _service instead of custom create-tarball.sh.
- Avoid double-shipping license file.</changelog>
  <changelog author="fstrba@suse.com" date="1647777600">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1649073600">- Update to upsteam release 2.0.2
  * No changelog was made available.
- Added patch:
  * 0001-Remove-dependency-on-glassfish-el.patch
    + patch out the two el wrapper functions that are unused</changelog>
  <changelog author="fstrba@suse.com" date="1708516800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1717761600">- Use the javax.inject artifact</changelog>
</package>
<package pkgid="1cdc5b8e3363e8600cc03f2105298b218506b79f13cdbae317c8e75d32b703b8" name="cdi-api" arch="src">
  <version epoch="0" ver="2.0.2" rel="150200.3.11.2"/>
  <changelog author="fstrba@suse.com" date="1553688000">- Initial packaging of cdi-api 1.2
- Generate and customize the ant build.xml file</changelog>
  <changelog author="jengelh@inai.de" date="1553688001">- Replace summary by something that speaks more than two
  acronyms.</changelog>
  <changelog author="fstrba@suse.com" date="1554292800">- Generate the tarball and pack only the api part, to avoid
  distributing non-distribuable content</changelog>
  <changelog author="jengelh@inai.de" date="1554552000">- Use _service instead of custom create-tarball.sh.
- Avoid double-shipping license file.</changelog>
  <changelog author="fstrba@suse.com" date="1647777600">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1649073600">- Update to upsteam release 2.0.2
  * No changelog was made available.
- Added patch:
  * 0001-Remove-dependency-on-glassfish-el.patch
    + patch out the two el wrapper functions that are unused</changelog>
  <changelog author="fstrba@suse.com" date="1708516800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1717761600">- Use the javax.inject artifact</changelog>
</package>
<package pkgid="ae0fa3979fc33f8f3ec5794325ee7194d191d72ff306b7c163532f4477c54edd" name="cdi-api-javadoc" arch="noarch">
  <version epoch="0" ver="2.0.2" rel="150200.3.11.2"/>
  <changelog author="fstrba@suse.com" date="1553688000">- Initial packaging of cdi-api 1.2
- Generate and customize the ant build.xml file</changelog>
  <changelog author="jengelh@inai.de" date="1553688001">- Replace summary by something that speaks more than two
  acronyms.</changelog>
  <changelog author="fstrba@suse.com" date="1554292800">- Generate the tarball and pack only the api part, to avoid
  distributing non-distribuable content</changelog>
  <changelog author="jengelh@inai.de" date="1554552000">- Use _service instead of custom create-tarball.sh.
- Avoid double-shipping license file.</changelog>
  <changelog author="fstrba@suse.com" date="1647777600">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1649073600">- Update to upsteam release 2.0.2
  * No changelog was made available.
- Added patch:
  * 0001-Remove-dependency-on-glassfish-el.patch
    + patch out the two el wrapper functions that are unused</changelog>
  <changelog author="fstrba@suse.com" date="1708516800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1717761600">- Use the javax.inject artifact</changelog>
</package>
<package pkgid="58e7c85cd657af0e6a5f494e4c1ee480a74a2cf83ca1610880f2073b6ecb71ce" name="ceph" arch="aarch64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="b41d1342a75e719808fa08d675fe29c0c8c3135662bd206a7ca924ac71469cfe" name="ceph" arch="ppc64le">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="33f7365fb820cc4ebeed91224d091b53393531dc63a0390b6cf3859c543bface" name="ceph" arch="s390x">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="d62b36a18f005bf2ee85fd10f577e965e80470431d9ca01825397254122a9007" name="ceph" arch="src">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="6ba2316980af0e163cef86c6c61d3bc27b4bc061387b19c4eb731918360f1dcd" name="ceph" arch="x86_64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="95a28bf32e434a39df1d7c9c3f52df8ccd569580e280b766e6dab24370a1445b" name="ceph-base" arch="aarch64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="7cda4294ad48ba3a02b3249bd9fdcd38985af8b9f5bf24a29267c8326a844bfd" name="ceph-base" arch="ppc64le">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="cc7e5cc46436415d117fe4efa43da8502ce4db14e0e6d96ef4835de177cd3328" name="ceph-base" arch="s390x">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="4d88f493fcf2451ede18dac8c69d306c95a95f71006781323c315783ef7287f6" name="ceph-base" arch="x86_64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="4871863ff55b9f017d69e4c6467deee47f8eca9b62ecf6b419fd657230d87679" name="ceph-common" arch="aarch64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="ed0dd595185d2d40f5bb0e10502cd2aeff2bef3d3bf6e5d2a00e3601fd57e8f3" name="ceph-common" arch="ppc64le">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="d25d3934ea7d95e9fa02ff76c02b445f182d9eee38e170174e92617c9aef55b8" name="ceph-common" arch="s390x">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="6e9fd2a4312190f94c7f6fbc84a238834823ec26968691fa7d6e61eaf703ea3c" name="ceph-common" arch="x86_64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="1edd9a5ed88acfbe4e4bd359075b791874c019d932d26dec90375fac05f10752" name="ceph-fuse" arch="aarch64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="8a3173ca3a3c26bc9b1f0831bc0b1f3c73615464048c10ced7cfe3898c68083c" name="ceph-fuse" arch="ppc64le">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="6203ce3b527bb6b1602e0fae73af87e0242036b63b8dbee55185fc18c36b6ee9" name="ceph-fuse" arch="s390x">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="0c509032ae25ad12c7c5cd6cc98eeac7272ad0c2a1241cffa0dd8d64960f9108" name="ceph-fuse" arch="x86_64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="7448cf9c5c63e10118f9604931cb72ab5a300236113f9e90455c958cd04d5be1" name="ceph-grafana-dashboards" arch="noarch">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="203231e637fd7db1a4ed71bf9ef968a53a900bab52bacd5feaabb1eac96cdb74" name="ceph-immutable-object-cache" arch="aarch64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="010a89d8533e1b0add49bff299000f4b1b3912bb35417ad05da57fa766309b65" name="ceph-immutable-object-cache" arch="ppc64le">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="2a8468a80f2cb0b5a7861d7af769fc03177ad7661ea29cd69bd17987a37a78d8" name="ceph-immutable-object-cache" arch="s390x">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="9b47dc8833e839c73e16e64c68b5cfa05a8bd6c2403b843e76ff873808593031" name="ceph-immutable-object-cache" arch="x86_64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="c178d3ea74ea93b017986f9b6dbd348a97a7546d0c837c194490a633af3607a5" name="ceph-mds" arch="aarch64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="219843c810dd07b1c1c79cd48eebb70bff567846f30b88f31c853ad21802bb1a" name="ceph-mds" arch="ppc64le">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="49765972de63adebcc0b5486af32e071f25e0a47f0a293efe4412818a9bd5fa2" name="ceph-mds" arch="s390x">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="82813ad260007f229725aaa3a94a8da87a6daa6c1eedaec82924e67c81db0941" name="ceph-mds" arch="x86_64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="cd46e0d38ae8a7d8f47fec9fd576222a84ed9696f2024fb2cac3964e3fd3c0a1" name="ceph-mgr" arch="aarch64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="2de041b19e2cb20e8bad3e519312b1bc41e96c59d5740db5d7e6fd076e3e84c4" name="ceph-mgr" arch="ppc64le">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="10a72bebd2bd9726142043685e6ed8e338b9aef8ee4647e4655f5db47e9e5303" name="ceph-mgr" arch="s390x">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="ac8b5a65ea0b859b3a6344a479648fd86960d888144d092bd4e6ec7d819da52f" name="ceph-mgr" arch="x86_64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="7b269827ff011c843dde7adb24861d17057e9e6f88ecb5d025bee7bb05987754" name="ceph-mgr-cephadm" arch="noarch">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="25b54518a95c87fef5190f7e562632350d2016ce32b3f0767aed38724b870c1a" name="ceph-mgr-dashboard" arch="noarch">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="2adc91e66da6c41ee44405f41280c12648ee6b7f4de9f320224ab6e9819c0a08" name="ceph-mgr-diskprediction-local" arch="noarch">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="bba213e8590de51bfcb20f65497ff8bff56f3431154fc51ab1f80d1ab5814f19" name="ceph-mgr-k8sevents" arch="noarch">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="d06e06d816d0235ee53e29c5932face95b0b4f91aa51513a0eed7ee5ced49071" name="ceph-mgr-modules-core" arch="noarch">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="546fcabe84e0a43d1b934e5cf1c58f2cf89357dc9578e76b1f8d0029f178d2de" name="ceph-mgr-rook" arch="noarch">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="a4b9872d05f01cf8dda0a980e36d25206b933ab6ae0102ce2ed0dac5ff566739" name="ceph-mon" arch="aarch64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="20b9e8c6d7fa7c139d086c3c8410e2bc3f336613386d61a66ed3d710fea61142" name="ceph-mon" arch="ppc64le">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="c4ee6b3115ea4e6261877b184c66e4005060c8d9b066cb29abd458a58ebe1045" name="ceph-mon" arch="s390x">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="1ec42028945e457facd4cea0f31842d1aaa042ddf0061da5b2abf2f27f254668" name="ceph-mon" arch="x86_64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="90747153c57d9a9200fb6a7155c152ac3710610d379834099cb3f04b1509628b" name="ceph-osd" arch="aarch64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="172ca96feba82b867c3fc20bb2399483c2c44c428643ca3263ce0a09e492fc1a" name="ceph-osd" arch="ppc64le">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="b66d0cb07b64a2634d48e779a6677091f1c6671ff562d4e22ae87fec54877172" name="ceph-osd" arch="s390x">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="fbabb5e77dc01bb41df9307eb101b638309d9517a18d0eb71c76ec87f732db9d" name="ceph-osd" arch="x86_64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="52cf7da072b6cdd5237d8a108006713bd3ae08b8a59b0dd74e15c8c2cd593ae6" name="ceph-prometheus-alerts" arch="noarch">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="f3a11869ec004181d1c210f832905edc1329a7fd068d87486781f17fceacf13e" name="ceph-radosgw" arch="aarch64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="83d66d0b7bd7eb7a622fcd462a9f6c03dbd927571fb38ef2b6cc0f781389f5d5" name="ceph-radosgw" arch="ppc64le">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="41271aaf5235b9b8b5860ae6ee9e1ae75887038bcd0d3e071762e9326c58a7e3" name="ceph-radosgw" arch="s390x">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="0f52020fedfcfe5b99e1fdbe56b885ceeced2b94ca08081d86f7129ab36efa24" name="ceph-radosgw" arch="x86_64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="09450f052d77ab681fe3f11a9f055172d890a01fe07c591200c4e79c286b9af6" name="ceph-test" arch="src">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="04110d3a2bfcc0315e8787aacdb0a51adfd06f8996a65584d4edd8bb02d807bf" name="ceph-test" arch="x86_64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="628e7e00a9b1290d1f327ea532da5d68d6c47c72c4b1487797defea1b247c036" name="cephadm" arch="noarch">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="abb5dc6f5d91d243dba68a57b7c8e8d98b3deca1796c8287f710a8680805d1e6" name="cephfs-mirror" arch="aarch64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="685afe97b27664fd58092fe35f911f2d09bfda4d5ac4a98593f26453f4a86972" name="cephfs-mirror" arch="ppc64le">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="d6c62708367118d518e59f9e5b282bf32ed2dda16c8d89b2f264763b6f3ade77" name="cephfs-mirror" arch="s390x">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="33adf4426d3ff22af89dc324fbf7589ac15b9e2e59aaadc84914b967e583a7fa" name="cephfs-mirror" arch="x86_64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="b24fba1f6a427729a5fa9a08906e17bf59745c1cf8f2eff18696e9b67f4c7bd9" name="cephfs-shell" arch="aarch64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="0090cf09b244ed3c4b4e794dbd2d33e0249c04432cb4452f974282b43865e15f" name="cephfs-shell" arch="ppc64le">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="c71d8f10630fa33bbf95f2914ce419b610274d2b844a9c511b732adb4c0b3134" name="cephfs-shell" arch="s390x">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="5d552910c41080b5ab8db4220cf03f783ec2057d85ce7c319fc2aac0dae080c7" name="cephfs-shell" arch="x86_64">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="68a0e640b913c1134bb503379c886989b92c38bba3aa1c946d594d5302982937" name="cephfs-top" arch="noarch">
  <version epoch="0" ver="16.2.13.66+g54799ee0666" rel="150400.3.11.1"/>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
  <changelog author="tserong@suse.com" date="1678449600">- Update to 16.2.11-62-gce6291a3463:
  + (bsc#1201088) fix FTBFS on gcc 13</changelog>
  <changelog author="tserong@suse.com" date="1680004800">- Update to 16.2.11-65-g8b7e6fc0182:
  + (bsc#1201088) test/librados: fix FTBFS on gcc 13
  + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="tserong@suse.com" date="1683806400">- Update to 16.2.13-66-g54799ee0666:
  + (bsc#1199880) mgr: don't dump global config holding gil
  + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears
  + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs
  + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate
  + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments
  + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode'
  + (bsc#1210944) cmake: patch boost source to support python 3.11
  + (bsc#1211090) fix FTBFS on s390x</changelog>
  <changelog author="tserong@suse.com" date="1684929600">- Add "#!BuildConstraint" to spec files for compatibility with _multibuild</changelog>
  <changelog author="tserong@suse.com" date="1687867200">- Remove _constraints file, add README-constraints.txt and pre_checkin.env</changelog>
</package>
<package pkgid="e34b66104e765595abfb74306a7e402590a84d92bbc6f7f555b80a2a14b3aa66" name="checker-qual" arch="noarch">
  <version epoch="0" ver="3.22.0" rel="150200.5.7.2"/>
  <changelog author="fstrba@suse.com" date="1652788800">- Initial packaging of checkerframework's checker-qual annotations
  3.22.0</changelog>
</package>
<package pkgid="e68b7a8109afc04b57f9857a36ba67940bc9e0ee3e77137b04bfe7b7bd0c3e06" name="checker-qual" arch="src">
  <version epoch="0" ver="3.22.0" rel="150200.5.7.2"/>
  <changelog author="fstrba@suse.com" date="1652788800">- Initial packaging of checkerframework's checker-qual annotations
  3.22.0</changelog>
</package>
<package pkgid="b346554cbb3fa8da8114d1043465aad751160cd279ab44a9bc10c141c06fd7aa" name="checker-qual-javadoc" arch="noarch">
  <version epoch="0" ver="3.22.0" rel="150200.5.7.2"/>
  <changelog author="fstrba@suse.com" date="1652788800">- Initial packaging of checkerframework's checker-qual annotations
  3.22.0</changelog>
</package>
<package pkgid="c6879710c092402421f5ddd9e94be92a6e1ae7814b861ad2e501f321fe2281ed" name="chromaprint" arch="src">
  <version epoch="0" ver="1.4.3" rel="150200.3.2.1"/>
  <changelog author="pascal.bleser@opensuse.org" date="1337428800">- initial version (0.6)</changelog>
  <changelog author="Manfred.Tremmel@iiv.de" date="1338292800">- ffmpeg doen't include url.h anymorecompile against ffmpeg_oldabi</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1352462400">- Update to version 0.7
  - Support for the latest FFmpeg API.
  - New (non-default) fingerprint algorithm that removes leading silence.
  - API to configure fingerprint algorithms, currently only used by
  CHROMAPRINT_ALGORITHM_TEST4.</changelog>
  <changelog author="schwab@suse.de" date="1363694400">- Properly determine LIB_SUFFIX</changelog>
  <changelog author="joerg.lorenzen@ki.tng.de" date="1383134400">- Update to version 1.0
  - Support for the latest FFmpeg API.
  - Support for reading audio from stdin in fpcalc.
  - Changed fpcalc to return non-zero status on failure.</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1418212800">- Add baselibs.conf</changelog>
  <changelog author="olaf@aepfle.de" date="1418212801">- Update to version 1.1
  - Fixed potential DoS attack in fingerprint decompression code. (#6)
  - Fixed invalid memory read with some fingerprinter configurations. (#5)
  - Added support for audio format conversion with libav. (#2, Gordon Pettey)</changelog>
  <changelog author="mpluskal@suse.com" date="1434456000">- Update to version 1.2
  * Fixed compilation with neither libswresample nor libavresample
    (#11)
  * Fixed compilation with static libav (#10)
  * Functions chromaprint_encode_fingerprint and
    chromaprint_decode_fingerprint are changed to accept const
    pointer as input
  * Added support for using the Kiss FFT library (should make
    Android port easier)
  * Removed obsolete dev tools from the package
  * More compatible DEBUG() macro
- Cleanup spec file with spec-cleaner
- Add missing dependency on boost
- Use cmake macro</changelog>
  <changelog author="olaf@aepfle.de" date="1442923200">- Use pkgconfig for ffmpeg BuildRequires</changelog>
  <changelog author="olaf@aepfle.de" date="1449576000">- Remove broken libffmpeg requires in devel pkg</changelog>
  <changelog author="olaf@aepfle.de" date="1449662400">- Use pkg-config to detect ffmpeg in cmake
  chromaprint-ffmpeg-pkgconfig.patch
- Add bcond_without to use ffmpeg unconditional</changelog>
  <changelog author="tchvatal@suse.com" date="1450440000">- Remove needless conditional for the libdir which is in the macro</changelog>
  <changelog author="jengelh@inai.de" date="1455537600">- Update to new upstream release 1.3.1
  * Support for ffmpeg 3.x
  * You can use use "-length 0" in fpcalc to get the full fingerprint
  * New function chromaprint_get_fingerprint_hash for calculating
  SimHash from the fingerprint data</changelog>
  <changelog author="olaf@aepfle.de" date="1459512000">- Restore support for libswresample/libavresample (bsc#973555)
- Remove usage of deprecated API
  chromaprint-ffmpeg-API.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1469707200">- Remove unused Provides libchromaprint-with-ffmpeg</changelog>
  <changelog author="adam.majer@suse.de" date="1485950400">- use individual libboost-*-devel packages instead of boost-devel</changelog>
  <changelog author="alarrosa@suse.com" date="1500292800">- Update to 1.4.2:
  * Fixed invalid memory access when decoding base64-encoded fingerprints.
  * Removed unnecessary library dependencies libchromaprint to avoid
    circular dependency problems with FFmpeg.
- Rebase chromaprint-ffmpeg-pkgconfig.patch
- Drop chromaprint-ffmpeg-API.patch which isn't needed anymore.
- Update to 1.4.1:
  * Restored the -v/-version parameter for fpcalc that got accidentally
    removed in 1.4.
  * Fixed processing of some short audio files. They were ignored in 1.4.
  * The DURATION field in the default output of fpcalc is now printed as an
    integer again.
  * Added missing version number to libchromaprint.pc.
  * Linux fpcalc builds are now fully static.
- Update to 1.4.0:
  * Fully streaming audio processing without any post-processing step
    for the fingerprint generation.
  * Many performance optimizations. Especially when processing long streams,
    operations should be faster and use less memory.
  * C++11 compiler is now required for building the library.
  * The public C API now uses standard fixed-size int types from stdint.h
    (breaks backwards compatibility).
  * All code written for the library is now distributed under the MIT license.
  * Kiss FFT is now included with the library and automatically used if
    no other FFT library is found.
  * Added support for using the FFTW3F version of FFTW3.
  * Boost is no longer used.
- Update to 1.3.2:
  * Fixed crash on an invalid audio file that FFmpeg could not decode.</changelog>
  <changelog author="jengelh@inai.de" date="1500984000">- Fix RPM groups.</changelog>
  <changelog author="avindra@opensuse.org" date="1516795200">- Update to 1.4.3:
  * Allow one packet to have decoding error
  * Print output even if there is a decoding error, exit with error
    code 3 instead of 2 in such case
  * Add new option -ignore-errors to change the error code 3 to 0
  * Add new option -algorithm NUM
  * Periodically flush output when working on a stream
- drop chromaprint-ffmpeg-pkgconfig.patch
  * fixed upstream
- Switch to https for URL
- Source moved to github
- cleanup with spec-cleaner</changelog>
</package>
<package pkgid="390feb74952290214aefe49a2f82169b0f969436436ccbc60cc76409a802dacb" name="chromaprint-fpcalc" arch="aarch64">
  <version epoch="0" ver="1.4.3" rel="150200.3.2.1"/>
  <changelog author="hrvoje.senjan@gmail.com" date="1418212800">- Add baselibs.conf</changelog>
  <changelog author="olaf@aepfle.de" date="1418212801">- Update to version 1.1
  - Fixed potential DoS attack in fingerprint decompression code. (#6)
  - Fixed invalid memory read with some fingerprinter configurations. (#5)
  - Added support for audio format conversion with libav. (#2, Gordon Pettey)</changelog>
  <changelog author="mpluskal@suse.com" date="1434456000">- Update to version 1.2
  * Fixed compilation with neither libswresample nor libavresample
    (#11)
  * Fixed compilation with static libav (#10)
  * Functions chromaprint_encode_fingerprint and
    chromaprint_decode_fingerprint are changed to accept const
    pointer as input
  * Added support for using the Kiss FFT library (should make
    Android port easier)
  * Removed obsolete dev tools from the package
  * More compatible DEBUG() macro
- Cleanup spec file with spec-cleaner
- Add missing dependency on boost
- Use cmake macro</changelog>
  <changelog author="olaf@aepfle.de" date="1442923200">- Use pkgconfig for ffmpeg BuildRequires</changelog>
  <changelog author="olaf@aepfle.de" date="1449576000">- Remove broken libffmpeg requires in devel pkg</changelog>
  <changelog author="olaf@aepfle.de" date="1449662400">- Use pkg-config to detect ffmpeg in cmake
  chromaprint-ffmpeg-pkgconfig.patch
- Add bcond_without to use ffmpeg unconditional</changelog>
  <changelog author="tchvatal@suse.com" date="1450440000">- Remove needless conditional for the libdir which is in the macro</changelog>
  <changelog author="jengelh@inai.de" date="1455537600">- Update to new upstream release 1.3.1
  * Support for ffmpeg 3.x
  * You can use use "-length 0" in fpcalc to get the full fingerprint
  * New function chromaprint_get_fingerprint_hash for calculating
  SimHash from the fingerprint data</changelog>
  <changelog author="olaf@aepfle.de" date="1459512000">- Restore support for libswresample/libavresample (bsc#973555)
- Remove usage of deprecated API
  chromaprint-ffmpeg-API.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1469707200">- Remove unused Provides libchromaprint-with-ffmpeg</changelog>
  <changelog author="adam.majer@suse.de" date="1485950400">- use individual libboost-*-devel packages instead of boost-devel</changelog>
  <changelog author="alarrosa@suse.com" date="1500292800">- Update to 1.4.2:
  * Fixed invalid memory access when decoding base64-encoded fingerprints.
  * Removed unnecessary library dependencies libchromaprint to avoid
    circular dependency problems with FFmpeg.
- Rebase chromaprint-ffmpeg-pkgconfig.patch
- Drop chromaprint-ffmpeg-API.patch which isn't needed anymore.
- Update to 1.4.1:
  * Restored the -v/-version parameter for fpcalc that got accidentally
    removed in 1.4.
  * Fixed processing of some short audio files. They were ignored in 1.4.
  * The DURATION field in the default output of fpcalc is now printed as an
    integer again.
  * Added missing version number to libchromaprint.pc.
  * Linux fpcalc builds are now fully static.
- Update to 1.4.0:
  * Fully streaming audio processing without any post-processing step
    for the fingerprint generation.
  * Many performance optimizations. Especially when processing long streams,
    operations should be faster and use less memory.
  * C++11 compiler is now required for building the library.
  * The public C API now uses standard fixed-size int types from stdint.h
    (breaks backwards compatibility).
  * All code written for the library is now distributed under the MIT license.
  * Kiss FFT is now included with the library and automatically used if
    no other FFT library is found.
  * Added support for using the FFTW3F version of FFTW3.
  * Boost is no longer used.
- Update to 1.3.2:
  * Fixed crash on an invalid audio file that FFmpeg could not decode.</changelog>
  <changelog author="jengelh@inai.de" date="1500984000">- Fix RPM groups.</changelog>
  <changelog author="avindra@opensuse.org" date="1516795200">- Update to 1.4.3:
  * Allow one packet to have decoding error
  * Print output even if there is a decoding error, exit with error
    code 3 instead of 2 in such case
  * Add new option -ignore-errors to change the error code 3 to 0
  * Add new option -algorithm NUM
  * Periodically flush output when working on a stream
- drop chromaprint-ffmpeg-pkgconfig.patch
  * fixed upstream
- Switch to https for URL
- Source moved to github
- cleanup with spec-cleaner</changelog>
</package>
<package pkgid="c0274040f9f1a5fb9f954df04af7aebb739ab0f1c0d10c23166d396761b2615b" name="chromaprint-fpcalc" arch="ppc64le">
  <version epoch="0" ver="1.4.3" rel="150200.3.2.1"/>
  <changelog author="hrvoje.senjan@gmail.com" date="1418212800">- Add baselibs.conf</changelog>
  <changelog author="olaf@aepfle.de" date="1418212801">- Update to version 1.1
  - Fixed potential DoS attack in fingerprint decompression code. (#6)
  - Fixed invalid memory read with some fingerprinter configurations. (#5)
  - Added support for audio format conversion with libav. (#2, Gordon Pettey)</changelog>
  <changelog author="mpluskal@suse.com" date="1434456000">- Update to version 1.2
  * Fixed compilation with neither libswresample nor libavresample
    (#11)
  * Fixed compilation with static libav (#10)
  * Functions chromaprint_encode_fingerprint and
    chromaprint_decode_fingerprint are changed to accept const
    pointer as input
  * Added support for using the Kiss FFT library (should make
    Android port easier)
  * Removed obsolete dev tools from the package
  * More compatible DEBUG() macro
- Cleanup spec file with spec-cleaner
- Add missing dependency on boost
- Use cmake macro</changelog>
  <changelog author="olaf@aepfle.de" date="1442923200">- Use pkgconfig for ffmpeg BuildRequires</changelog>
  <changelog author="olaf@aepfle.de" date="1449576000">- Remove broken libffmpeg requires in devel pkg</changelog>
  <changelog author="olaf@aepfle.de" date="1449662400">- Use pkg-config to detect ffmpeg in cmake
  chromaprint-ffmpeg-pkgconfig.patch
- Add bcond_without to use ffmpeg unconditional</changelog>
  <changelog author="tchvatal@suse.com" date="1450440000">- Remove needless conditional for the libdir which is in the macro</changelog>
  <changelog author="jengelh@inai.de" date="1455537600">- Update to new upstream release 1.3.1
  * Support for ffmpeg 3.x
  * You can use use "-length 0" in fpcalc to get the full fingerprint
  * New function chromaprint_get_fingerprint_hash for calculating
  SimHash from the fingerprint data</changelog>
  <changelog author="olaf@aepfle.de" date="1459512000">- Restore support for libswresample/libavresample (bsc#973555)
- Remove usage of deprecated API
  chromaprint-ffmpeg-API.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1469707200">- Remove unused Provides libchromaprint-with-ffmpeg</changelog>
  <changelog author="adam.majer@suse.de" date="1485950400">- use individual libboost-*-devel packages instead of boost-devel</changelog>
  <changelog author="alarrosa@suse.com" date="1500292800">- Update to 1.4.2:
  * Fixed invalid memory access when decoding base64-encoded fingerprints.
  * Removed unnecessary library dependencies libchromaprint to avoid
    circular dependency problems with FFmpeg.
- Rebase chromaprint-ffmpeg-pkgconfig.patch
- Drop chromaprint-ffmpeg-API.patch which isn't needed anymore.
- Update to 1.4.1:
  * Restored the -v/-version parameter for fpcalc that got accidentally
    removed in 1.4.
  * Fixed processing of some short audio files. They were ignored in 1.4.
  * The DURATION field in the default output of fpcalc is now printed as an
    integer again.
  * Added missing version number to libchromaprint.pc.
  * Linux fpcalc builds are now fully static.
- Update to 1.4.0:
  * Fully streaming audio processing without any post-processing step
    for the fingerprint generation.
  * Many performance optimizations. Especially when processing long streams,
    operations should be faster and use less memory.
  * C++11 compiler is now required for building the library.
  * The public C API now uses standard fixed-size int types from stdint.h
    (breaks backwards compatibility).
  * All code written for the library is now distributed under the MIT license.
  * Kiss FFT is now included with the library and automatically used if
    no other FFT library is found.
  * Added support for using the FFTW3F version of FFTW3.
  * Boost is no longer used.
- Update to 1.3.2:
  * Fixed crash on an invalid audio file that FFmpeg could not decode.</changelog>
  <changelog author="jengelh@inai.de" date="1500984000">- Fix RPM groups.</changelog>
  <changelog author="avindra@opensuse.org" date="1516795200">- Update to 1.4.3:
  * Allow one packet to have decoding error
  * Print output even if there is a decoding error, exit with error
    code 3 instead of 2 in such case
  * Add new option -ignore-errors to change the error code 3 to 0
  * Add new option -algorithm NUM
  * Periodically flush output when working on a stream
- drop chromaprint-ffmpeg-pkgconfig.patch
  * fixed upstream
- Switch to https for URL
- Source moved to github
- cleanup with spec-cleaner</changelog>
</package>
<package pkgid="e2778482fb05a8236d90dd6fe4153cbe201201bf8e00fbf80d3b7cd5218361e7" name="chromaprint-fpcalc" arch="s390x">
  <version epoch="0" ver="1.4.3" rel="150200.3.2.1"/>
  <changelog author="hrvoje.senjan@gmail.com" date="1418212800">- Add baselibs.conf</changelog>
  <changelog author="olaf@aepfle.de" date="1418212801">- Update to version 1.1
  - Fixed potential DoS attack in fingerprint decompression code. (#6)
  - Fixed invalid memory read with some fingerprinter configurations. (#5)
  - Added support for audio format conversion with libav. (#2, Gordon Pettey)</changelog>
  <changelog author="mpluskal@suse.com" date="1434456000">- Update to version 1.2
  * Fixed compilation with neither libswresample nor libavresample
    (#11)
  * Fixed compilation with static libav (#10)
  * Functions chromaprint_encode_fingerprint and
    chromaprint_decode_fingerprint are changed to accept const
    pointer as input
  * Added support for using the Kiss FFT library (should make
    Android port easier)
  * Removed obsolete dev tools from the package
  * More compatible DEBUG() macro
- Cleanup spec file with spec-cleaner
- Add missing dependency on boost
- Use cmake macro</changelog>
  <changelog author="olaf@aepfle.de" date="1442923200">- Use pkgconfig for ffmpeg BuildRequires</changelog>
  <changelog author="olaf@aepfle.de" date="1449576000">- Remove broken libffmpeg requires in devel pkg</changelog>
  <changelog author="olaf@aepfle.de" date="1449662400">- Use pkg-config to detect ffmpeg in cmake
  chromaprint-ffmpeg-pkgconfig.patch
- Add bcond_without to use ffmpeg unconditional</changelog>
  <changelog author="tchvatal@suse.com" date="1450440000">- Remove needless conditional for the libdir which is in the macro</changelog>
  <changelog author="jengelh@inai.de" date="1455537600">- Update to new upstream release 1.3.1
  * Support for ffmpeg 3.x
  * You can use use "-length 0" in fpcalc to get the full fingerprint
  * New function chromaprint_get_fingerprint_hash for calculating
  SimHash from the fingerprint data</changelog>
  <changelog author="olaf@aepfle.de" date="1459512000">- Restore support for libswresample/libavresample (bsc#973555)
- Remove usage of deprecated API
  chromaprint-ffmpeg-API.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1469707200">- Remove unused Provides libchromaprint-with-ffmpeg</changelog>
  <changelog author="adam.majer@suse.de" date="1485950400">- use individual libboost-*-devel packages instead of boost-devel</changelog>
  <changelog author="alarrosa@suse.com" date="1500292800">- Update to 1.4.2:
  * Fixed invalid memory access when decoding base64-encoded fingerprints.
  * Removed unnecessary library dependencies libchromaprint to avoid
    circular dependency problems with FFmpeg.
- Rebase chromaprint-ffmpeg-pkgconfig.patch
- Drop chromaprint-ffmpeg-API.patch which isn't needed anymore.
- Update to 1.4.1:
  * Restored the -v/-version parameter for fpcalc that got accidentally
    removed in 1.4.
  * Fixed processing of some short audio files. They were ignored in 1.4.
  * The DURATION field in the default output of fpcalc is now printed as an
    integer again.
  * Added missing version number to libchromaprint.pc.
  * Linux fpcalc builds are now fully static.
- Update to 1.4.0:
  * Fully streaming audio processing without any post-processing step
    for the fingerprint generation.
  * Many performance optimizations. Especially when processing long streams,
    operations should be faster and use less memory.
  * C++11 compiler is now required for building the library.
  * The public C API now uses standard fixed-size int types from stdint.h
    (breaks backwards compatibility).
  * All code written for the library is now distributed under the MIT license.
  * Kiss FFT is now included with the library and automatically used if
    no other FFT library is found.
  * Added support for using the FFTW3F version of FFTW3.
  * Boost is no longer used.
- Update to 1.3.2:
  * Fixed crash on an invalid audio file that FFmpeg could not decode.</changelog>
  <changelog author="jengelh@inai.de" date="1500984000">- Fix RPM groups.</changelog>
  <changelog author="avindra@opensuse.org" date="1516795200">- Update to 1.4.3:
  * Allow one packet to have decoding error
  * Print output even if there is a decoding error, exit with error
    code 3 instead of 2 in such case
  * Add new option -ignore-errors to change the error code 3 to 0
  * Add new option -algorithm NUM
  * Periodically flush output when working on a stream
- drop chromaprint-ffmpeg-pkgconfig.patch
  * fixed upstream
- Switch to https for URL
- Source moved to github
- cleanup with spec-cleaner</changelog>
</package>
<package pkgid="59d1715ba014b9d0d9a47aadfe8cad867892b9cba9644b90d051d419da2699b1" name="chromaprint-fpcalc" arch="x86_64">
  <version epoch="0" ver="1.4.3" rel="150200.3.2.1"/>
  <changelog author="hrvoje.senjan@gmail.com" date="1418212800">- Add baselibs.conf</changelog>
  <changelog author="olaf@aepfle.de" date="1418212801">- Update to version 1.1
  - Fixed potential DoS attack in fingerprint decompression code. (#6)
  - Fixed invalid memory read with some fingerprinter configurations. (#5)
  - Added support for audio format conversion with libav. (#2, Gordon Pettey)</changelog>
  <changelog author="mpluskal@suse.com" date="1434456000">- Update to version 1.2
  * Fixed compilation with neither libswresample nor libavresample
    (#11)
  * Fixed compilation with static libav (#10)
  * Functions chromaprint_encode_fingerprint and
    chromaprint_decode_fingerprint are changed to accept const
    pointer as input
  * Added support for using the Kiss FFT library (should make
    Android port easier)
  * Removed obsolete dev tools from the package
  * More compatible DEBUG() macro
- Cleanup spec file with spec-cleaner
- Add missing dependency on boost
- Use cmake macro</changelog>
  <changelog author="olaf@aepfle.de" date="1442923200">- Use pkgconfig for ffmpeg BuildRequires</changelog>
  <changelog author="olaf@aepfle.de" date="1449576000">- Remove broken libffmpeg requires in devel pkg</changelog>
  <changelog author="olaf@aepfle.de" date="1449662400">- Use pkg-config to detect ffmpeg in cmake
  chromaprint-ffmpeg-pkgconfig.patch
- Add bcond_without to use ffmpeg unconditional</changelog>
  <changelog author="tchvatal@suse.com" date="1450440000">- Remove needless conditional for the libdir which is in the macro</changelog>
  <changelog author="jengelh@inai.de" date="1455537600">- Update to new upstream release 1.3.1
  * Support for ffmpeg 3.x
  * You can use use "-length 0" in fpcalc to get the full fingerprint
  * New function chromaprint_get_fingerprint_hash for calculating
  SimHash from the fingerprint data</changelog>
  <changelog author="olaf@aepfle.de" date="1459512000">- Restore support for libswresample/libavresample (bsc#973555)
- Remove usage of deprecated API
  chromaprint-ffmpeg-API.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1469707200">- Remove unused Provides libchromaprint-with-ffmpeg</changelog>
  <changelog author="adam.majer@suse.de" date="1485950400">- use individual libboost-*-devel packages instead of boost-devel</changelog>
  <changelog author="alarrosa@suse.com" date="1500292800">- Update to 1.4.2:
  * Fixed invalid memory access when decoding base64-encoded fingerprints.
  * Removed unnecessary library dependencies libchromaprint to avoid
    circular dependency problems with FFmpeg.
- Rebase chromaprint-ffmpeg-pkgconfig.patch
- Drop chromaprint-ffmpeg-API.patch which isn't needed anymore.
- Update to 1.4.1:
  * Restored the -v/-version parameter for fpcalc that got accidentally
    removed in 1.4.
  * Fixed processing of some short audio files. They were ignored in 1.4.
  * The DURATION field in the default output of fpcalc is now printed as an
    integer again.
  * Added missing version number to libchromaprint.pc.
  * Linux fpcalc builds are now fully static.
- Update to 1.4.0:
  * Fully streaming audio processing without any post-processing step
    for the fingerprint generation.
  * Many performance optimizations. Especially when processing long streams,
    operations should be faster and use less memory.
  * C++11 compiler is now required for building the library.
  * The public C API now uses standard fixed-size int types from stdint.h
    (breaks backwards compatibility).
  * All code written for the library is now distributed under the MIT license.
  * Kiss FFT is now included with the library and automatically used if
    no other FFT library is found.
  * Added support for using the FFTW3F version of FFTW3.
  * Boost is no longer used.
- Update to 1.3.2:
  * Fixed crash on an invalid audio file that FFmpeg could not decode.</changelog>
  <changelog author="jengelh@inai.de" date="1500984000">- Fix RPM groups.</changelog>
  <changelog author="avindra@opensuse.org" date="1516795200">- Update to 1.4.3:
  * Allow one packet to have decoding error
  * Print output even if there is a decoding error, exit with error
    code 3 instead of 2 in such case
  * Add new option -ignore-errors to change the error code 3 to 0
  * Add new option -algorithm NUM
  * Periodically flush output when working on a stream
- drop chromaprint-ffmpeg-pkgconfig.patch
  * fixed upstream
- Switch to https for URL
- Source moved to github
- cleanup with spec-cleaner</changelog>
</package>
<package pkgid="5f4f242f831de1a4a28f418826636e5d1d2522e73d6628ce4afc5b424c043074" name="chrony" arch="aarch64">
  <version epoch="0" ver="4.1" rel="150400.21.5.7"/>
  <changelog author="max@suse.com" date="1591272000">- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.
- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596369600">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="elimat@opensuse.org" date="1599998400">- Update to 3.5.1:
  * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)</changelog>
  <changelog author="max@suse.com" date="1600084800">- Adjust and rename the sysconfig file, so that it matches the
  expectations of chronyd.service (bsc#1173277).</changelog>
  <changelog author="kukuk@suse.com" date="1603886400">- By default we don't write log files but log to journald, so
  only recommend logrotate.</changelog>
  <changelog author="mrueckert@suse.de" date="1604232000">- Update to 4.0
  - Enhancements
  - Add support for Network Time Security (NTS) authentication
  - Add support for AES-CMAC keys (AES128, AES256) with Nettle
  - Add authselectmode directive to control selection of
    unauthenticated sources
  - Add binddevice, bindacqdevice, bindcmddevice directives
  - Add confdir directive to better support fragmented
    configuration
  - Add sourcedir directive and "reload sources" command to
    support dynamic NTP sources specified in files
  - Add clockprecision directive
  - Add dscp directive to set Differentiated Services Code Point
    (DSCP)
  - Add -L option to limit log messages by severity
  - Add -p option to print whole configuration with included
    files
  - Add -U option to allow start under non-root user
  - Allow maxsamples to be set to 1 for faster update with -q/-Q
    option
  - Avoid replacing NTP sources with sources that have
    unreachable address
  - Improve pools to repeat name resolution to get "maxsources"
    sources
  - Improve source selection with trusted sources
  - Improve NTP loop test to prevent synchronisation to itself
  - Repeat iburst when NTP source is switched from offline state
    to online
  - Update clock synchronisation status and leap status more
    frequently
  - Update seccomp filter
  - Add "add pool" command
  - Add "reset sources" command to drop all measurements
  - Add authdata command to print details about NTP
    authentication
  - Add selectdata command to print details about source
    selection
  - Add -N option and sourcename command to print original names
    of sources
  - Add -a option to some commands to print also unresolved
    sources
  - Add -k, -p, -r options to clients command to select, limit,
    reset data
  - Bug fixes
  - Don’t set interface for NTP responses to allow asymmetric
    routing
  - Handle RTCs that don’t support interrupts
  - Respond to command requests with correct address on
    multihomed hosts
  - Removed features
  - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)
  - Drop support for long (non-standard) MACs in NTPv4 packets
    (chrony 2.x clients using non-MD5/SHA1 keys need to use
    option "version 3")
  - Drop support for line editing with GNU Readline
- add BuildRequires for gnutls-devel (which also pulls nettle to
  enable the new features)
- drop patches which are included in the update:
  chrony-test-update-processing-of-packet-log.patch
  chrony-test-fix-util-unit-test-for-NTP-era-split.patch
- refreshed chrony-config.patch
- track series file for easier quilt setup
- added option to turn off testsuite with
  osc build --without=testsuite
  testsuite still runs by default</changelog>
  <changelog author="mrueckert@suse.de" date="1607342400">- drop buildrequires on NSS. We need gnutls for NTS anyway and we
  can do all the other required crypto via nettle+gnutls. no need
  for another crypto library.</changelog>
  <changelog author="max@suse.com" date="1612526400">- Enable syscallfilter unconditionally [boo#1181826].</changelog>
  <changelog author="max@suse.com" date="1622548800">- Update to 4.1
  * Add support for NTS servers specified by IP address (matching
    Subject Alternative Name in server certificate)
  * Add source-specific configuration of trusted certificates
  * Allow multiple files and directories with trusted certificates
  * Allow multiple pairs of server keys and certificates
  * Add copy option to server/pool directive
  * Increase PPS lock limit to 40% of pulse interval
  * Perform source selection immediately after loading dump files
  * Reload dump files for addresses negotiated by NTS-KE server
  * Update seccomp filter and add less restrictive level
  * Restart ongoing name resolution on online command
  * Fix dump files to not include uncorrected offset
  * Fix initstepslew to accept time from own NTP clients
  * Reset NTP address and port when no longer negotiated by NTS-KE
    server
- Update clknetsim to snapshot f89702d.
- Refresh chrony.keyring from
  https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
- Ensure the correct pool packages are installed for openSUSE
  and SLE (bsc#1180689).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers
- Remove otherproviders, not needed anymore</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="max@suse.com" date="1625140800">- boo#1187906: Consolidate all references to the helper script.
- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_chrony-wait.service.patch
  * harden_chronyd.service.patch</changelog>
  <changelog author="max@suse.com" date="1633694400">- boo#1190926: PrivateDevices is too strict, we might need to
  access the rtc and ptp devices.
- Add back support to build chrony on SLE12.
- Drop dependency on asciidoctor. It is only needed for building
  the HTML documentation which we don't package anyway.</changelog>
  <changelog author="max@suse.com" date="1637323200">- SLE bugs that have been fixed in openSUSE up to this point
  without explicit references: bsc#1183783, bsc#1184400,
  bsc#1171806, bsc#1161119, bsc#1159840.
- Obsoleted SLE patches:
  * chrony-fix-open.patch
  * chrony-gettimeofday.patch
  * chrony-ntp-era-split.patch
  * chrony-pidfile.patch
  * chrony-select-timeout.patch
  * chrony-urandom.patch
  * chrony.sysconfig
  * clknetsim-glibc-2.31.patch</changelog>
  <changelog author="max@suse.com" date="1638878400">- Add chrony-htonl.patch to work around undocumented behaviour of
  htonl() in older glibc versions (SLE-12) on 64 bit big endian
  architectures (s390x).</changelog>
  <changelog author="max@suse.com" date="1641816000">- bsc#1194229: Fix pool package dependencies, so that SLE actually
  prefers chrony-pool-suse over chrony-pool-empty.</changelog>
  <changelog author="max@suse.com" date="1648123200">- Fix config file handling in the spec file and remove "ntsdumpdir"
  from default config, because augeas-lenses cannot parse it during
  installation of SLE Micro on SLE-15-SP3 (bsc#1194220).</changelog>
  <changelog author="max@suse.com" date="1710504000">- Use shorter NTS-KE retry interval when network is down
  (bsc#1213551, chrony-burst_total_samples_to_go.patch,
  chrony-retry_interval_ke_start.patch).</changelog>
  <changelog author="max@suse.com" date="1712750400">- Use make quickcheck instead of make check to avoid &gt;1h build
  times and failures due to timeouts. This was the default before
  3.2 but it changed to make tests more reliable. Here a seed is
  already set to get deterministic execution.</changelog>
</package>
<package pkgid="a19cc25ff1fb6bd15e0bfd85904f7c738f99c76df2902b50fea916f02f82b38b" name="chrony" arch="ppc64le">
  <version epoch="0" ver="4.1" rel="150400.21.5.7"/>
  <changelog author="max@suse.com" date="1591272000">- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.
- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596369600">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="elimat@opensuse.org" date="1599998400">- Update to 3.5.1:
  * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)</changelog>
  <changelog author="max@suse.com" date="1600084800">- Adjust and rename the sysconfig file, so that it matches the
  expectations of chronyd.service (bsc#1173277).</changelog>
  <changelog author="kukuk@suse.com" date="1603886400">- By default we don't write log files but log to journald, so
  only recommend logrotate.</changelog>
  <changelog author="mrueckert@suse.de" date="1604232000">- Update to 4.0
  - Enhancements
  - Add support for Network Time Security (NTS) authentication
  - Add support for AES-CMAC keys (AES128, AES256) with Nettle
  - Add authselectmode directive to control selection of
    unauthenticated sources
  - Add binddevice, bindacqdevice, bindcmddevice directives
  - Add confdir directive to better support fragmented
    configuration
  - Add sourcedir directive and "reload sources" command to
    support dynamic NTP sources specified in files
  - Add clockprecision directive
  - Add dscp directive to set Differentiated Services Code Point
    (DSCP)
  - Add -L option to limit log messages by severity
  - Add -p option to print whole configuration with included
    files
  - Add -U option to allow start under non-root user
  - Allow maxsamples to be set to 1 for faster update with -q/-Q
    option
  - Avoid replacing NTP sources with sources that have
    unreachable address
  - Improve pools to repeat name resolution to get "maxsources"
    sources
  - Improve source selection with trusted sources
  - Improve NTP loop test to prevent synchronisation to itself
  - Repeat iburst when NTP source is switched from offline state
    to online
  - Update clock synchronisation status and leap status more
    frequently
  - Update seccomp filter
  - Add "add pool" command
  - Add "reset sources" command to drop all measurements
  - Add authdata command to print details about NTP
    authentication
  - Add selectdata command to print details about source
    selection
  - Add -N option and sourcename command to print original names
    of sources
  - Add -a option to some commands to print also unresolved
    sources
  - Add -k, -p, -r options to clients command to select, limit,
    reset data
  - Bug fixes
  - Don’t set interface for NTP responses to allow asymmetric
    routing
  - Handle RTCs that don’t support interrupts
  - Respond to command requests with correct address on
    multihomed hosts
  - Removed features
  - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)
  - Drop support for long (non-standard) MACs in NTPv4 packets
    (chrony 2.x clients using non-MD5/SHA1 keys need to use
    option "version 3")
  - Drop support for line editing with GNU Readline
- add BuildRequires for gnutls-devel (which also pulls nettle to
  enable the new features)
- drop patches which are included in the update:
  chrony-test-update-processing-of-packet-log.patch
  chrony-test-fix-util-unit-test-for-NTP-era-split.patch
- refreshed chrony-config.patch
- track series file for easier quilt setup
- added option to turn off testsuite with
  osc build --without=testsuite
  testsuite still runs by default</changelog>
  <changelog author="mrueckert@suse.de" date="1607342400">- drop buildrequires on NSS. We need gnutls for NTS anyway and we
  can do all the other required crypto via nettle+gnutls. no need
  for another crypto library.</changelog>
  <changelog author="max@suse.com" date="1612526400">- Enable syscallfilter unconditionally [boo#1181826].</changelog>
  <changelog author="max@suse.com" date="1622548800">- Update to 4.1
  * Add support for NTS servers specified by IP address (matching
    Subject Alternative Name in server certificate)
  * Add source-specific configuration of trusted certificates
  * Allow multiple files and directories with trusted certificates
  * Allow multiple pairs of server keys and certificates
  * Add copy option to server/pool directive
  * Increase PPS lock limit to 40% of pulse interval
  * Perform source selection immediately after loading dump files
  * Reload dump files for addresses negotiated by NTS-KE server
  * Update seccomp filter and add less restrictive level
  * Restart ongoing name resolution on online command
  * Fix dump files to not include uncorrected offset
  * Fix initstepslew to accept time from own NTP clients
  * Reset NTP address and port when no longer negotiated by NTS-KE
    server
- Update clknetsim to snapshot f89702d.
- Refresh chrony.keyring from
  https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
- Ensure the correct pool packages are installed for openSUSE
  and SLE (bsc#1180689).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers
- Remove otherproviders, not needed anymore</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="max@suse.com" date="1625140800">- boo#1187906: Consolidate all references to the helper script.
- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_chrony-wait.service.patch
  * harden_chronyd.service.patch</changelog>
  <changelog author="max@suse.com" date="1633694400">- boo#1190926: PrivateDevices is too strict, we might need to
  access the rtc and ptp devices.
- Add back support to build chrony on SLE12.
- Drop dependency on asciidoctor. It is only needed for building
  the HTML documentation which we don't package anyway.</changelog>
  <changelog author="max@suse.com" date="1637323200">- SLE bugs that have been fixed in openSUSE up to this point
  without explicit references: bsc#1183783, bsc#1184400,
  bsc#1171806, bsc#1161119, bsc#1159840.
- Obsoleted SLE patches:
  * chrony-fix-open.patch
  * chrony-gettimeofday.patch
  * chrony-ntp-era-split.patch
  * chrony-pidfile.patch
  * chrony-select-timeout.patch
  * chrony-urandom.patch
  * chrony.sysconfig
  * clknetsim-glibc-2.31.patch</changelog>
  <changelog author="max@suse.com" date="1638878400">- Add chrony-htonl.patch to work around undocumented behaviour of
  htonl() in older glibc versions (SLE-12) on 64 bit big endian
  architectures (s390x).</changelog>
  <changelog author="max@suse.com" date="1641816000">- bsc#1194229: Fix pool package dependencies, so that SLE actually
  prefers chrony-pool-suse over chrony-pool-empty.</changelog>
  <changelog author="max@suse.com" date="1648123200">- Fix config file handling in the spec file and remove "ntsdumpdir"
  from default config, because augeas-lenses cannot parse it during
  installation of SLE Micro on SLE-15-SP3 (bsc#1194220).</changelog>
  <changelog author="max@suse.com" date="1710504000">- Use shorter NTS-KE retry interval when network is down
  (bsc#1213551, chrony-burst_total_samples_to_go.patch,
  chrony-retry_interval_ke_start.patch).</changelog>
  <changelog author="max@suse.com" date="1712750400">- Use make quickcheck instead of make check to avoid &gt;1h build
  times and failures due to timeouts. This was the default before
  3.2 but it changed to make tests more reliable. Here a seed is
  already set to get deterministic execution.</changelog>
</package>
<package pkgid="e1190640d771df1780ab16895cb25c90e161976f795cf64926c7d8309881e7b9" name="chrony" arch="s390x">
  <version epoch="0" ver="4.1" rel="150400.21.5.7"/>
  <changelog author="max@suse.com" date="1591272000">- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.
- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596369600">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="elimat@opensuse.org" date="1599998400">- Update to 3.5.1:
  * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)</changelog>
  <changelog author="max@suse.com" date="1600084800">- Adjust and rename the sysconfig file, so that it matches the
  expectations of chronyd.service (bsc#1173277).</changelog>
  <changelog author="kukuk@suse.com" date="1603886400">- By default we don't write log files but log to journald, so
  only recommend logrotate.</changelog>
  <changelog author="mrueckert@suse.de" date="1604232000">- Update to 4.0
  - Enhancements
  - Add support for Network Time Security (NTS) authentication
  - Add support for AES-CMAC keys (AES128, AES256) with Nettle
  - Add authselectmode directive to control selection of
    unauthenticated sources
  - Add binddevice, bindacqdevice, bindcmddevice directives
  - Add confdir directive to better support fragmented
    configuration
  - Add sourcedir directive and "reload sources" command to
    support dynamic NTP sources specified in files
  - Add clockprecision directive
  - Add dscp directive to set Differentiated Services Code Point
    (DSCP)
  - Add -L option to limit log messages by severity
  - Add -p option to print whole configuration with included
    files
  - Add -U option to allow start under non-root user
  - Allow maxsamples to be set to 1 for faster update with -q/-Q
    option
  - Avoid replacing NTP sources with sources that have
    unreachable address
  - Improve pools to repeat name resolution to get "maxsources"
    sources
  - Improve source selection with trusted sources
  - Improve NTP loop test to prevent synchronisation to itself
  - Repeat iburst when NTP source is switched from offline state
    to online
  - Update clock synchronisation status and leap status more
    frequently
  - Update seccomp filter
  - Add "add pool" command
  - Add "reset sources" command to drop all measurements
  - Add authdata command to print details about NTP
    authentication
  - Add selectdata command to print details about source
    selection
  - Add -N option and sourcename command to print original names
    of sources
  - Add -a option to some commands to print also unresolved
    sources
  - Add -k, -p, -r options to clients command to select, limit,
    reset data
  - Bug fixes
  - Don’t set interface for NTP responses to allow asymmetric
    routing
  - Handle RTCs that don’t support interrupts
  - Respond to command requests with correct address on
    multihomed hosts
  - Removed features
  - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)
  - Drop support for long (non-standard) MACs in NTPv4 packets
    (chrony 2.x clients using non-MD5/SHA1 keys need to use
    option "version 3")
  - Drop support for line editing with GNU Readline
- add BuildRequires for gnutls-devel (which also pulls nettle to
  enable the new features)
- drop patches which are included in the update:
  chrony-test-update-processing-of-packet-log.patch
  chrony-test-fix-util-unit-test-for-NTP-era-split.patch
- refreshed chrony-config.patch
- track series file for easier quilt setup
- added option to turn off testsuite with
  osc build --without=testsuite
  testsuite still runs by default</changelog>
  <changelog author="mrueckert@suse.de" date="1607342400">- drop buildrequires on NSS. We need gnutls for NTS anyway and we
  can do all the other required crypto via nettle+gnutls. no need
  for another crypto library.</changelog>
  <changelog author="max@suse.com" date="1612526400">- Enable syscallfilter unconditionally [boo#1181826].</changelog>
  <changelog author="max@suse.com" date="1622548800">- Update to 4.1
  * Add support for NTS servers specified by IP address (matching
    Subject Alternative Name in server certificate)
  * Add source-specific configuration of trusted certificates
  * Allow multiple files and directories with trusted certificates
  * Allow multiple pairs of server keys and certificates
  * Add copy option to server/pool directive
  * Increase PPS lock limit to 40% of pulse interval
  * Perform source selection immediately after loading dump files
  * Reload dump files for addresses negotiated by NTS-KE server
  * Update seccomp filter and add less restrictive level
  * Restart ongoing name resolution on online command
  * Fix dump files to not include uncorrected offset
  * Fix initstepslew to accept time from own NTP clients
  * Reset NTP address and port when no longer negotiated by NTS-KE
    server
- Update clknetsim to snapshot f89702d.
- Refresh chrony.keyring from
  https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
- Ensure the correct pool packages are installed for openSUSE
  and SLE (bsc#1180689).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers
- Remove otherproviders, not needed anymore</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="max@suse.com" date="1625140800">- boo#1187906: Consolidate all references to the helper script.
- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_chrony-wait.service.patch
  * harden_chronyd.service.patch</changelog>
  <changelog author="max@suse.com" date="1633694400">- boo#1190926: PrivateDevices is too strict, we might need to
  access the rtc and ptp devices.
- Add back support to build chrony on SLE12.
- Drop dependency on asciidoctor. It is only needed for building
  the HTML documentation which we don't package anyway.</changelog>
  <changelog author="max@suse.com" date="1637323200">- SLE bugs that have been fixed in openSUSE up to this point
  without explicit references: bsc#1183783, bsc#1184400,
  bsc#1171806, bsc#1161119, bsc#1159840.
- Obsoleted SLE patches:
  * chrony-fix-open.patch
  * chrony-gettimeofday.patch
  * chrony-ntp-era-split.patch
  * chrony-pidfile.patch
  * chrony-select-timeout.patch
  * chrony-urandom.patch
  * chrony.sysconfig
  * clknetsim-glibc-2.31.patch</changelog>
  <changelog author="max@suse.com" date="1638878400">- Add chrony-htonl.patch to work around undocumented behaviour of
  htonl() in older glibc versions (SLE-12) on 64 bit big endian
  architectures (s390x).</changelog>
  <changelog author="max@suse.com" date="1641816000">- bsc#1194229: Fix pool package dependencies, so that SLE actually
  prefers chrony-pool-suse over chrony-pool-empty.</changelog>
  <changelog author="max@suse.com" date="1648123200">- Fix config file handling in the spec file and remove "ntsdumpdir"
  from default config, because augeas-lenses cannot parse it during
  installation of SLE Micro on SLE-15-SP3 (bsc#1194220).</changelog>
  <changelog author="max@suse.com" date="1710504000">- Use shorter NTS-KE retry interval when network is down
  (bsc#1213551, chrony-burst_total_samples_to_go.patch,
  chrony-retry_interval_ke_start.patch).</changelog>
  <changelog author="max@suse.com" date="1712750400">- Use make quickcheck instead of make check to avoid &gt;1h build
  times and failures due to timeouts. This was the default before
  3.2 but it changed to make tests more reliable. Here a seed is
  already set to get deterministic execution.</changelog>
</package>
<package pkgid="f7238acd01282105926a1157baa94bcd5bd58f29e0b554dbaa21a26e0817b92f" name="chrony" arch="src">
  <version epoch="0" ver="4.1" rel="150400.21.5.7"/>
  <changelog author="max@suse.com" date="1591272000">- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.
- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596369600">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="elimat@opensuse.org" date="1599998400">- Update to 3.5.1:
  * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)</changelog>
  <changelog author="max@suse.com" date="1600084800">- Adjust and rename the sysconfig file, so that it matches the
  expectations of chronyd.service (bsc#1173277).</changelog>
  <changelog author="kukuk@suse.com" date="1603886400">- By default we don't write log files but log to journald, so
  only recommend logrotate.</changelog>
  <changelog author="mrueckert@suse.de" date="1604232000">- Update to 4.0
  - Enhancements
  - Add support for Network Time Security (NTS) authentication
  - Add support for AES-CMAC keys (AES128, AES256) with Nettle
  - Add authselectmode directive to control selection of
    unauthenticated sources
  - Add binddevice, bindacqdevice, bindcmddevice directives
  - Add confdir directive to better support fragmented
    configuration
  - Add sourcedir directive and "reload sources" command to
    support dynamic NTP sources specified in files
  - Add clockprecision directive
  - Add dscp directive to set Differentiated Services Code Point
    (DSCP)
  - Add -L option to limit log messages by severity
  - Add -p option to print whole configuration with included
    files
  - Add -U option to allow start under non-root user
  - Allow maxsamples to be set to 1 for faster update with -q/-Q
    option
  - Avoid replacing NTP sources with sources that have
    unreachable address
  - Improve pools to repeat name resolution to get "maxsources"
    sources
  - Improve source selection with trusted sources
  - Improve NTP loop test to prevent synchronisation to itself
  - Repeat iburst when NTP source is switched from offline state
    to online
  - Update clock synchronisation status and leap status more
    frequently
  - Update seccomp filter
  - Add "add pool" command
  - Add "reset sources" command to drop all measurements
  - Add authdata command to print details about NTP
    authentication
  - Add selectdata command to print details about source
    selection
  - Add -N option and sourcename command to print original names
    of sources
  - Add -a option to some commands to print also unresolved
    sources
  - Add -k, -p, -r options to clients command to select, limit,
    reset data
  - Bug fixes
  - Don’t set interface for NTP responses to allow asymmetric
    routing
  - Handle RTCs that don’t support interrupts
  - Respond to command requests with correct address on
    multihomed hosts
  - Removed features
  - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)
  - Drop support for long (non-standard) MACs in NTPv4 packets
    (chrony 2.x clients using non-MD5/SHA1 keys need to use
    option "version 3")
  - Drop support for line editing with GNU Readline
- add BuildRequires for gnutls-devel (which also pulls nettle to
  enable the new features)
- drop patches which are included in the update:
  chrony-test-update-processing-of-packet-log.patch
  chrony-test-fix-util-unit-test-for-NTP-era-split.patch
- refreshed chrony-config.patch
- track series file for easier quilt setup
- added option to turn off testsuite with
  osc build --without=testsuite
  testsuite still runs by default</changelog>
  <changelog author="mrueckert@suse.de" date="1607342400">- drop buildrequires on NSS. We need gnutls for NTS anyway and we
  can do all the other required crypto via nettle+gnutls. no need
  for another crypto library.</changelog>
  <changelog author="max@suse.com" date="1612526400">- Enable syscallfilter unconditionally [boo#1181826].</changelog>
  <changelog author="max@suse.com" date="1622548800">- Update to 4.1
  * Add support for NTS servers specified by IP address (matching
    Subject Alternative Name in server certificate)
  * Add source-specific configuration of trusted certificates
  * Allow multiple files and directories with trusted certificates
  * Allow multiple pairs of server keys and certificates
  * Add copy option to server/pool directive
  * Increase PPS lock limit to 40% of pulse interval
  * Perform source selection immediately after loading dump files
  * Reload dump files for addresses negotiated by NTS-KE server
  * Update seccomp filter and add less restrictive level
  * Restart ongoing name resolution on online command
  * Fix dump files to not include uncorrected offset
  * Fix initstepslew to accept time from own NTP clients
  * Reset NTP address and port when no longer negotiated by NTS-KE
    server
- Update clknetsim to snapshot f89702d.
- Refresh chrony.keyring from
  https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
- Ensure the correct pool packages are installed for openSUSE
  and SLE (bsc#1180689).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers
- Remove otherproviders, not needed anymore</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="max@suse.com" date="1625140800">- boo#1187906: Consolidate all references to the helper script.
- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_chrony-wait.service.patch
  * harden_chronyd.service.patch</changelog>
  <changelog author="max@suse.com" date="1633694400">- boo#1190926: PrivateDevices is too strict, we might need to
  access the rtc and ptp devices.
- Add back support to build chrony on SLE12.
- Drop dependency on asciidoctor. It is only needed for building
  the HTML documentation which we don't package anyway.</changelog>
  <changelog author="max@suse.com" date="1637323200">- SLE bugs that have been fixed in openSUSE up to this point
  without explicit references: bsc#1183783, bsc#1184400,
  bsc#1171806, bsc#1161119, bsc#1159840.
- Obsoleted SLE patches:
  * chrony-fix-open.patch
  * chrony-gettimeofday.patch
  * chrony-ntp-era-split.patch
  * chrony-pidfile.patch
  * chrony-select-timeout.patch
  * chrony-urandom.patch
  * chrony.sysconfig
  * clknetsim-glibc-2.31.patch</changelog>
  <changelog author="max@suse.com" date="1638878400">- Add chrony-htonl.patch to work around undocumented behaviour of
  htonl() in older glibc versions (SLE-12) on 64 bit big endian
  architectures (s390x).</changelog>
  <changelog author="max@suse.com" date="1641816000">- bsc#1194229: Fix pool package dependencies, so that SLE actually
  prefers chrony-pool-suse over chrony-pool-empty.</changelog>
  <changelog author="max@suse.com" date="1648123200">- Fix config file handling in the spec file and remove "ntsdumpdir"
  from default config, because augeas-lenses cannot parse it during
  installation of SLE Micro on SLE-15-SP3 (bsc#1194220).</changelog>
  <changelog author="max@suse.com" date="1710504000">- Use shorter NTS-KE retry interval when network is down
  (bsc#1213551, chrony-burst_total_samples_to_go.patch,
  chrony-retry_interval_ke_start.patch).</changelog>
  <changelog author="max@suse.com" date="1712750400">- Use make quickcheck instead of make check to avoid &gt;1h build
  times and failures due to timeouts. This was the default before
  3.2 but it changed to make tests more reliable. Here a seed is
  already set to get deterministic execution.</changelog>
</package>
<package pkgid="dfc68e6d7c7310636b10ca2d9265c499b9615e7825a76093df2f387af4816e78" name="chrony" arch="x86_64">
  <version epoch="0" ver="4.1" rel="150400.21.5.7"/>
  <changelog author="max@suse.com" date="1591272000">- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.
- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596369600">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="elimat@opensuse.org" date="1599998400">- Update to 3.5.1:
  * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)</changelog>
  <changelog author="max@suse.com" date="1600084800">- Adjust and rename the sysconfig file, so that it matches the
  expectations of chronyd.service (bsc#1173277).</changelog>
  <changelog author="kukuk@suse.com" date="1603886400">- By default we don't write log files but log to journald, so
  only recommend logrotate.</changelog>
  <changelog author="mrueckert@suse.de" date="1604232000">- Update to 4.0
  - Enhancements
  - Add support for Network Time Security (NTS) authentication
  - Add support for AES-CMAC keys (AES128, AES256) with Nettle
  - Add authselectmode directive to control selection of
    unauthenticated sources
  - Add binddevice, bindacqdevice, bindcmddevice directives
  - Add confdir directive to better support fragmented
    configuration
  - Add sourcedir directive and "reload sources" command to
    support dynamic NTP sources specified in files
  - Add clockprecision directive
  - Add dscp directive to set Differentiated Services Code Point
    (DSCP)
  - Add -L option to limit log messages by severity
  - Add -p option to print whole configuration with included
    files
  - Add -U option to allow start under non-root user
  - Allow maxsamples to be set to 1 for faster update with -q/-Q
    option
  - Avoid replacing NTP sources with sources that have
    unreachable address
  - Improve pools to repeat name resolution to get "maxsources"
    sources
  - Improve source selection with trusted sources
  - Improve NTP loop test to prevent synchronisation to itself
  - Repeat iburst when NTP source is switched from offline state
    to online
  - Update clock synchronisation status and leap status more
    frequently
  - Update seccomp filter
  - Add "add pool" command
  - Add "reset sources" command to drop all measurements
  - Add authdata command to print details about NTP
    authentication
  - Add selectdata command to print details about source
    selection
  - Add -N option and sourcename command to print original names
    of sources
  - Add -a option to some commands to print also unresolved
    sources
  - Add -k, -p, -r options to clients command to select, limit,
    reset data
  - Bug fixes
  - Don’t set interface for NTP responses to allow asymmetric
    routing
  - Handle RTCs that don’t support interrupts
  - Respond to command requests with correct address on
    multihomed hosts
  - Removed features
  - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)
  - Drop support for long (non-standard) MACs in NTPv4 packets
    (chrony 2.x clients using non-MD5/SHA1 keys need to use
    option "version 3")
  - Drop support for line editing with GNU Readline
- add BuildRequires for gnutls-devel (which also pulls nettle to
  enable the new features)
- drop patches which are included in the update:
  chrony-test-update-processing-of-packet-log.patch
  chrony-test-fix-util-unit-test-for-NTP-era-split.patch
- refreshed chrony-config.patch
- track series file for easier quilt setup
- added option to turn off testsuite with
  osc build --without=testsuite
  testsuite still runs by default</changelog>
  <changelog author="mrueckert@suse.de" date="1607342400">- drop buildrequires on NSS. We need gnutls for NTS anyway and we
  can do all the other required crypto via nettle+gnutls. no need
  for another crypto library.</changelog>
  <changelog author="max@suse.com" date="1612526400">- Enable syscallfilter unconditionally [boo#1181826].</changelog>
  <changelog author="max@suse.com" date="1622548800">- Update to 4.1
  * Add support for NTS servers specified by IP address (matching
    Subject Alternative Name in server certificate)
  * Add source-specific configuration of trusted certificates
  * Allow multiple files and directories with trusted certificates
  * Allow multiple pairs of server keys and certificates
  * Add copy option to server/pool directive
  * Increase PPS lock limit to 40% of pulse interval
  * Perform source selection immediately after loading dump files
  * Reload dump files for addresses negotiated by NTS-KE server
  * Update seccomp filter and add less restrictive level
  * Restart ongoing name resolution on online command
  * Fix dump files to not include uncorrected offset
  * Fix initstepslew to accept time from own NTP clients
  * Reset NTP address and port when no longer negotiated by NTS-KE
    server
- Update clknetsim to snapshot f89702d.
- Refresh chrony.keyring from
  https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
- Ensure the correct pool packages are installed for openSUSE
  and SLE (bsc#1180689).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers
- Remove otherproviders, not needed anymore</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="max@suse.com" date="1625140800">- boo#1187906: Consolidate all references to the helper script.
- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_chrony-wait.service.patch
  * harden_chronyd.service.patch</changelog>
  <changelog author="max@suse.com" date="1633694400">- boo#1190926: PrivateDevices is too strict, we might need to
  access the rtc and ptp devices.
- Add back support to build chrony on SLE12.
- Drop dependency on asciidoctor. It is only needed for building
  the HTML documentation which we don't package anyway.</changelog>
  <changelog author="max@suse.com" date="1637323200">- SLE bugs that have been fixed in openSUSE up to this point
  without explicit references: bsc#1183783, bsc#1184400,
  bsc#1171806, bsc#1161119, bsc#1159840.
- Obsoleted SLE patches:
  * chrony-fix-open.patch
  * chrony-gettimeofday.patch
  * chrony-ntp-era-split.patch
  * chrony-pidfile.patch
  * chrony-select-timeout.patch
  * chrony-urandom.patch
  * chrony.sysconfig
  * clknetsim-glibc-2.31.patch</changelog>
  <changelog author="max@suse.com" date="1638878400">- Add chrony-htonl.patch to work around undocumented behaviour of
  htonl() in older glibc versions (SLE-12) on 64 bit big endian
  architectures (s390x).</changelog>
  <changelog author="max@suse.com" date="1641816000">- bsc#1194229: Fix pool package dependencies, so that SLE actually
  prefers chrony-pool-suse over chrony-pool-empty.</changelog>
  <changelog author="max@suse.com" date="1648123200">- Fix config file handling in the spec file and remove "ntsdumpdir"
  from default config, because augeas-lenses cannot parse it during
  installation of SLE Micro on SLE-15-SP3 (bsc#1194220).</changelog>
  <changelog author="max@suse.com" date="1710504000">- Use shorter NTS-KE retry interval when network is down
  (bsc#1213551, chrony-burst_total_samples_to_go.patch,
  chrony-retry_interval_ke_start.patch).</changelog>
  <changelog author="max@suse.com" date="1712750400">- Use make quickcheck instead of make check to avoid &gt;1h build
  times and failures due to timeouts. This was the default before
  3.2 but it changed to make tests more reliable. Here a seed is
  already set to get deterministic execution.</changelog>
</package>
<package pkgid="ab728c0c71a7bf427d1778d83792fb31601f3dae0374cc705be770030157e41e" name="chrony-pool-empty" arch="noarch">
  <version epoch="0" ver="4.1" rel="150400.21.5.7"/>
  <changelog author="max@suse.com" date="1591272000">- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.
- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596369600">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="elimat@opensuse.org" date="1599998400">- Update to 3.5.1:
  * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)</changelog>
  <changelog author="max@suse.com" date="1600084800">- Adjust and rename the sysconfig file, so that it matches the
  expectations of chronyd.service (bsc#1173277).</changelog>
  <changelog author="kukuk@suse.com" date="1603886400">- By default we don't write log files but log to journald, so
  only recommend logrotate.</changelog>
  <changelog author="mrueckert@suse.de" date="1604232000">- Update to 4.0
  - Enhancements
  - Add support for Network Time Security (NTS) authentication
  - Add support for AES-CMAC keys (AES128, AES256) with Nettle
  - Add authselectmode directive to control selection of
    unauthenticated sources
  - Add binddevice, bindacqdevice, bindcmddevice directives
  - Add confdir directive to better support fragmented
    configuration
  - Add sourcedir directive and "reload sources" command to
    support dynamic NTP sources specified in files
  - Add clockprecision directive
  - Add dscp directive to set Differentiated Services Code Point
    (DSCP)
  - Add -L option to limit log messages by severity
  - Add -p option to print whole configuration with included
    files
  - Add -U option to allow start under non-root user
  - Allow maxsamples to be set to 1 for faster update with -q/-Q
    option
  - Avoid replacing NTP sources with sources that have
    unreachable address
  - Improve pools to repeat name resolution to get "maxsources"
    sources
  - Improve source selection with trusted sources
  - Improve NTP loop test to prevent synchronisation to itself
  - Repeat iburst when NTP source is switched from offline state
    to online
  - Update clock synchronisation status and leap status more
    frequently
  - Update seccomp filter
  - Add "add pool" command
  - Add "reset sources" command to drop all measurements
  - Add authdata command to print details about NTP
    authentication
  - Add selectdata command to print details about source
    selection
  - Add -N option and sourcename command to print original names
    of sources
  - Add -a option to some commands to print also unresolved
    sources
  - Add -k, -p, -r options to clients command to select, limit,
    reset data
  - Bug fixes
  - Don’t set interface for NTP responses to allow asymmetric
    routing
  - Handle RTCs that don’t support interrupts
  - Respond to command requests with correct address on
    multihomed hosts
  - Removed features
  - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)
  - Drop support for long (non-standard) MACs in NTPv4 packets
    (chrony 2.x clients using non-MD5/SHA1 keys need to use
    option "version 3")
  - Drop support for line editing with GNU Readline
- add BuildRequires for gnutls-devel (which also pulls nettle to
  enable the new features)
- drop patches which are included in the update:
  chrony-test-update-processing-of-packet-log.patch
  chrony-test-fix-util-unit-test-for-NTP-era-split.patch
- refreshed chrony-config.patch
- track series file for easier quilt setup
- added option to turn off testsuite with
  osc build --without=testsuite
  testsuite still runs by default</changelog>
  <changelog author="mrueckert@suse.de" date="1607342400">- drop buildrequires on NSS. We need gnutls for NTS anyway and we
  can do all the other required crypto via nettle+gnutls. no need
  for another crypto library.</changelog>
  <changelog author="max@suse.com" date="1612526400">- Enable syscallfilter unconditionally [boo#1181826].</changelog>
  <changelog author="max@suse.com" date="1622548800">- Update to 4.1
  * Add support for NTS servers specified by IP address (matching
    Subject Alternative Name in server certificate)
  * Add source-specific configuration of trusted certificates
  * Allow multiple files and directories with trusted certificates
  * Allow multiple pairs of server keys and certificates
  * Add copy option to server/pool directive
  * Increase PPS lock limit to 40% of pulse interval
  * Perform source selection immediately after loading dump files
  * Reload dump files for addresses negotiated by NTS-KE server
  * Update seccomp filter and add less restrictive level
  * Restart ongoing name resolution on online command
  * Fix dump files to not include uncorrected offset
  * Fix initstepslew to accept time from own NTP clients
  * Reset NTP address and port when no longer negotiated by NTS-KE
    server
- Update clknetsim to snapshot f89702d.
- Refresh chrony.keyring from
  https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
- Ensure the correct pool packages are installed for openSUSE
  and SLE (bsc#1180689).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers
- Remove otherproviders, not needed anymore</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="max@suse.com" date="1625140800">- boo#1187906: Consolidate all references to the helper script.
- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_chrony-wait.service.patch
  * harden_chronyd.service.patch</changelog>
  <changelog author="max@suse.com" date="1633694400">- boo#1190926: PrivateDevices is too strict, we might need to
  access the rtc and ptp devices.
- Add back support to build chrony on SLE12.
- Drop dependency on asciidoctor. It is only needed for building
  the HTML documentation which we don't package anyway.</changelog>
  <changelog author="max@suse.com" date="1637323200">- SLE bugs that have been fixed in openSUSE up to this point
  without explicit references: bsc#1183783, bsc#1184400,
  bsc#1171806, bsc#1161119, bsc#1159840.
- Obsoleted SLE patches:
  * chrony-fix-open.patch
  * chrony-gettimeofday.patch
  * chrony-ntp-era-split.patch
  * chrony-pidfile.patch
  * chrony-select-timeout.patch
  * chrony-urandom.patch
  * chrony.sysconfig
  * clknetsim-glibc-2.31.patch</changelog>
  <changelog author="max@suse.com" date="1638878400">- Add chrony-htonl.patch to work around undocumented behaviour of
  htonl() in older glibc versions (SLE-12) on 64 bit big endian
  architectures (s390x).</changelog>
  <changelog author="max@suse.com" date="1641816000">- bsc#1194229: Fix pool package dependencies, so that SLE actually
  prefers chrony-pool-suse over chrony-pool-empty.</changelog>
  <changelog author="max@suse.com" date="1648123200">- Fix config file handling in the spec file and remove "ntsdumpdir"
  from default config, because augeas-lenses cannot parse it during
  installation of SLE Micro on SLE-15-SP3 (bsc#1194220).</changelog>
  <changelog author="max@suse.com" date="1710504000">- Use shorter NTS-KE retry interval when network is down
  (bsc#1213551, chrony-burst_total_samples_to_go.patch,
  chrony-retry_interval_ke_start.patch).</changelog>
  <changelog author="max@suse.com" date="1712750400">- Use make quickcheck instead of make check to avoid &gt;1h build
  times and failures due to timeouts. This was the default before
  3.2 but it changed to make tests more reliable. Here a seed is
  already set to get deterministic execution.</changelog>
</package>
<package pkgid="adb59fb891cb117c115b21872ba34a0f939183802c71b019c6da7f3551d351a5" name="chrony-pool-openSUSE" arch="noarch">
  <version epoch="0" ver="4.1" rel="150400.21.5.7"/>
  <changelog author="max@suse.com" date="1591272000">- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.
- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596369600">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="elimat@opensuse.org" date="1599998400">- Update to 3.5.1:
  * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)</changelog>
  <changelog author="max@suse.com" date="1600084800">- Adjust and rename the sysconfig file, so that it matches the
  expectations of chronyd.service (bsc#1173277).</changelog>
  <changelog author="kukuk@suse.com" date="1603886400">- By default we don't write log files but log to journald, so
  only recommend logrotate.</changelog>
  <changelog author="mrueckert@suse.de" date="1604232000">- Update to 4.0
  - Enhancements
  - Add support for Network Time Security (NTS) authentication
  - Add support for AES-CMAC keys (AES128, AES256) with Nettle
  - Add authselectmode directive to control selection of
    unauthenticated sources
  - Add binddevice, bindacqdevice, bindcmddevice directives
  - Add confdir directive to better support fragmented
    configuration
  - Add sourcedir directive and "reload sources" command to
    support dynamic NTP sources specified in files
  - Add clockprecision directive
  - Add dscp directive to set Differentiated Services Code Point
    (DSCP)
  - Add -L option to limit log messages by severity
  - Add -p option to print whole configuration with included
    files
  - Add -U option to allow start under non-root user
  - Allow maxsamples to be set to 1 for faster update with -q/-Q
    option
  - Avoid replacing NTP sources with sources that have
    unreachable address
  - Improve pools to repeat name resolution to get "maxsources"
    sources
  - Improve source selection with trusted sources
  - Improve NTP loop test to prevent synchronisation to itself
  - Repeat iburst when NTP source is switched from offline state
    to online
  - Update clock synchronisation status and leap status more
    frequently
  - Update seccomp filter
  - Add "add pool" command
  - Add "reset sources" command to drop all measurements
  - Add authdata command to print details about NTP
    authentication
  - Add selectdata command to print details about source
    selection
  - Add -N option and sourcename command to print original names
    of sources
  - Add -a option to some commands to print also unresolved
    sources
  - Add -k, -p, -r options to clients command to select, limit,
    reset data
  - Bug fixes
  - Don’t set interface for NTP responses to allow asymmetric
    routing
  - Handle RTCs that don’t support interrupts
  - Respond to command requests with correct address on
    multihomed hosts
  - Removed features
  - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)
  - Drop support for long (non-standard) MACs in NTPv4 packets
    (chrony 2.x clients using non-MD5/SHA1 keys need to use
    option "version 3")
  - Drop support for line editing with GNU Readline
- add BuildRequires for gnutls-devel (which also pulls nettle to
  enable the new features)
- drop patches which are included in the update:
  chrony-test-update-processing-of-packet-log.patch
  chrony-test-fix-util-unit-test-for-NTP-era-split.patch
- refreshed chrony-config.patch
- track series file for easier quilt setup
- added option to turn off testsuite with
  osc build --without=testsuite
  testsuite still runs by default</changelog>
  <changelog author="mrueckert@suse.de" date="1607342400">- drop buildrequires on NSS. We need gnutls for NTS anyway and we
  can do all the other required crypto via nettle+gnutls. no need
  for another crypto library.</changelog>
  <changelog author="max@suse.com" date="1612526400">- Enable syscallfilter unconditionally [boo#1181826].</changelog>
  <changelog author="max@suse.com" date="1622548800">- Update to 4.1
  * Add support for NTS servers specified by IP address (matching
    Subject Alternative Name in server certificate)
  * Add source-specific configuration of trusted certificates
  * Allow multiple files and directories with trusted certificates
  * Allow multiple pairs of server keys and certificates
  * Add copy option to server/pool directive
  * Increase PPS lock limit to 40% of pulse interval
  * Perform source selection immediately after loading dump files
  * Reload dump files for addresses negotiated by NTS-KE server
  * Update seccomp filter and add less restrictive level
  * Restart ongoing name resolution on online command
  * Fix dump files to not include uncorrected offset
  * Fix initstepslew to accept time from own NTP clients
  * Reset NTP address and port when no longer negotiated by NTS-KE
    server
- Update clknetsim to snapshot f89702d.
- Refresh chrony.keyring from
  https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
- Ensure the correct pool packages are installed for openSUSE
  and SLE (bsc#1180689).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers
- Remove otherproviders, not needed anymore</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="max@suse.com" date="1625140800">- boo#1187906: Consolidate all references to the helper script.
- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_chrony-wait.service.patch
  * harden_chronyd.service.patch</changelog>
  <changelog author="max@suse.com" date="1633694400">- boo#1190926: PrivateDevices is too strict, we might need to
  access the rtc and ptp devices.
- Add back support to build chrony on SLE12.
- Drop dependency on asciidoctor. It is only needed for building
  the HTML documentation which we don't package anyway.</changelog>
  <changelog author="max@suse.com" date="1637323200">- SLE bugs that have been fixed in openSUSE up to this point
  without explicit references: bsc#1183783, bsc#1184400,
  bsc#1171806, bsc#1161119, bsc#1159840.
- Obsoleted SLE patches:
  * chrony-fix-open.patch
  * chrony-gettimeofday.patch
  * chrony-ntp-era-split.patch
  * chrony-pidfile.patch
  * chrony-select-timeout.patch
  * chrony-urandom.patch
  * chrony.sysconfig
  * clknetsim-glibc-2.31.patch</changelog>
  <changelog author="max@suse.com" date="1638878400">- Add chrony-htonl.patch to work around undocumented behaviour of
  htonl() in older glibc versions (SLE-12) on 64 bit big endian
  architectures (s390x).</changelog>
  <changelog author="max@suse.com" date="1641816000">- bsc#1194229: Fix pool package dependencies, so that SLE actually
  prefers chrony-pool-suse over chrony-pool-empty.</changelog>
  <changelog author="max@suse.com" date="1648123200">- Fix config file handling in the spec file and remove "ntsdumpdir"
  from default config, because augeas-lenses cannot parse it during
  installation of SLE Micro on SLE-15-SP3 (bsc#1194220).</changelog>
  <changelog author="max@suse.com" date="1710504000">- Use shorter NTS-KE retry interval when network is down
  (bsc#1213551, chrony-burst_total_samples_to_go.patch,
  chrony-retry_interval_ke_start.patch).</changelog>
  <changelog author="max@suse.com" date="1712750400">- Use make quickcheck instead of make check to avoid &gt;1h build
  times and failures due to timeouts. This was the default before
  3.2 but it changed to make tests more reliable. Here a seed is
  already set to get deterministic execution.</changelog>
</package>
<package pkgid="9a9a0cfdf95dc3158e57d034caf6edf746afb91816f3582795a13718e66e62f0" name="chrony-pool-suse" arch="noarch">
  <version epoch="0" ver="4.1" rel="150400.21.5.7"/>
  <changelog author="max@suse.com" date="1591272000">- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.
- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596369600">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="elimat@opensuse.org" date="1599998400">- Update to 3.5.1:
  * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)</changelog>
  <changelog author="max@suse.com" date="1600084800">- Adjust and rename the sysconfig file, so that it matches the
  expectations of chronyd.service (bsc#1173277).</changelog>
  <changelog author="kukuk@suse.com" date="1603886400">- By default we don't write log files but log to journald, so
  only recommend logrotate.</changelog>
  <changelog author="mrueckert@suse.de" date="1604232000">- Update to 4.0
  - Enhancements
  - Add support for Network Time Security (NTS) authentication
  - Add support for AES-CMAC keys (AES128, AES256) with Nettle
  - Add authselectmode directive to control selection of
    unauthenticated sources
  - Add binddevice, bindacqdevice, bindcmddevice directives
  - Add confdir directive to better support fragmented
    configuration
  - Add sourcedir directive and "reload sources" command to
    support dynamic NTP sources specified in files
  - Add clockprecision directive
  - Add dscp directive to set Differentiated Services Code Point
    (DSCP)
  - Add -L option to limit log messages by severity
  - Add -p option to print whole configuration with included
    files
  - Add -U option to allow start under non-root user
  - Allow maxsamples to be set to 1 for faster update with -q/-Q
    option
  - Avoid replacing NTP sources with sources that have
    unreachable address
  - Improve pools to repeat name resolution to get "maxsources"
    sources
  - Improve source selection with trusted sources
  - Improve NTP loop test to prevent synchronisation to itself
  - Repeat iburst when NTP source is switched from offline state
    to online
  - Update clock synchronisation status and leap status more
    frequently
  - Update seccomp filter
  - Add "add pool" command
  - Add "reset sources" command to drop all measurements
  - Add authdata command to print details about NTP
    authentication
  - Add selectdata command to print details about source
    selection
  - Add -N option and sourcename command to print original names
    of sources
  - Add -a option to some commands to print also unresolved
    sources
  - Add -k, -p, -r options to clients command to select, limit,
    reset data
  - Bug fixes
  - Don’t set interface for NTP responses to allow asymmetric
    routing
  - Handle RTCs that don’t support interrupts
  - Respond to command requests with correct address on
    multihomed hosts
  - Removed features
  - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)
  - Drop support for long (non-standard) MACs in NTPv4 packets
    (chrony 2.x clients using non-MD5/SHA1 keys need to use
    option "version 3")
  - Drop support for line editing with GNU Readline
- add BuildRequires for gnutls-devel (which also pulls nettle to
  enable the new features)
- drop patches which are included in the update:
  chrony-test-update-processing-of-packet-log.patch
  chrony-test-fix-util-unit-test-for-NTP-era-split.patch
- refreshed chrony-config.patch
- track series file for easier quilt setup
- added option to turn off testsuite with
  osc build --without=testsuite
  testsuite still runs by default</changelog>
  <changelog author="mrueckert@suse.de" date="1607342400">- drop buildrequires on NSS. We need gnutls for NTS anyway and we
  can do all the other required crypto via nettle+gnutls. no need
  for another crypto library.</changelog>
  <changelog author="max@suse.com" date="1612526400">- Enable syscallfilter unconditionally [boo#1181826].</changelog>
  <changelog author="max@suse.com" date="1622548800">- Update to 4.1
  * Add support for NTS servers specified by IP address (matching
    Subject Alternative Name in server certificate)
  * Add source-specific configuration of trusted certificates
  * Allow multiple files and directories with trusted certificates
  * Allow multiple pairs of server keys and certificates
  * Add copy option to server/pool directive
  * Increase PPS lock limit to 40% of pulse interval
  * Perform source selection immediately after loading dump files
  * Reload dump files for addresses negotiated by NTS-KE server
  * Update seccomp filter and add less restrictive level
  * Restart ongoing name resolution on online command
  * Fix dump files to not include uncorrected offset
  * Fix initstepslew to accept time from own NTP clients
  * Reset NTP address and port when no longer negotiated by NTS-KE
    server
- Update clknetsim to snapshot f89702d.
- Refresh chrony.keyring from
  https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
- Ensure the correct pool packages are installed for openSUSE
  and SLE (bsc#1180689).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers
- Remove otherproviders, not needed anymore</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="max@suse.com" date="1625140800">- boo#1187906: Consolidate all references to the helper script.
- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_chrony-wait.service.patch
  * harden_chronyd.service.patch</changelog>
  <changelog author="max@suse.com" date="1633694400">- boo#1190926: PrivateDevices is too strict, we might need to
  access the rtc and ptp devices.
- Add back support to build chrony on SLE12.
- Drop dependency on asciidoctor. It is only needed for building
  the HTML documentation which we don't package anyway.</changelog>
  <changelog author="max@suse.com" date="1637323200">- SLE bugs that have been fixed in openSUSE up to this point
  without explicit references: bsc#1183783, bsc#1184400,
  bsc#1171806, bsc#1161119, bsc#1159840.
- Obsoleted SLE patches:
  * chrony-fix-open.patch
  * chrony-gettimeofday.patch
  * chrony-ntp-era-split.patch
  * chrony-pidfile.patch
  * chrony-select-timeout.patch
  * chrony-urandom.patch
  * chrony.sysconfig
  * clknetsim-glibc-2.31.patch</changelog>
  <changelog author="max@suse.com" date="1638878400">- Add chrony-htonl.patch to work around undocumented behaviour of
  htonl() in older glibc versions (SLE-12) on 64 bit big endian
  architectures (s390x).</changelog>
  <changelog author="max@suse.com" date="1641816000">- bsc#1194229: Fix pool package dependencies, so that SLE actually
  prefers chrony-pool-suse over chrony-pool-empty.</changelog>
  <changelog author="max@suse.com" date="1648123200">- Fix config file handling in the spec file and remove "ntsdumpdir"
  from default config, because augeas-lenses cannot parse it during
  installation of SLE Micro on SLE-15-SP3 (bsc#1194220).</changelog>
  <changelog author="max@suse.com" date="1710504000">- Use shorter NTS-KE retry interval when network is down
  (bsc#1213551, chrony-burst_total_samples_to_go.patch,
  chrony-retry_interval_ke_start.patch).</changelog>
  <changelog author="max@suse.com" date="1712750400">- Use make quickcheck instead of make check to avoid &gt;1h build
  times and failures due to timeouts. This was the default before
  3.2 but it changed to make tests more reliable. Here a seed is
  already set to get deterministic execution.</changelog>
</package>
<package pkgid="4efe67e52782774fc6b7906451c239b2d67b9c0e2c5c96232147c61f1da7344b" name="clamav" arch="aarch64">
  <version epoch="0" ver="0.103.12" rel="150600.18.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="max@suse.com" date="1651838400">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1661947200">- bsc#1202986: Update to 0.103.7:
  * Upgrade the vendored UnRAR library to version 6.1.7.
  * Fix logical signature "Intermediates" feature.
  * Relax constraints on slightly malformed zip archives that
    contain overlapping file entries.</changelog>
  <changelog author="max@suse.com" date="1676548800">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.</changelog>
  <changelog author="max@suse.com" date="1692273600">- Update to 0.103.9
  * CVE-2023-20197, bsc#1214342: Fixed a possible denial of service
    vulnerability in the HFS+ file parser.
  * Fixed compiler warnings that may turn into errors in Clang 16.
- Renew clamav.keyring .</changelog>
  <changelog author="max@suse.com" date="1698321600">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="max@suse.com" date="1725883200">- Update to 0.103.12
  * [CVE-2024-20506, bsc#1230162]: Changed the logging module to
    disable following symlinks on Linux and Unix systems so as to
    prevent an attacker with existing access to the 'clamd' or
    'freshclam' services from using a symlink to corrupt system
    files.
  * [CVE-2024-20505, bsc#1230161]: Fixed a possible out-of-bounds
    read bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition.
  * ClamOnAcc: Fixed an infinite loop when a watched directory
    does not exist.
  * Fixed a bug causing CVDs downloaded by the `DatabaseCustomURL`
    Freshclam config option to be pruned and then re-downloaded
    with every update.
  * Fixed an unaligned pointer dereference issue on select
    architectures.</changelog>
</package>
<package pkgid="5fc3b1b8912408045bb638d5c061da10c161ec8602946cf5278e5704bebb80ef" name="clamav" arch="ppc64le">
  <version epoch="0" ver="0.103.12" rel="150600.18.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="max@suse.com" date="1651838400">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1661947200">- bsc#1202986: Update to 0.103.7:
  * Upgrade the vendored UnRAR library to version 6.1.7.
  * Fix logical signature "Intermediates" feature.
  * Relax constraints on slightly malformed zip archives that
    contain overlapping file entries.</changelog>
  <changelog author="max@suse.com" date="1676548800">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.</changelog>
  <changelog author="max@suse.com" date="1692273600">- Update to 0.103.9
  * CVE-2023-20197, bsc#1214342: Fixed a possible denial of service
    vulnerability in the HFS+ file parser.
  * Fixed compiler warnings that may turn into errors in Clang 16.
- Renew clamav.keyring .</changelog>
  <changelog author="max@suse.com" date="1698321600">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="max@suse.com" date="1725883200">- Update to 0.103.12
  * [CVE-2024-20506, bsc#1230162]: Changed the logging module to
    disable following symlinks on Linux and Unix systems so as to
    prevent an attacker with existing access to the 'clamd' or
    'freshclam' services from using a symlink to corrupt system
    files.
  * [CVE-2024-20505, bsc#1230161]: Fixed a possible out-of-bounds
    read bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition.
  * ClamOnAcc: Fixed an infinite loop when a watched directory
    does not exist.
  * Fixed a bug causing CVDs downloaded by the `DatabaseCustomURL`
    Freshclam config option to be pruned and then re-downloaded
    with every update.
  * Fixed an unaligned pointer dereference issue on select
    architectures.</changelog>
</package>
<package pkgid="8564be4f7abe987c81587754b2b4cfb719df8f85ff77cd47ed79aac685aaf440" name="clamav" arch="s390x">
  <version epoch="0" ver="0.103.12" rel="150600.18.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="max@suse.com" date="1651838400">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1661947200">- bsc#1202986: Update to 0.103.7:
  * Upgrade the vendored UnRAR library to version 6.1.7.
  * Fix logical signature "Intermediates" feature.
  * Relax constraints on slightly malformed zip archives that
    contain overlapping file entries.</changelog>
  <changelog author="max@suse.com" date="1676548800">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.</changelog>
  <changelog author="max@suse.com" date="1692273600">- Update to 0.103.9
  * CVE-2023-20197, bsc#1214342: Fixed a possible denial of service
    vulnerability in the HFS+ file parser.
  * Fixed compiler warnings that may turn into errors in Clang 16.
- Renew clamav.keyring .</changelog>
  <changelog author="max@suse.com" date="1698321600">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="max@suse.com" date="1725883200">- Update to 0.103.12
  * [CVE-2024-20506, bsc#1230162]: Changed the logging module to
    disable following symlinks on Linux and Unix systems so as to
    prevent an attacker with existing access to the 'clamd' or
    'freshclam' services from using a symlink to corrupt system
    files.
  * [CVE-2024-20505, bsc#1230161]: Fixed a possible out-of-bounds
    read bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition.
  * ClamOnAcc: Fixed an infinite loop when a watched directory
    does not exist.
  * Fixed a bug causing CVDs downloaded by the `DatabaseCustomURL`
    Freshclam config option to be pruned and then re-downloaded
    with every update.
  * Fixed an unaligned pointer dereference issue on select
    architectures.</changelog>
</package>
<package pkgid="92db3c2805365c68717fbbac9d7fc65aa5ed5f800cb775533a7b130b17c32d49" name="clamav" arch="src">
  <version epoch="0" ver="0.103.12" rel="150600.18.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="max@suse.com" date="1651838400">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1661947200">- bsc#1202986: Update to 0.103.7:
  * Upgrade the vendored UnRAR library to version 6.1.7.
  * Fix logical signature "Intermediates" feature.
  * Relax constraints on slightly malformed zip archives that
    contain overlapping file entries.</changelog>
  <changelog author="max@suse.com" date="1676548800">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.</changelog>
  <changelog author="max@suse.com" date="1692273600">- Update to 0.103.9
  * CVE-2023-20197, bsc#1214342: Fixed a possible denial of service
    vulnerability in the HFS+ file parser.
  * Fixed compiler warnings that may turn into errors in Clang 16.
- Renew clamav.keyring .</changelog>
  <changelog author="max@suse.com" date="1698321600">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="max@suse.com" date="1725883200">- Update to 0.103.12
  * [CVE-2024-20506, bsc#1230162]: Changed the logging module to
    disable following symlinks on Linux and Unix systems so as to
    prevent an attacker with existing access to the 'clamd' or
    'freshclam' services from using a symlink to corrupt system
    files.
  * [CVE-2024-20505, bsc#1230161]: Fixed a possible out-of-bounds
    read bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition.
  * ClamOnAcc: Fixed an infinite loop when a watched directory
    does not exist.
  * Fixed a bug causing CVDs downloaded by the `DatabaseCustomURL`
    Freshclam config option to be pruned and then re-downloaded
    with every update.
  * Fixed an unaligned pointer dereference issue on select
    architectures.</changelog>
</package>
<package pkgid="1147c8d663a1bcd998a40f479acbb0c620829c271685845c83a56bd1c6118769" name="clamav" arch="x86_64">
  <version epoch="0" ver="0.103.12" rel="150600.18.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="max@suse.com" date="1651838400">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1661947200">- bsc#1202986: Update to 0.103.7:
  * Upgrade the vendored UnRAR library to version 6.1.7.
  * Fix logical signature "Intermediates" feature.
  * Relax constraints on slightly malformed zip archives that
    contain overlapping file entries.</changelog>
  <changelog author="max@suse.com" date="1676548800">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.</changelog>
  <changelog author="max@suse.com" date="1692273600">- Update to 0.103.9
  * CVE-2023-20197, bsc#1214342: Fixed a possible denial of service
    vulnerability in the HFS+ file parser.
  * Fixed compiler warnings that may turn into errors in Clang 16.
- Renew clamav.keyring .</changelog>
  <changelog author="max@suse.com" date="1698321600">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="max@suse.com" date="1725883200">- Update to 0.103.12
  * [CVE-2024-20506, bsc#1230162]: Changed the logging module to
    disable following symlinks on Linux and Unix systems so as to
    prevent an attacker with existing access to the 'clamd' or
    'freshclam' services from using a symlink to corrupt system
    files.
  * [CVE-2024-20505, bsc#1230161]: Fixed a possible out-of-bounds
    read bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition.
  * ClamOnAcc: Fixed an infinite loop when a watched directory
    does not exist.
  * Fixed a bug causing CVDs downloaded by the `DatabaseCustomURL`
    Freshclam config option to be pruned and then re-downloaded
    with every update.
  * Fixed an unaligned pointer dereference issue on select
    architectures.</changelog>
</package>
<package pkgid="6267237284e7df376cf361dc13f3fc7f58c1dcacba1758f1b60dff1cd1be8763" name="clamav-devel" arch="aarch64">
  <version epoch="0" ver="0.103.12" rel="150600.18.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="max@suse.com" date="1651838400">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1661947200">- bsc#1202986: Update to 0.103.7:
  * Upgrade the vendored UnRAR library to version 6.1.7.
  * Fix logical signature "Intermediates" feature.
  * Relax constraints on slightly malformed zip archives that
    contain overlapping file entries.</changelog>
  <changelog author="max@suse.com" date="1676548800">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.</changelog>
  <changelog author="max@suse.com" date="1692273600">- Update to 0.103.9
  * CVE-2023-20197, bsc#1214342: Fixed a possible denial of service
    vulnerability in the HFS+ file parser.
  * Fixed compiler warnings that may turn into errors in Clang 16.
- Renew clamav.keyring .</changelog>
  <changelog author="max@suse.com" date="1698321600">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="max@suse.com" date="1725883200">- Update to 0.103.12
  * [CVE-2024-20506, bsc#1230162]: Changed the logging module to
    disable following symlinks on Linux and Unix systems so as to
    prevent an attacker with existing access to the 'clamd' or
    'freshclam' services from using a symlink to corrupt system
    files.
  * [CVE-2024-20505, bsc#1230161]: Fixed a possible out-of-bounds
    read bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition.
  * ClamOnAcc: Fixed an infinite loop when a watched directory
    does not exist.
  * Fixed a bug causing CVDs downloaded by the `DatabaseCustomURL`
    Freshclam config option to be pruned and then re-downloaded
    with every update.
  * Fixed an unaligned pointer dereference issue on select
    architectures.</changelog>
</package>
<package pkgid="dcf3e07f3c2028a1eb2a80efce2a9416338d0d97e2ee83a0d244bd05e9d914bc" name="clamav-devel" arch="ppc64le">
  <version epoch="0" ver="0.103.12" rel="150600.18.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="max@suse.com" date="1651838400">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1661947200">- bsc#1202986: Update to 0.103.7:
  * Upgrade the vendored UnRAR library to version 6.1.7.
  * Fix logical signature "Intermediates" feature.
  * Relax constraints on slightly malformed zip archives that
    contain overlapping file entries.</changelog>
  <changelog author="max@suse.com" date="1676548800">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.</changelog>
  <changelog author="max@suse.com" date="1692273600">- Update to 0.103.9
  * CVE-2023-20197, bsc#1214342: Fixed a possible denial of service
    vulnerability in the HFS+ file parser.
  * Fixed compiler warnings that may turn into errors in Clang 16.
- Renew clamav.keyring .</changelog>
  <changelog author="max@suse.com" date="1698321600">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="max@suse.com" date="1725883200">- Update to 0.103.12
  * [CVE-2024-20506, bsc#1230162]: Changed the logging module to
    disable following symlinks on Linux and Unix systems so as to
    prevent an attacker with existing access to the 'clamd' or
    'freshclam' services from using a symlink to corrupt system
    files.
  * [CVE-2024-20505, bsc#1230161]: Fixed a possible out-of-bounds
    read bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition.
  * ClamOnAcc: Fixed an infinite loop when a watched directory
    does not exist.
  * Fixed a bug causing CVDs downloaded by the `DatabaseCustomURL`
    Freshclam config option to be pruned and then re-downloaded
    with every update.
  * Fixed an unaligned pointer dereference issue on select
    architectures.</changelog>
</package>
<package pkgid="51a963a7089990b12c90406e18fc78bb0b5edf9a3e8e20833cff211e6fce09d2" name="clamav-devel" arch="s390x">
  <version epoch="0" ver="0.103.12" rel="150600.18.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="max@suse.com" date="1651838400">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1661947200">- bsc#1202986: Update to 0.103.7:
  * Upgrade the vendored UnRAR library to version 6.1.7.
  * Fix logical signature "Intermediates" feature.
  * Relax constraints on slightly malformed zip archives that
    contain overlapping file entries.</changelog>
  <changelog author="max@suse.com" date="1676548800">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.</changelog>
  <changelog author="max@suse.com" date="1692273600">- Update to 0.103.9
  * CVE-2023-20197, bsc#1214342: Fixed a possible denial of service
    vulnerability in the HFS+ file parser.
  * Fixed compiler warnings that may turn into errors in Clang 16.
- Renew clamav.keyring .</changelog>
  <changelog author="max@suse.com" date="1698321600">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="max@suse.com" date="1725883200">- Update to 0.103.12
  * [CVE-2024-20506, bsc#1230162]: Changed the logging module to
    disable following symlinks on Linux and Unix systems so as to
    prevent an attacker with existing access to the 'clamd' or
    'freshclam' services from using a symlink to corrupt system
    files.
  * [CVE-2024-20505, bsc#1230161]: Fixed a possible out-of-bounds
    read bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition.
  * ClamOnAcc: Fixed an infinite loop when a watched directory
    does not exist.
  * Fixed a bug causing CVDs downloaded by the `DatabaseCustomURL`
    Freshclam config option to be pruned and then re-downloaded
    with every update.
  * Fixed an unaligned pointer dereference issue on select
    architectures.</changelog>
</package>
<package pkgid="ef1ee526a892355a6870b7c69ef0ecc47460ad898e4f5123b08d411657c9b2fb" name="clamav-devel" arch="x86_64">
  <version epoch="0" ver="0.103.12" rel="150600.18.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="max@suse.com" date="1651838400">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1661947200">- bsc#1202986: Update to 0.103.7:
  * Upgrade the vendored UnRAR library to version 6.1.7.
  * Fix logical signature "Intermediates" feature.
  * Relax constraints on slightly malformed zip archives that
    contain overlapping file entries.</changelog>
  <changelog author="max@suse.com" date="1676548800">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.</changelog>
  <changelog author="max@suse.com" date="1692273600">- Update to 0.103.9
  * CVE-2023-20197, bsc#1214342: Fixed a possible denial of service
    vulnerability in the HFS+ file parser.
  * Fixed compiler warnings that may turn into errors in Clang 16.
- Renew clamav.keyring .</changelog>
  <changelog author="max@suse.com" date="1698321600">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="max@suse.com" date="1725883200">- Update to 0.103.12
  * [CVE-2024-20506, bsc#1230162]: Changed the logging module to
    disable following symlinks on Linux and Unix systems so as to
    prevent an attacker with existing access to the 'clamd' or
    'freshclam' services from using a symlink to corrupt system
    files.
  * [CVE-2024-20505, bsc#1230161]: Fixed a possible out-of-bounds
    read bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition.
  * ClamOnAcc: Fixed an infinite loop when a watched directory
    does not exist.
  * Fixed a bug causing CVDs downloaded by the `DatabaseCustomURL`
    Freshclam config option to be pruned and then re-downloaded
    with every update.
  * Fixed an unaligned pointer dereference issue on select
    architectures.</changelog>
</package>
<package pkgid="7ea27aaf269cc65dc1ce70152d2f4f5eb22ef0a11007430f03bbfddb6bb2c2a0" name="clang-tools" arch="aarch64">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="e8042b62da69af8176e6b890db9ea6e5ff91ea77f7d51a1d6f06c1fb941c176c" name="clang-tools" arch="ppc64le">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="3b6f38cf0a2640c87a02a1ce715d3b572fca39572d3c9971f2835aca1d480090" name="clang-tools" arch="s390x">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="414e6a57b889f59f5f2e908fc3ffe17259e7189ba7e8103e9f80d29a4519e4b3" name="clang-tools" arch="x86_64">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="7fe5d4fe51ad6b359024d9bb83ff84a6dd1553185d7547a78c68b72c5cb78b13" name="clang11" arch="aarch64">
  <version epoch="0" ver="11.0.1" rel="150300.3.8.1"/>
  <changelog author="rguenther@suse.com" date="1580990400">- Add back emacs-llvm Provides and Conflicts to clang subpackage
  originally in llvm-emacs-plugins to properly conflict with
  llvm-emacs-plugins from older llvm releases.</changelog>
  <changelog author="rguenther@suse.com" date="1581076800">- Add vim-plugin-llvm Conflicts to clang subpackage which now
  contains files formerly in llvmN-vim-plugins, conflicting with
  packages from older llvm releases.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583582400">- Move all clang-related scripts (including those originally in
  clangX-checker), hmaptool and clang-doc into a common
  unversioned subpackage clang-tools, like python3-clang.
  The scripts reference the unversioned executables, so allowing
  multiple versions via update-alternatives would be misleading.
  The clang-doc executable will come with assets in Clang 10, so
  we have to take it out of update-alternatives as well.
  This should be the proper solution to boo#1161873.
- Include run-find-all-symbols script in clang-tools.
- Remove metadata for clangX-include-fixer subpackage that never
  had any files and thus wasn't released as rpm. There are so many
  clang binaries that packaging them separately doesn't scale.
- Fix lldb version string, adapt lldb-cmake.patch (boo#1165517).
- Remove unneccesary libtool dependency.
- Don't let clang depend on libc++, we link it with libstdc++.
- Recommend gold plugin if clang and gold are installed.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583928000">- Require clang-tools for clangX-devel.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1584964800">- Remove conflicts of clang-tools with {clang,llvm}{7,8}: the
  relevant binaries have been removed from those packages. This
  allows having clang-tools together with older versions of llvm.
  For a smooth installation we add OrderWithRequires dependencies.
- Fix typos in (still inactive) !%{with clang_scripts} part.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1585051200">- Update to version 10.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/10.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-ifs, llvm-install-name-tool, llvm-reduce.
  * New Clang tools: clang-move, clang-offload-wrapper, pp-trace.
  * lldb-mi moved to a separate project and is no longer available.
- Dropped obsolete patches:
  * clang-fix-powerpc-triplet.patch
  * clang-riscv64-rv64gc.diff
  * compiler-rt-move-fdp.patch
  * compiler-rt-sanitizer-ipc-perm.patch
  * D60657-riscv-pcrel_lo.diff
  * gwp-asan-lto.patch
  * libcxx-tests-linux-distribution.patch
  * link-lldb-shared.patch
  * llvm-riscv64-fix-cffi.diff
  * openmp-export-fini.patch
  * riscv-eh-frame-fixup.patch
  * riscv64-suse-linux.patch
- Rebased patches:
  * assume-opensuse.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
  * lto-disable-cache.patch
  * polly-pthread.patch
  * tests-use-python3.patch
- Add tablegen-test-link-static.patch: fix TableGenTests.
- Add ValueLattice-Add-new-state-for-undef-constants.patch: fix
  miscompilation on ppc64/s390x that was leading to test crashes.
- Enable ThinLTO on aarch64.
- Disable ThinLTO on ppc64le due to internal error in gold.
- Delete object files and static libraries from build tree in
  %install already, because debuginfo extraction happens after
  that. If we do it after %check, we run out of disk space.
- Run tests "manually", because we've already removed many targets.
- Don't build unit tests, because some of them are now statically
  linked, which is very expensive with LTO. Also unit tests are
  probably not very interesting on the distribution level, we don't
  expect them to perform different than in upstream. The relevant
  upstream change for this is https://reviews.llvm.org/D54439.
- Drop %if for openSUSE 13.2.</changelog>
  <changelog author="idonmez@suse.com" date="1592913600">- Add lld-default-sha1.patch to make lld generate SHA1 build-ids by
  default, otherwise our tools cannot process the debuginfo.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1594555200">- Factor out computation of the number of jobs into a macro.
- Choose mem_per_compile_job dependent on build stage, let stage 1
  on x86_64 use more memory.
- More generous memory allocation on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1595419200">- Update to version 10.0.1.
  * This release contains bug-fixes for the LLVM 10.0.0 release.
    This release is API and ABI compatible with 10.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Replace ValueLattice-Add-new-state-for-undef-constants.patch,
  which landed upstream in a modified version, by
  restore-llvm10-abi.patch that resets the ABI to our 10.0.0.
- Rewrite lld-default-sha1.patch to be version-independent.
- Set flags consistently, so that we don't lose -DNDEBUG on 32-bit
  architectures. Also we don't need the opt flags twice. This leads
  to a significant reduction in binary sizes on 32-bit arches.
- Make it easier to package release candidates.
- Enable most tests on 32-bit ARM, but not for libcxx.
- Add fix-atomics-test.patch for architectures where native atomics
  are not available.
- Lower build constraints for riscv64 a bit to allow building on
  more workers.
- Allow more compile jobs in stage 2.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1596110400">- Add ld.lld as an alternative for ld. (boo#1174656)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603108800">- Update to version 11.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/11.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-gsymutil, llvm-ml.
  * clang-import-test was removed.
- Drop obsolete patches:
  * clang-ignore-stack-clash-protector.patch
  * fix-atomics-test.patch
  * restore-llvm10-abi.patch
- Rebase patches:
  * clang-resourcedirs.patch
  * default-to-i586.patch
  * link-clang-shared.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Add llvm-exegesis-link-dylib.patch: link llvm-exegesis with
  libLLVM.so, the advanced functionality is not available anyway.
- Remove -fstack-clash-protection on architectures where it isn't
  actually supported, because that prevents feature detection.
- Make sure we also build AttributeReference for the documentation.
  This requires building via CMake. Also shorten the paths.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603540800">- Disable ThinLTO on aarch64 because of hangs. (boo#1178070)
- Enable ThinLTO on ppc64 and ppc64le, the internal error is gone.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1605355200">- Let CMake files in {llvm,clang}X-devel refer to the versioned
  binaries that come with the package instead of the symlink
  managed by update-alternatives. (boo#1178513)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1606132800">- Add compiler-rt-dont-compile-assembly-files-as-c.patch to fix
  build failure with newer CMake versions.</changelog>
  <changelog author="schwab@suse.de" date="1607947200">- polly-pthread.patch: Remove, std::call_once no longer needs libpthread</changelog>
  <changelog author="gmbr3@opensuse.org" date="1609502400">- Move BFD plugins to %{_libdir}</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1609934400">- Increase required RAM for aarch64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1610193600">- Update to version 11.0.1.
  * This release contains bug-fixes for the LLVM 11.0.0 release.
    This release is API and ABI compatible with 11.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Drop obsolete compiler-rt-dont-compile-assembly-files-as-c.patch.
- Make documentation tarballs more reproducible.</changelog>
  <changelog author="rguenther@suse.com" date="1664280000">- Add llvm-testsuite-keep-DFLTCC.patch to keep DFLTCC environment
  during testing so we can disable the compression facility on
  s390x which causes testsuite issues.  [bsc#1189602]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1669809600">- Drop RUNPATH from packaged binaries, instead set LD_LIBRARY_PATH
  for building and testing to simulate behavior of actual package.
  [bsc#1197773 , backported from OBS devel revision 25]
- Propagate the complete host environment to the tests run. This
  ensures that all envvars needed e.g. for the compiler to work
  correctly are present. This run libc++ tests successfully getting the env
  LD_LIBRARY_PATH, otherwise, library were not found.
  [llvm-propagate-host-env-to-libc++-test-suite.patch]</changelog>
</package>
<package pkgid="9ce1458459f76efc0488eff1757bfad6cbb563fb1aa39e2dacb23a26d8d7a249" name="clang11" arch="ppc64le">
  <version epoch="0" ver="11.0.1" rel="150300.3.8.1"/>
  <changelog author="rguenther@suse.com" date="1580990400">- Add back emacs-llvm Provides and Conflicts to clang subpackage
  originally in llvm-emacs-plugins to properly conflict with
  llvm-emacs-plugins from older llvm releases.</changelog>
  <changelog author="rguenther@suse.com" date="1581076800">- Add vim-plugin-llvm Conflicts to clang subpackage which now
  contains files formerly in llvmN-vim-plugins, conflicting with
  packages from older llvm releases.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583582400">- Move all clang-related scripts (including those originally in
  clangX-checker), hmaptool and clang-doc into a common
  unversioned subpackage clang-tools, like python3-clang.
  The scripts reference the unversioned executables, so allowing
  multiple versions via update-alternatives would be misleading.
  The clang-doc executable will come with assets in Clang 10, so
  we have to take it out of update-alternatives as well.
  This should be the proper solution to boo#1161873.
- Include run-find-all-symbols script in clang-tools.
- Remove metadata for clangX-include-fixer subpackage that never
  had any files and thus wasn't released as rpm. There are so many
  clang binaries that packaging them separately doesn't scale.
- Fix lldb version string, adapt lldb-cmake.patch (boo#1165517).
- Remove unneccesary libtool dependency.
- Don't let clang depend on libc++, we link it with libstdc++.
- Recommend gold plugin if clang and gold are installed.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583928000">- Require clang-tools for clangX-devel.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1584964800">- Remove conflicts of clang-tools with {clang,llvm}{7,8}: the
  relevant binaries have been removed from those packages. This
  allows having clang-tools together with older versions of llvm.
  For a smooth installation we add OrderWithRequires dependencies.
- Fix typos in (still inactive) !%{with clang_scripts} part.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1585051200">- Update to version 10.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/10.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-ifs, llvm-install-name-tool, llvm-reduce.
  * New Clang tools: clang-move, clang-offload-wrapper, pp-trace.
  * lldb-mi moved to a separate project and is no longer available.
- Dropped obsolete patches:
  * clang-fix-powerpc-triplet.patch
  * clang-riscv64-rv64gc.diff
  * compiler-rt-move-fdp.patch
  * compiler-rt-sanitizer-ipc-perm.patch
  * D60657-riscv-pcrel_lo.diff
  * gwp-asan-lto.patch
  * libcxx-tests-linux-distribution.patch
  * link-lldb-shared.patch
  * llvm-riscv64-fix-cffi.diff
  * openmp-export-fini.patch
  * riscv-eh-frame-fixup.patch
  * riscv64-suse-linux.patch
- Rebased patches:
  * assume-opensuse.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
  * lto-disable-cache.patch
  * polly-pthread.patch
  * tests-use-python3.patch
- Add tablegen-test-link-static.patch: fix TableGenTests.
- Add ValueLattice-Add-new-state-for-undef-constants.patch: fix
  miscompilation on ppc64/s390x that was leading to test crashes.
- Enable ThinLTO on aarch64.
- Disable ThinLTO on ppc64le due to internal error in gold.
- Delete object files and static libraries from build tree in
  %install already, because debuginfo extraction happens after
  that. If we do it after %check, we run out of disk space.
- Run tests "manually", because we've already removed many targets.
- Don't build unit tests, because some of them are now statically
  linked, which is very expensive with LTO. Also unit tests are
  probably not very interesting on the distribution level, we don't
  expect them to perform different than in upstream. The relevant
  upstream change for this is https://reviews.llvm.org/D54439.
- Drop %if for openSUSE 13.2.</changelog>
  <changelog author="idonmez@suse.com" date="1592913600">- Add lld-default-sha1.patch to make lld generate SHA1 build-ids by
  default, otherwise our tools cannot process the debuginfo.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1594555200">- Factor out computation of the number of jobs into a macro.
- Choose mem_per_compile_job dependent on build stage, let stage 1
  on x86_64 use more memory.
- More generous memory allocation on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1595419200">- Update to version 10.0.1.
  * This release contains bug-fixes for the LLVM 10.0.0 release.
    This release is API and ABI compatible with 10.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Replace ValueLattice-Add-new-state-for-undef-constants.patch,
  which landed upstream in a modified version, by
  restore-llvm10-abi.patch that resets the ABI to our 10.0.0.
- Rewrite lld-default-sha1.patch to be version-independent.
- Set flags consistently, so that we don't lose -DNDEBUG on 32-bit
  architectures. Also we don't need the opt flags twice. This leads
  to a significant reduction in binary sizes on 32-bit arches.
- Make it easier to package release candidates.
- Enable most tests on 32-bit ARM, but not for libcxx.
- Add fix-atomics-test.patch for architectures where native atomics
  are not available.
- Lower build constraints for riscv64 a bit to allow building on
  more workers.
- Allow more compile jobs in stage 2.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1596110400">- Add ld.lld as an alternative for ld. (boo#1174656)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603108800">- Update to version 11.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/11.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-gsymutil, llvm-ml.
  * clang-import-test was removed.
- Drop obsolete patches:
  * clang-ignore-stack-clash-protector.patch
  * fix-atomics-test.patch
  * restore-llvm10-abi.patch
- Rebase patches:
  * clang-resourcedirs.patch
  * default-to-i586.patch
  * link-clang-shared.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Add llvm-exegesis-link-dylib.patch: link llvm-exegesis with
  libLLVM.so, the advanced functionality is not available anyway.
- Remove -fstack-clash-protection on architectures where it isn't
  actually supported, because that prevents feature detection.
- Make sure we also build AttributeReference for the documentation.
  This requires building via CMake. Also shorten the paths.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603540800">- Disable ThinLTO on aarch64 because of hangs. (boo#1178070)
- Enable ThinLTO on ppc64 and ppc64le, the internal error is gone.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1605355200">- Let CMake files in {llvm,clang}X-devel refer to the versioned
  binaries that come with the package instead of the symlink
  managed by update-alternatives. (boo#1178513)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1606132800">- Add compiler-rt-dont-compile-assembly-files-as-c.patch to fix
  build failure with newer CMake versions.</changelog>
  <changelog author="schwab@suse.de" date="1607947200">- polly-pthread.patch: Remove, std::call_once no longer needs libpthread</changelog>
  <changelog author="gmbr3@opensuse.org" date="1609502400">- Move BFD plugins to %{_libdir}</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1609934400">- Increase required RAM for aarch64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1610193600">- Update to version 11.0.1.
  * This release contains bug-fixes for the LLVM 11.0.0 release.
    This release is API and ABI compatible with 11.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Drop obsolete compiler-rt-dont-compile-assembly-files-as-c.patch.
- Make documentation tarballs more reproducible.</changelog>
  <changelog author="rguenther@suse.com" date="1664280000">- Add llvm-testsuite-keep-DFLTCC.patch to keep DFLTCC environment
  during testing so we can disable the compression facility on
  s390x which causes testsuite issues.  [bsc#1189602]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1669809600">- Drop RUNPATH from packaged binaries, instead set LD_LIBRARY_PATH
  for building and testing to simulate behavior of actual package.
  [bsc#1197773 , backported from OBS devel revision 25]
- Propagate the complete host environment to the tests run. This
  ensures that all envvars needed e.g. for the compiler to work
  correctly are present. This run libc++ tests successfully getting the env
  LD_LIBRARY_PATH, otherwise, library were not found.
  [llvm-propagate-host-env-to-libc++-test-suite.patch]</changelog>
</package>
<package pkgid="e1c15e7868d084b7cae3ae7534ba39e6dfe1092091426e769fb8fb2e871512e6" name="clang11" arch="s390x">
  <version epoch="0" ver="11.0.1" rel="150300.3.8.1"/>
  <changelog author="rguenther@suse.com" date="1580990400">- Add back emacs-llvm Provides and Conflicts to clang subpackage
  originally in llvm-emacs-plugins to properly conflict with
  llvm-emacs-plugins from older llvm releases.</changelog>
  <changelog author="rguenther@suse.com" date="1581076800">- Add vim-plugin-llvm Conflicts to clang subpackage which now
  contains files formerly in llvmN-vim-plugins, conflicting with
  packages from older llvm releases.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583582400">- Move all clang-related scripts (including those originally in
  clangX-checker), hmaptool and clang-doc into a common
  unversioned subpackage clang-tools, like python3-clang.
  The scripts reference the unversioned executables, so allowing
  multiple versions via update-alternatives would be misleading.
  The clang-doc executable will come with assets in Clang 10, so
  we have to take it out of update-alternatives as well.
  This should be the proper solution to boo#1161873.
- Include run-find-all-symbols script in clang-tools.
- Remove metadata for clangX-include-fixer subpackage that never
  had any files and thus wasn't released as rpm. There are so many
  clang binaries that packaging them separately doesn't scale.
- Fix lldb version string, adapt lldb-cmake.patch (boo#1165517).
- Remove unneccesary libtool dependency.
- Don't let clang depend on libc++, we link it with libstdc++.
- Recommend gold plugin if clang and gold are installed.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583928000">- Require clang-tools for clangX-devel.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1584964800">- Remove conflicts of clang-tools with {clang,llvm}{7,8}: the
  relevant binaries have been removed from those packages. This
  allows having clang-tools together with older versions of llvm.
  For a smooth installation we add OrderWithRequires dependencies.
- Fix typos in (still inactive) !%{with clang_scripts} part.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1585051200">- Update to version 10.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/10.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-ifs, llvm-install-name-tool, llvm-reduce.
  * New Clang tools: clang-move, clang-offload-wrapper, pp-trace.
  * lldb-mi moved to a separate project and is no longer available.
- Dropped obsolete patches:
  * clang-fix-powerpc-triplet.patch
  * clang-riscv64-rv64gc.diff
  * compiler-rt-move-fdp.patch
  * compiler-rt-sanitizer-ipc-perm.patch
  * D60657-riscv-pcrel_lo.diff
  * gwp-asan-lto.patch
  * libcxx-tests-linux-distribution.patch
  * link-lldb-shared.patch
  * llvm-riscv64-fix-cffi.diff
  * openmp-export-fini.patch
  * riscv-eh-frame-fixup.patch
  * riscv64-suse-linux.patch
- Rebased patches:
  * assume-opensuse.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
  * lto-disable-cache.patch
  * polly-pthread.patch
  * tests-use-python3.patch
- Add tablegen-test-link-static.patch: fix TableGenTests.
- Add ValueLattice-Add-new-state-for-undef-constants.patch: fix
  miscompilation on ppc64/s390x that was leading to test crashes.
- Enable ThinLTO on aarch64.
- Disable ThinLTO on ppc64le due to internal error in gold.
- Delete object files and static libraries from build tree in
  %install already, because debuginfo extraction happens after
  that. If we do it after %check, we run out of disk space.
- Run tests "manually", because we've already removed many targets.
- Don't build unit tests, because some of them are now statically
  linked, which is very expensive with LTO. Also unit tests are
  probably not very interesting on the distribution level, we don't
  expect them to perform different than in upstream. The relevant
  upstream change for this is https://reviews.llvm.org/D54439.
- Drop %if for openSUSE 13.2.</changelog>
  <changelog author="idonmez@suse.com" date="1592913600">- Add lld-default-sha1.patch to make lld generate SHA1 build-ids by
  default, otherwise our tools cannot process the debuginfo.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1594555200">- Factor out computation of the number of jobs into a macro.
- Choose mem_per_compile_job dependent on build stage, let stage 1
  on x86_64 use more memory.
- More generous memory allocation on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1595419200">- Update to version 10.0.1.
  * This release contains bug-fixes for the LLVM 10.0.0 release.
    This release is API and ABI compatible with 10.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Replace ValueLattice-Add-new-state-for-undef-constants.patch,
  which landed upstream in a modified version, by
  restore-llvm10-abi.patch that resets the ABI to our 10.0.0.
- Rewrite lld-default-sha1.patch to be version-independent.
- Set flags consistently, so that we don't lose -DNDEBUG on 32-bit
  architectures. Also we don't need the opt flags twice. This leads
  to a significant reduction in binary sizes on 32-bit arches.
- Make it easier to package release candidates.
- Enable most tests on 32-bit ARM, but not for libcxx.
- Add fix-atomics-test.patch for architectures where native atomics
  are not available.
- Lower build constraints for riscv64 a bit to allow building on
  more workers.
- Allow more compile jobs in stage 2.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1596110400">- Add ld.lld as an alternative for ld. (boo#1174656)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603108800">- Update to version 11.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/11.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-gsymutil, llvm-ml.
  * clang-import-test was removed.
- Drop obsolete patches:
  * clang-ignore-stack-clash-protector.patch
  * fix-atomics-test.patch
  * restore-llvm10-abi.patch
- Rebase patches:
  * clang-resourcedirs.patch
  * default-to-i586.patch
  * link-clang-shared.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Add llvm-exegesis-link-dylib.patch: link llvm-exegesis with
  libLLVM.so, the advanced functionality is not available anyway.
- Remove -fstack-clash-protection on architectures where it isn't
  actually supported, because that prevents feature detection.
- Make sure we also build AttributeReference for the documentation.
  This requires building via CMake. Also shorten the paths.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603540800">- Disable ThinLTO on aarch64 because of hangs. (boo#1178070)
- Enable ThinLTO on ppc64 and ppc64le, the internal error is gone.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1605355200">- Let CMake files in {llvm,clang}X-devel refer to the versioned
  binaries that come with the package instead of the symlink
  managed by update-alternatives. (boo#1178513)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1606132800">- Add compiler-rt-dont-compile-assembly-files-as-c.patch to fix
  build failure with newer CMake versions.</changelog>
  <changelog author="schwab@suse.de" date="1607947200">- polly-pthread.patch: Remove, std::call_once no longer needs libpthread</changelog>
  <changelog author="gmbr3@opensuse.org" date="1609502400">- Move BFD plugins to %{_libdir}</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1609934400">- Increase required RAM for aarch64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1610193600">- Update to version 11.0.1.
  * This release contains bug-fixes for the LLVM 11.0.0 release.
    This release is API and ABI compatible with 11.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Drop obsolete compiler-rt-dont-compile-assembly-files-as-c.patch.
- Make documentation tarballs more reproducible.</changelog>
  <changelog author="rguenther@suse.com" date="1664280000">- Add llvm-testsuite-keep-DFLTCC.patch to keep DFLTCC environment
  during testing so we can disable the compression facility on
  s390x which causes testsuite issues.  [bsc#1189602]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1669809600">- Drop RUNPATH from packaged binaries, instead set LD_LIBRARY_PATH
  for building and testing to simulate behavior of actual package.
  [bsc#1197773 , backported from OBS devel revision 25]
- Propagate the complete host environment to the tests run. This
  ensures that all envvars needed e.g. for the compiler to work
  correctly are present. This run libc++ tests successfully getting the env
  LD_LIBRARY_PATH, otherwise, library were not found.
  [llvm-propagate-host-env-to-libc++-test-suite.patch]</changelog>
</package>
<package pkgid="c971661f170206cf5662936dd8f61380db4b41b6f2deb962d2e656a48fd7de81" name="clang11" arch="x86_64">
  <version epoch="0" ver="11.0.1" rel="150300.3.8.1"/>
  <changelog author="rguenther@suse.com" date="1580990400">- Add back emacs-llvm Provides and Conflicts to clang subpackage
  originally in llvm-emacs-plugins to properly conflict with
  llvm-emacs-plugins from older llvm releases.</changelog>
  <changelog author="rguenther@suse.com" date="1581076800">- Add vim-plugin-llvm Conflicts to clang subpackage which now
  contains files formerly in llvmN-vim-plugins, conflicting with
  packages from older llvm releases.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583582400">- Move all clang-related scripts (including those originally in
  clangX-checker), hmaptool and clang-doc into a common
  unversioned subpackage clang-tools, like python3-clang.
  The scripts reference the unversioned executables, so allowing
  multiple versions via update-alternatives would be misleading.
  The clang-doc executable will come with assets in Clang 10, so
  we have to take it out of update-alternatives as well.
  This should be the proper solution to boo#1161873.
- Include run-find-all-symbols script in clang-tools.
- Remove metadata for clangX-include-fixer subpackage that never
  had any files and thus wasn't released as rpm. There are so many
  clang binaries that packaging them separately doesn't scale.
- Fix lldb version string, adapt lldb-cmake.patch (boo#1165517).
- Remove unneccesary libtool dependency.
- Don't let clang depend on libc++, we link it with libstdc++.
- Recommend gold plugin if clang and gold are installed.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583928000">- Require clang-tools for clangX-devel.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1584964800">- Remove conflicts of clang-tools with {clang,llvm}{7,8}: the
  relevant binaries have been removed from those packages. This
  allows having clang-tools together with older versions of llvm.
  For a smooth installation we add OrderWithRequires dependencies.
- Fix typos in (still inactive) !%{with clang_scripts} part.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1585051200">- Update to version 10.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/10.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-ifs, llvm-install-name-tool, llvm-reduce.
  * New Clang tools: clang-move, clang-offload-wrapper, pp-trace.
  * lldb-mi moved to a separate project and is no longer available.
- Dropped obsolete patches:
  * clang-fix-powerpc-triplet.patch
  * clang-riscv64-rv64gc.diff
  * compiler-rt-move-fdp.patch
  * compiler-rt-sanitizer-ipc-perm.patch
  * D60657-riscv-pcrel_lo.diff
  * gwp-asan-lto.patch
  * libcxx-tests-linux-distribution.patch
  * link-lldb-shared.patch
  * llvm-riscv64-fix-cffi.diff
  * openmp-export-fini.patch
  * riscv-eh-frame-fixup.patch
  * riscv64-suse-linux.patch
- Rebased patches:
  * assume-opensuse.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
  * lto-disable-cache.patch
  * polly-pthread.patch
  * tests-use-python3.patch
- Add tablegen-test-link-static.patch: fix TableGenTests.
- Add ValueLattice-Add-new-state-for-undef-constants.patch: fix
  miscompilation on ppc64/s390x that was leading to test crashes.
- Enable ThinLTO on aarch64.
- Disable ThinLTO on ppc64le due to internal error in gold.
- Delete object files and static libraries from build tree in
  %install already, because debuginfo extraction happens after
  that. If we do it after %check, we run out of disk space.
- Run tests "manually", because we've already removed many targets.
- Don't build unit tests, because some of them are now statically
  linked, which is very expensive with LTO. Also unit tests are
  probably not very interesting on the distribution level, we don't
  expect them to perform different than in upstream. The relevant
  upstream change for this is https://reviews.llvm.org/D54439.
- Drop %if for openSUSE 13.2.</changelog>
  <changelog author="idonmez@suse.com" date="1592913600">- Add lld-default-sha1.patch to make lld generate SHA1 build-ids by
  default, otherwise our tools cannot process the debuginfo.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1594555200">- Factor out computation of the number of jobs into a macro.
- Choose mem_per_compile_job dependent on build stage, let stage 1
  on x86_64 use more memory.
- More generous memory allocation on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1595419200">- Update to version 10.0.1.
  * This release contains bug-fixes for the LLVM 10.0.0 release.
    This release is API and ABI compatible with 10.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Replace ValueLattice-Add-new-state-for-undef-constants.patch,
  which landed upstream in a modified version, by
  restore-llvm10-abi.patch that resets the ABI to our 10.0.0.
- Rewrite lld-default-sha1.patch to be version-independent.
- Set flags consistently, so that we don't lose -DNDEBUG on 32-bit
  architectures. Also we don't need the opt flags twice. This leads
  to a significant reduction in binary sizes on 32-bit arches.
- Make it easier to package release candidates.
- Enable most tests on 32-bit ARM, but not for libcxx.
- Add fix-atomics-test.patch for architectures where native atomics
  are not available.
- Lower build constraints for riscv64 a bit to allow building on
  more workers.
- Allow more compile jobs in stage 2.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1596110400">- Add ld.lld as an alternative for ld. (boo#1174656)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603108800">- Update to version 11.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/11.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-gsymutil, llvm-ml.
  * clang-import-test was removed.
- Drop obsolete patches:
  * clang-ignore-stack-clash-protector.patch
  * fix-atomics-test.patch
  * restore-llvm10-abi.patch
- Rebase patches:
  * clang-resourcedirs.patch
  * default-to-i586.patch
  * link-clang-shared.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Add llvm-exegesis-link-dylib.patch: link llvm-exegesis with
  libLLVM.so, the advanced functionality is not available anyway.
- Remove -fstack-clash-protection on architectures where it isn't
  actually supported, because that prevents feature detection.
- Make sure we also build AttributeReference for the documentation.
  This requires building via CMake. Also shorten the paths.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603540800">- Disable ThinLTO on aarch64 because of hangs. (boo#1178070)
- Enable ThinLTO on ppc64 and ppc64le, the internal error is gone.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1605355200">- Let CMake files in {llvm,clang}X-devel refer to the versioned
  binaries that come with the package instead of the symlink
  managed by update-alternatives. (boo#1178513)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1606132800">- Add compiler-rt-dont-compile-assembly-files-as-c.patch to fix
  build failure with newer CMake versions.</changelog>
  <changelog author="schwab@suse.de" date="1607947200">- polly-pthread.patch: Remove, std::call_once no longer needs libpthread</changelog>
  <changelog author="gmbr3@opensuse.org" date="1609502400">- Move BFD plugins to %{_libdir}</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1609934400">- Increase required RAM for aarch64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1610193600">- Update to version 11.0.1.
  * This release contains bug-fixes for the LLVM 11.0.0 release.
    This release is API and ABI compatible with 11.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Drop obsolete compiler-rt-dont-compile-assembly-files-as-c.patch.
- Make documentation tarballs more reproducible.</changelog>
  <changelog author="rguenther@suse.com" date="1664280000">- Add llvm-testsuite-keep-DFLTCC.patch to keep DFLTCC environment
  during testing so we can disable the compression facility on
  s390x which causes testsuite issues.  [bsc#1189602]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1669809600">- Drop RUNPATH from packaged binaries, instead set LD_LIBRARY_PATH
  for building and testing to simulate behavior of actual package.
  [bsc#1197773 , backported from OBS devel revision 25]
- Propagate the complete host environment to the tests run. This
  ensures that all envvars needed e.g. for the compiler to work
  correctly are present. This run libc++ tests successfully getting the env
  LD_LIBRARY_PATH, otherwise, library were not found.
  [llvm-propagate-host-env-to-libc++-test-suite.patch]</changelog>
</package>
<package pkgid="c45bf328bd38e5ce64f23a9a97ff3243d1ac4a804482391eec227e0a72e7cd59" name="clang11-devel" arch="aarch64">
  <version epoch="0" ver="11.0.1" rel="150300.3.8.1"/>
  <changelog author="rguenther@suse.com" date="1580990400">- Add back emacs-llvm Provides and Conflicts to clang subpackage
  originally in llvm-emacs-plugins to properly conflict with
  llvm-emacs-plugins from older llvm releases.</changelog>
  <changelog author="rguenther@suse.com" date="1581076800">- Add vim-plugin-llvm Conflicts to clang subpackage which now
  contains files formerly in llvmN-vim-plugins, conflicting with
  packages from older llvm releases.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583582400">- Move all clang-related scripts (including those originally in
  clangX-checker), hmaptool and clang-doc into a common
  unversioned subpackage clang-tools, like python3-clang.
  The scripts reference the unversioned executables, so allowing
  multiple versions via update-alternatives would be misleading.
  The clang-doc executable will come with assets in Clang 10, so
  we have to take it out of update-alternatives as well.
  This should be the proper solution to boo#1161873.
- Include run-find-all-symbols script in clang-tools.
- Remove metadata for clangX-include-fixer subpackage that never
  had any files and thus wasn't released as rpm. There are so many
  clang binaries that packaging them separately doesn't scale.
- Fix lldb version string, adapt lldb-cmake.patch (boo#1165517).
- Remove unneccesary libtool dependency.
- Don't let clang depend on libc++, we link it with libstdc++.
- Recommend gold plugin if clang and gold are installed.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583928000">- Require clang-tools for clangX-devel.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1584964800">- Remove conflicts of clang-tools with {clang,llvm}{7,8}: the
  relevant binaries have been removed from those packages. This
  allows having clang-tools together with older versions of llvm.
  For a smooth installation we add OrderWithRequires dependencies.
- Fix typos in (still inactive) !%{with clang_scripts} part.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1585051200">- Update to version 10.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/10.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-ifs, llvm-install-name-tool, llvm-reduce.
  * New Clang tools: clang-move, clang-offload-wrapper, pp-trace.
  * lldb-mi moved to a separate project and is no longer available.
- Dropped obsolete patches:
  * clang-fix-powerpc-triplet.patch
  * clang-riscv64-rv64gc.diff
  * compiler-rt-move-fdp.patch
  * compiler-rt-sanitizer-ipc-perm.patch
  * D60657-riscv-pcrel_lo.diff
  * gwp-asan-lto.patch
  * libcxx-tests-linux-distribution.patch
  * link-lldb-shared.patch
  * llvm-riscv64-fix-cffi.diff
  * openmp-export-fini.patch
  * riscv-eh-frame-fixup.patch
  * riscv64-suse-linux.patch
- Rebased patches:
  * assume-opensuse.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
  * lto-disable-cache.patch
  * polly-pthread.patch
  * tests-use-python3.patch
- Add tablegen-test-link-static.patch: fix TableGenTests.
- Add ValueLattice-Add-new-state-for-undef-constants.patch: fix
  miscompilation on ppc64/s390x that was leading to test crashes.
- Enable ThinLTO on aarch64.
- Disable ThinLTO on ppc64le due to internal error in gold.
- Delete object files and static libraries from build tree in
  %install already, because debuginfo extraction happens after
  that. If we do it after %check, we run out of disk space.
- Run tests "manually", because we've already removed many targets.
- Don't build unit tests, because some of them are now statically
  linked, which is very expensive with LTO. Also unit tests are
  probably not very interesting on the distribution level, we don't
  expect them to perform different than in upstream. The relevant
  upstream change for this is https://reviews.llvm.org/D54439.
- Drop %if for openSUSE 13.2.</changelog>
  <changelog author="idonmez@suse.com" date="1592913600">- Add lld-default-sha1.patch to make lld generate SHA1 build-ids by
  default, otherwise our tools cannot process the debuginfo.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1594555200">- Factor out computation of the number of jobs into a macro.
- Choose mem_per_compile_job dependent on build stage, let stage 1
  on x86_64 use more memory.
- More generous memory allocation on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1595419200">- Update to version 10.0.1.
  * This release contains bug-fixes for the LLVM 10.0.0 release.
    This release is API and ABI compatible with 10.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Replace ValueLattice-Add-new-state-for-undef-constants.patch,
  which landed upstream in a modified version, by
  restore-llvm10-abi.patch that resets the ABI to our 10.0.0.
- Rewrite lld-default-sha1.patch to be version-independent.
- Set flags consistently, so that we don't lose -DNDEBUG on 32-bit
  architectures. Also we don't need the opt flags twice. This leads
  to a significant reduction in binary sizes on 32-bit arches.
- Make it easier to package release candidates.
- Enable most tests on 32-bit ARM, but not for libcxx.
- Add fix-atomics-test.patch for architectures where native atomics
  are not available.
- Lower build constraints for riscv64 a bit to allow building on
  more workers.
- Allow more compile jobs in stage 2.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1596110400">- Add ld.lld as an alternative for ld. (boo#1174656)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603108800">- Update to version 11.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/11.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-gsymutil, llvm-ml.
  * clang-import-test was removed.
- Drop obsolete patches:
  * clang-ignore-stack-clash-protector.patch
  * fix-atomics-test.patch
  * restore-llvm10-abi.patch
- Rebase patches:
  * clang-resourcedirs.patch
  * default-to-i586.patch
  * link-clang-shared.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Add llvm-exegesis-link-dylib.patch: link llvm-exegesis with
  libLLVM.so, the advanced functionality is not available anyway.
- Remove -fstack-clash-protection on architectures where it isn't
  actually supported, because that prevents feature detection.
- Make sure we also build AttributeReference for the documentation.
  This requires building via CMake. Also shorten the paths.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603540800">- Disable ThinLTO on aarch64 because of hangs. (boo#1178070)
- Enable ThinLTO on ppc64 and ppc64le, the internal error is gone.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1605355200">- Let CMake files in {llvm,clang}X-devel refer to the versioned
  binaries that come with the package instead of the symlink
  managed by update-alternatives. (boo#1178513)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1606132800">- Add compiler-rt-dont-compile-assembly-files-as-c.patch to fix
  build failure with newer CMake versions.</changelog>
  <changelog author="schwab@suse.de" date="1607947200">- polly-pthread.patch: Remove, std::call_once no longer needs libpthread</changelog>
  <changelog author="gmbr3@opensuse.org" date="1609502400">- Move BFD plugins to %{_libdir}</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1609934400">- Increase required RAM for aarch64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1610193600">- Update to version 11.0.1.
  * This release contains bug-fixes for the LLVM 11.0.0 release.
    This release is API and ABI compatible with 11.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Drop obsolete compiler-rt-dont-compile-assembly-files-as-c.patch.
- Make documentation tarballs more reproducible.</changelog>
  <changelog author="rguenther@suse.com" date="1664280000">- Add llvm-testsuite-keep-DFLTCC.patch to keep DFLTCC environment
  during testing so we can disable the compression facility on
  s390x which causes testsuite issues.  [bsc#1189602]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1669809600">- Drop RUNPATH from packaged binaries, instead set LD_LIBRARY_PATH
  for building and testing to simulate behavior of actual package.
  [bsc#1197773 , backported from OBS devel revision 25]
- Propagate the complete host environment to the tests run. This
  ensures that all envvars needed e.g. for the compiler to work
  correctly are present. This run libc++ tests successfully getting the env
  LD_LIBRARY_PATH, otherwise, library were not found.
  [llvm-propagate-host-env-to-libc++-test-suite.patch]</changelog>
</package>
<package pkgid="62552548e161680dcaadf7a73d60e20de8ed7f5037a65fa146af8ab283e1aaf0" name="clang11-devel" arch="ppc64le">
  <version epoch="0" ver="11.0.1" rel="150300.3.8.1"/>
  <changelog author="rguenther@suse.com" date="1580990400">- Add back emacs-llvm Provides and Conflicts to clang subpackage
  originally in llvm-emacs-plugins to properly conflict with
  llvm-emacs-plugins from older llvm releases.</changelog>
  <changelog author="rguenther@suse.com" date="1581076800">- Add vim-plugin-llvm Conflicts to clang subpackage which now
  contains files formerly in llvmN-vim-plugins, conflicting with
  packages from older llvm releases.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583582400">- Move all clang-related scripts (including those originally in
  clangX-checker), hmaptool and clang-doc into a common
  unversioned subpackage clang-tools, like python3-clang.
  The scripts reference the unversioned executables, so allowing
  multiple versions via update-alternatives would be misleading.
  The clang-doc executable will come with assets in Clang 10, so
  we have to take it out of update-alternatives as well.
  This should be the proper solution to boo#1161873.
- Include run-find-all-symbols script in clang-tools.
- Remove metadata for clangX-include-fixer subpackage that never
  had any files and thus wasn't released as rpm. There are so many
  clang binaries that packaging them separately doesn't scale.
- Fix lldb version string, adapt lldb-cmake.patch (boo#1165517).
- Remove unneccesary libtool dependency.
- Don't let clang depend on libc++, we link it with libstdc++.
- Recommend gold plugin if clang and gold are installed.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583928000">- Require clang-tools for clangX-devel.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1584964800">- Remove conflicts of clang-tools with {clang,llvm}{7,8}: the
  relevant binaries have been removed from those packages. This
  allows having clang-tools together with older versions of llvm.
  For a smooth installation we add OrderWithRequires dependencies.
- Fix typos in (still inactive) !%{with clang_scripts} part.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1585051200">- Update to version 10.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/10.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-ifs, llvm-install-name-tool, llvm-reduce.
  * New Clang tools: clang-move, clang-offload-wrapper, pp-trace.
  * lldb-mi moved to a separate project and is no longer available.
- Dropped obsolete patches:
  * clang-fix-powerpc-triplet.patch
  * clang-riscv64-rv64gc.diff
  * compiler-rt-move-fdp.patch
  * compiler-rt-sanitizer-ipc-perm.patch
  * D60657-riscv-pcrel_lo.diff
  * gwp-asan-lto.patch
  * libcxx-tests-linux-distribution.patch
  * link-lldb-shared.patch
  * llvm-riscv64-fix-cffi.diff
  * openmp-export-fini.patch
  * riscv-eh-frame-fixup.patch
  * riscv64-suse-linux.patch
- Rebased patches:
  * assume-opensuse.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
  * lto-disable-cache.patch
  * polly-pthread.patch
  * tests-use-python3.patch
- Add tablegen-test-link-static.patch: fix TableGenTests.
- Add ValueLattice-Add-new-state-for-undef-constants.patch: fix
  miscompilation on ppc64/s390x that was leading to test crashes.
- Enable ThinLTO on aarch64.
- Disable ThinLTO on ppc64le due to internal error in gold.
- Delete object files and static libraries from build tree in
  %install already, because debuginfo extraction happens after
  that. If we do it after %check, we run out of disk space.
- Run tests "manually", because we've already removed many targets.
- Don't build unit tests, because some of them are now statically
  linked, which is very expensive with LTO. Also unit tests are
  probably not very interesting on the distribution level, we don't
  expect them to perform different than in upstream. The relevant
  upstream change for this is https://reviews.llvm.org/D54439.
- Drop %if for openSUSE 13.2.</changelog>
  <changelog author="idonmez@suse.com" date="1592913600">- Add lld-default-sha1.patch to make lld generate SHA1 build-ids by
  default, otherwise our tools cannot process the debuginfo.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1594555200">- Factor out computation of the number of jobs into a macro.
- Choose mem_per_compile_job dependent on build stage, let stage 1
  on x86_64 use more memory.
- More generous memory allocation on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1595419200">- Update to version 10.0.1.
  * This release contains bug-fixes for the LLVM 10.0.0 release.
    This release is API and ABI compatible with 10.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Replace ValueLattice-Add-new-state-for-undef-constants.patch,
  which landed upstream in a modified version, by
  restore-llvm10-abi.patch that resets the ABI to our 10.0.0.
- Rewrite lld-default-sha1.patch to be version-independent.
- Set flags consistently, so that we don't lose -DNDEBUG on 32-bit
  architectures. Also we don't need the opt flags twice. This leads
  to a significant reduction in binary sizes on 32-bit arches.
- Make it easier to package release candidates.
- Enable most tests on 32-bit ARM, but not for libcxx.
- Add fix-atomics-test.patch for architectures where native atomics
  are not available.
- Lower build constraints for riscv64 a bit to allow building on
  more workers.
- Allow more compile jobs in stage 2.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1596110400">- Add ld.lld as an alternative for ld. (boo#1174656)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603108800">- Update to version 11.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/11.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-gsymutil, llvm-ml.
  * clang-import-test was removed.
- Drop obsolete patches:
  * clang-ignore-stack-clash-protector.patch
  * fix-atomics-test.patch
  * restore-llvm10-abi.patch
- Rebase patches:
  * clang-resourcedirs.patch
  * default-to-i586.patch
  * link-clang-shared.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Add llvm-exegesis-link-dylib.patch: link llvm-exegesis with
  libLLVM.so, the advanced functionality is not available anyway.
- Remove -fstack-clash-protection on architectures where it isn't
  actually supported, because that prevents feature detection.
- Make sure we also build AttributeReference for the documentation.
  This requires building via CMake. Also shorten the paths.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603540800">- Disable ThinLTO on aarch64 because of hangs. (boo#1178070)
- Enable ThinLTO on ppc64 and ppc64le, the internal error is gone.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1605355200">- Let CMake files in {llvm,clang}X-devel refer to the versioned
  binaries that come with the package instead of the symlink
  managed by update-alternatives. (boo#1178513)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1606132800">- Add compiler-rt-dont-compile-assembly-files-as-c.patch to fix
  build failure with newer CMake versions.</changelog>
  <changelog author="schwab@suse.de" date="1607947200">- polly-pthread.patch: Remove, std::call_once no longer needs libpthread</changelog>
  <changelog author="gmbr3@opensuse.org" date="1609502400">- Move BFD plugins to %{_libdir}</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1609934400">- Increase required RAM for aarch64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1610193600">- Update to version 11.0.1.
  * This release contains bug-fixes for the LLVM 11.0.0 release.
    This release is API and ABI compatible with 11.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Drop obsolete compiler-rt-dont-compile-assembly-files-as-c.patch.
- Make documentation tarballs more reproducible.</changelog>
  <changelog author="rguenther@suse.com" date="1664280000">- Add llvm-testsuite-keep-DFLTCC.patch to keep DFLTCC environment
  during testing so we can disable the compression facility on
  s390x which causes testsuite issues.  [bsc#1189602]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1669809600">- Drop RUNPATH from packaged binaries, instead set LD_LIBRARY_PATH
  for building and testing to simulate behavior of actual package.
  [bsc#1197773 , backported from OBS devel revision 25]
- Propagate the complete host environment to the tests run. This
  ensures that all envvars needed e.g. for the compiler to work
  correctly are present. This run libc++ tests successfully getting the env
  LD_LIBRARY_PATH, otherwise, library were not found.
  [llvm-propagate-host-env-to-libc++-test-suite.patch]</changelog>
</package>
<package pkgid="fbacffa00b0926aafcc5121dbeaf873eec3b199139fc49cf6f2a6a36f40636b1" name="clang11-devel" arch="s390x">
  <version epoch="0" ver="11.0.1" rel="150300.3.8.1"/>
  <changelog author="rguenther@suse.com" date="1580990400">- Add back emacs-llvm Provides and Conflicts to clang subpackage
  originally in llvm-emacs-plugins to properly conflict with
  llvm-emacs-plugins from older llvm releases.</changelog>
  <changelog author="rguenther@suse.com" date="1581076800">- Add vim-plugin-llvm Conflicts to clang subpackage which now
  contains files formerly in llvmN-vim-plugins, conflicting with
  packages from older llvm releases.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583582400">- Move all clang-related scripts (including those originally in
  clangX-checker), hmaptool and clang-doc into a common
  unversioned subpackage clang-tools, like python3-clang.
  The scripts reference the unversioned executables, so allowing
  multiple versions via update-alternatives would be misleading.
  The clang-doc executable will come with assets in Clang 10, so
  we have to take it out of update-alternatives as well.
  This should be the proper solution to boo#1161873.
- Include run-find-all-symbols script in clang-tools.
- Remove metadata for clangX-include-fixer subpackage that never
  had any files and thus wasn't released as rpm. There are so many
  clang binaries that packaging them separately doesn't scale.
- Fix lldb version string, adapt lldb-cmake.patch (boo#1165517).
- Remove unneccesary libtool dependency.
- Don't let clang depend on libc++, we link it with libstdc++.
- Recommend gold plugin if clang and gold are installed.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583928000">- Require clang-tools for clangX-devel.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1584964800">- Remove conflicts of clang-tools with {clang,llvm}{7,8}: the
  relevant binaries have been removed from those packages. This
  allows having clang-tools together with older versions of llvm.
  For a smooth installation we add OrderWithRequires dependencies.
- Fix typos in (still inactive) !%{with clang_scripts} part.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1585051200">- Update to version 10.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/10.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-ifs, llvm-install-name-tool, llvm-reduce.
  * New Clang tools: clang-move, clang-offload-wrapper, pp-trace.
  * lldb-mi moved to a separate project and is no longer available.
- Dropped obsolete patches:
  * clang-fix-powerpc-triplet.patch
  * clang-riscv64-rv64gc.diff
  * compiler-rt-move-fdp.patch
  * compiler-rt-sanitizer-ipc-perm.patch
  * D60657-riscv-pcrel_lo.diff
  * gwp-asan-lto.patch
  * libcxx-tests-linux-distribution.patch
  * link-lldb-shared.patch
  * llvm-riscv64-fix-cffi.diff
  * openmp-export-fini.patch
  * riscv-eh-frame-fixup.patch
  * riscv64-suse-linux.patch
- Rebased patches:
  * assume-opensuse.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
  * lto-disable-cache.patch
  * polly-pthread.patch
  * tests-use-python3.patch
- Add tablegen-test-link-static.patch: fix TableGenTests.
- Add ValueLattice-Add-new-state-for-undef-constants.patch: fix
  miscompilation on ppc64/s390x that was leading to test crashes.
- Enable ThinLTO on aarch64.
- Disable ThinLTO on ppc64le due to internal error in gold.
- Delete object files and static libraries from build tree in
  %install already, because debuginfo extraction happens after
  that. If we do it after %check, we run out of disk space.
- Run tests "manually", because we've already removed many targets.
- Don't build unit tests, because some of them are now statically
  linked, which is very expensive with LTO. Also unit tests are
  probably not very interesting on the distribution level, we don't
  expect them to perform different than in upstream. The relevant
  upstream change for this is https://reviews.llvm.org/D54439.
- Drop %if for openSUSE 13.2.</changelog>
  <changelog author="idonmez@suse.com" date="1592913600">- Add lld-default-sha1.patch to make lld generate SHA1 build-ids by
  default, otherwise our tools cannot process the debuginfo.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1594555200">- Factor out computation of the number of jobs into a macro.
- Choose mem_per_compile_job dependent on build stage, let stage 1
  on x86_64 use more memory.
- More generous memory allocation on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1595419200">- Update to version 10.0.1.
  * This release contains bug-fixes for the LLVM 10.0.0 release.
    This release is API and ABI compatible with 10.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Replace ValueLattice-Add-new-state-for-undef-constants.patch,
  which landed upstream in a modified version, by
  restore-llvm10-abi.patch that resets the ABI to our 10.0.0.
- Rewrite lld-default-sha1.patch to be version-independent.
- Set flags consistently, so that we don't lose -DNDEBUG on 32-bit
  architectures. Also we don't need the opt flags twice. This leads
  to a significant reduction in binary sizes on 32-bit arches.
- Make it easier to package release candidates.
- Enable most tests on 32-bit ARM, but not for libcxx.
- Add fix-atomics-test.patch for architectures where native atomics
  are not available.
- Lower build constraints for riscv64 a bit to allow building on
  more workers.
- Allow more compile jobs in stage 2.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1596110400">- Add ld.lld as an alternative for ld. (boo#1174656)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603108800">- Update to version 11.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/11.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-gsymutil, llvm-ml.
  * clang-import-test was removed.
- Drop obsolete patches:
  * clang-ignore-stack-clash-protector.patch
  * fix-atomics-test.patch
  * restore-llvm10-abi.patch
- Rebase patches:
  * clang-resourcedirs.patch
  * default-to-i586.patch
  * link-clang-shared.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Add llvm-exegesis-link-dylib.patch: link llvm-exegesis with
  libLLVM.so, the advanced functionality is not available anyway.
- Remove -fstack-clash-protection on architectures where it isn't
  actually supported, because that prevents feature detection.
- Make sure we also build AttributeReference for the documentation.
  This requires building via CMake. Also shorten the paths.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603540800">- Disable ThinLTO on aarch64 because of hangs. (boo#1178070)
- Enable ThinLTO on ppc64 and ppc64le, the internal error is gone.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1605355200">- Let CMake files in {llvm,clang}X-devel refer to the versioned
  binaries that come with the package instead of the symlink
  managed by update-alternatives. (boo#1178513)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1606132800">- Add compiler-rt-dont-compile-assembly-files-as-c.patch to fix
  build failure with newer CMake versions.</changelog>
  <changelog author="schwab@suse.de" date="1607947200">- polly-pthread.patch: Remove, std::call_once no longer needs libpthread</changelog>
  <changelog author="gmbr3@opensuse.org" date="1609502400">- Move BFD plugins to %{_libdir}</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1609934400">- Increase required RAM for aarch64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1610193600">- Update to version 11.0.1.
  * This release contains bug-fixes for the LLVM 11.0.0 release.
    This release is API and ABI compatible with 11.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Drop obsolete compiler-rt-dont-compile-assembly-files-as-c.patch.
- Make documentation tarballs more reproducible.</changelog>
  <changelog author="rguenther@suse.com" date="1664280000">- Add llvm-testsuite-keep-DFLTCC.patch to keep DFLTCC environment
  during testing so we can disable the compression facility on
  s390x which causes testsuite issues.  [bsc#1189602]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1669809600">- Drop RUNPATH from packaged binaries, instead set LD_LIBRARY_PATH
  for building and testing to simulate behavior of actual package.
  [bsc#1197773 , backported from OBS devel revision 25]
- Propagate the complete host environment to the tests run. This
  ensures that all envvars needed e.g. for the compiler to work
  correctly are present. This run libc++ tests successfully getting the env
  LD_LIBRARY_PATH, otherwise, library were not found.
  [llvm-propagate-host-env-to-libc++-test-suite.patch]</changelog>
</package>
<package pkgid="2172378613ecefa39c522b9597d81ab0a83f566941964ec142440e49ea53e171" name="clang11-devel" arch="x86_64">
  <version epoch="0" ver="11.0.1" rel="150300.3.8.1"/>
  <changelog author="rguenther@suse.com" date="1580990400">- Add back emacs-llvm Provides and Conflicts to clang subpackage
  originally in llvm-emacs-plugins to properly conflict with
  llvm-emacs-plugins from older llvm releases.</changelog>
  <changelog author="rguenther@suse.com" date="1581076800">- Add vim-plugin-llvm Conflicts to clang subpackage which now
  contains files formerly in llvmN-vim-plugins, conflicting with
  packages from older llvm releases.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583582400">- Move all clang-related scripts (including those originally in
  clangX-checker), hmaptool and clang-doc into a common
  unversioned subpackage clang-tools, like python3-clang.
  The scripts reference the unversioned executables, so allowing
  multiple versions via update-alternatives would be misleading.
  The clang-doc executable will come with assets in Clang 10, so
  we have to take it out of update-alternatives as well.
  This should be the proper solution to boo#1161873.
- Include run-find-all-symbols script in clang-tools.
- Remove metadata for clangX-include-fixer subpackage that never
  had any files and thus wasn't released as rpm. There are so many
  clang binaries that packaging them separately doesn't scale.
- Fix lldb version string, adapt lldb-cmake.patch (boo#1165517).
- Remove unneccesary libtool dependency.
- Don't let clang depend on libc++, we link it with libstdc++.
- Recommend gold plugin if clang and gold are installed.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583928000">- Require clang-tools for clangX-devel.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1584964800">- Remove conflicts of clang-tools with {clang,llvm}{7,8}: the
  relevant binaries have been removed from those packages. This
  allows having clang-tools together with older versions of llvm.
  For a smooth installation we add OrderWithRequires dependencies.
- Fix typos in (still inactive) !%{with clang_scripts} part.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1585051200">- Update to version 10.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/10.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-ifs, llvm-install-name-tool, llvm-reduce.
  * New Clang tools: clang-move, clang-offload-wrapper, pp-trace.
  * lldb-mi moved to a separate project and is no longer available.
- Dropped obsolete patches:
  * clang-fix-powerpc-triplet.patch
  * clang-riscv64-rv64gc.diff
  * compiler-rt-move-fdp.patch
  * compiler-rt-sanitizer-ipc-perm.patch
  * D60657-riscv-pcrel_lo.diff
  * gwp-asan-lto.patch
  * libcxx-tests-linux-distribution.patch
  * link-lldb-shared.patch
  * llvm-riscv64-fix-cffi.diff
  * openmp-export-fini.patch
  * riscv-eh-frame-fixup.patch
  * riscv64-suse-linux.patch
- Rebased patches:
  * assume-opensuse.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
  * lto-disable-cache.patch
  * polly-pthread.patch
  * tests-use-python3.patch
- Add tablegen-test-link-static.patch: fix TableGenTests.
- Add ValueLattice-Add-new-state-for-undef-constants.patch: fix
  miscompilation on ppc64/s390x that was leading to test crashes.
- Enable ThinLTO on aarch64.
- Disable ThinLTO on ppc64le due to internal error in gold.
- Delete object files and static libraries from build tree in
  %install already, because debuginfo extraction happens after
  that. If we do it after %check, we run out of disk space.
- Run tests "manually", because we've already removed many targets.
- Don't build unit tests, because some of them are now statically
  linked, which is very expensive with LTO. Also unit tests are
  probably not very interesting on the distribution level, we don't
  expect them to perform different than in upstream. The relevant
  upstream change for this is https://reviews.llvm.org/D54439.
- Drop %if for openSUSE 13.2.</changelog>
  <changelog author="idonmez@suse.com" date="1592913600">- Add lld-default-sha1.patch to make lld generate SHA1 build-ids by
  default, otherwise our tools cannot process the debuginfo.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1594555200">- Factor out computation of the number of jobs into a macro.
- Choose mem_per_compile_job dependent on build stage, let stage 1
  on x86_64 use more memory.
- More generous memory allocation on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1595419200">- Update to version 10.0.1.
  * This release contains bug-fixes for the LLVM 10.0.0 release.
    This release is API and ABI compatible with 10.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Replace ValueLattice-Add-new-state-for-undef-constants.patch,
  which landed upstream in a modified version, by
  restore-llvm10-abi.patch that resets the ABI to our 10.0.0.
- Rewrite lld-default-sha1.patch to be version-independent.
- Set flags consistently, so that we don't lose -DNDEBUG on 32-bit
  architectures. Also we don't need the opt flags twice. This leads
  to a significant reduction in binary sizes on 32-bit arches.
- Make it easier to package release candidates.
- Enable most tests on 32-bit ARM, but not for libcxx.
- Add fix-atomics-test.patch for architectures where native atomics
  are not available.
- Lower build constraints for riscv64 a bit to allow building on
  more workers.
- Allow more compile jobs in stage 2.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1596110400">- Add ld.lld as an alternative for ld. (boo#1174656)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603108800">- Update to version 11.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/11.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-gsymutil, llvm-ml.
  * clang-import-test was removed.
- Drop obsolete patches:
  * clang-ignore-stack-clash-protector.patch
  * fix-atomics-test.patch
  * restore-llvm10-abi.patch
- Rebase patches:
  * clang-resourcedirs.patch
  * default-to-i586.patch
  * link-clang-shared.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Add llvm-exegesis-link-dylib.patch: link llvm-exegesis with
  libLLVM.so, the advanced functionality is not available anyway.
- Remove -fstack-clash-protection on architectures where it isn't
  actually supported, because that prevents feature detection.
- Make sure we also build AttributeReference for the documentation.
  This requires building via CMake. Also shorten the paths.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603540800">- Disable ThinLTO on aarch64 because of hangs. (boo#1178070)
- Enable ThinLTO on ppc64 and ppc64le, the internal error is gone.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1605355200">- Let CMake files in {llvm,clang}X-devel refer to the versioned
  binaries that come with the package instead of the symlink
  managed by update-alternatives. (boo#1178513)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1606132800">- Add compiler-rt-dont-compile-assembly-files-as-c.patch to fix
  build failure with newer CMake versions.</changelog>
  <changelog author="schwab@suse.de" date="1607947200">- polly-pthread.patch: Remove, std::call_once no longer needs libpthread</changelog>
  <changelog author="gmbr3@opensuse.org" date="1609502400">- Move BFD plugins to %{_libdir}</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1609934400">- Increase required RAM for aarch64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1610193600">- Update to version 11.0.1.
  * This release contains bug-fixes for the LLVM 11.0.0 release.
    This release is API and ABI compatible with 11.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Drop obsolete compiler-rt-dont-compile-assembly-files-as-c.patch.
- Make documentation tarballs more reproducible.</changelog>
  <changelog author="rguenther@suse.com" date="1664280000">- Add llvm-testsuite-keep-DFLTCC.patch to keep DFLTCC environment
  during testing so we can disable the compression facility on
  s390x which causes testsuite issues.  [bsc#1189602]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1669809600">- Drop RUNPATH from packaged binaries, instead set LD_LIBRARY_PATH
  for building and testing to simulate behavior of actual package.
  [bsc#1197773 , backported from OBS devel revision 25]
- Propagate the complete host environment to the tests run. This
  ensures that all envvars needed e.g. for the compiler to work
  correctly are present. This run libc++ tests successfully getting the env
  LD_LIBRARY_PATH, otherwise, library were not found.
  [llvm-propagate-host-env-to-libc++-test-suite.patch]</changelog>
</package>
<package pkgid="a373958aa7a1aad4de538a2419e1454833a59945fc339071b272216a6a2af6d5" name="clang11-devel-32bit" arch="x86_64">
  <version epoch="0" ver="11.0.1" rel="150300.3.8.1"/>
  <changelog author="rguenther@suse.com" date="1580990400">- Add back emacs-llvm Provides and Conflicts to clang subpackage
  originally in llvm-emacs-plugins to properly conflict with
  llvm-emacs-plugins from older llvm releases.</changelog>
  <changelog author="rguenther@suse.com" date="1581076800">- Add vim-plugin-llvm Conflicts to clang subpackage which now
  contains files formerly in llvmN-vim-plugins, conflicting with
  packages from older llvm releases.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583582400">- Move all clang-related scripts (including those originally in
  clangX-checker), hmaptool and clang-doc into a common
  unversioned subpackage clang-tools, like python3-clang.
  The scripts reference the unversioned executables, so allowing
  multiple versions via update-alternatives would be misleading.
  The clang-doc executable will come with assets in Clang 10, so
  we have to take it out of update-alternatives as well.
  This should be the proper solution to boo#1161873.
- Include run-find-all-symbols script in clang-tools.
- Remove metadata for clangX-include-fixer subpackage that never
  had any files and thus wasn't released as rpm. There are so many
  clang binaries that packaging them separately doesn't scale.
- Fix lldb version string, adapt lldb-cmake.patch (boo#1165517).
- Remove unneccesary libtool dependency.
- Don't let clang depend on libc++, we link it with libstdc++.
- Recommend gold plugin if clang and gold are installed.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583928000">- Require clang-tools for clangX-devel.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1584964800">- Remove conflicts of clang-tools with {clang,llvm}{7,8}: the
  relevant binaries have been removed from those packages. This
  allows having clang-tools together with older versions of llvm.
  For a smooth installation we add OrderWithRequires dependencies.
- Fix typos in (still inactive) !%{with clang_scripts} part.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1585051200">- Update to version 10.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/10.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-ifs, llvm-install-name-tool, llvm-reduce.
  * New Clang tools: clang-move, clang-offload-wrapper, pp-trace.
  * lldb-mi moved to a separate project and is no longer available.
- Dropped obsolete patches:
  * clang-fix-powerpc-triplet.patch
  * clang-riscv64-rv64gc.diff
  * compiler-rt-move-fdp.patch
  * compiler-rt-sanitizer-ipc-perm.patch
  * D60657-riscv-pcrel_lo.diff
  * gwp-asan-lto.patch
  * libcxx-tests-linux-distribution.patch
  * link-lldb-shared.patch
  * llvm-riscv64-fix-cffi.diff
  * openmp-export-fini.patch
  * riscv-eh-frame-fixup.patch
  * riscv64-suse-linux.patch
- Rebased patches:
  * assume-opensuse.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
  * lto-disable-cache.patch
  * polly-pthread.patch
  * tests-use-python3.patch
- Add tablegen-test-link-static.patch: fix TableGenTests.
- Add ValueLattice-Add-new-state-for-undef-constants.patch: fix
  miscompilation on ppc64/s390x that was leading to test crashes.
- Enable ThinLTO on aarch64.
- Disable ThinLTO on ppc64le due to internal error in gold.
- Delete object files and static libraries from build tree in
  %install already, because debuginfo extraction happens after
  that. If we do it after %check, we run out of disk space.
- Run tests "manually", because we've already removed many targets.
- Don't build unit tests, because some of them are now statically
  linked, which is very expensive with LTO. Also unit tests are
  probably not very interesting on the distribution level, we don't
  expect them to perform different than in upstream. The relevant
  upstream change for this is https://reviews.llvm.org/D54439.
- Drop %if for openSUSE 13.2.</changelog>
  <changelog author="idonmez@suse.com" date="1592913600">- Add lld-default-sha1.patch to make lld generate SHA1 build-ids by
  default, otherwise our tools cannot process the debuginfo.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1594555200">- Factor out computation of the number of jobs into a macro.
- Choose mem_per_compile_job dependent on build stage, let stage 1
  on x86_64 use more memory.
- More generous memory allocation on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1595419200">- Update to version 10.0.1.
  * This release contains bug-fixes for the LLVM 10.0.0 release.
    This release is API and ABI compatible with 10.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Replace ValueLattice-Add-new-state-for-undef-constants.patch,
  which landed upstream in a modified version, by
  restore-llvm10-abi.patch that resets the ABI to our 10.0.0.
- Rewrite lld-default-sha1.patch to be version-independent.
- Set flags consistently, so that we don't lose -DNDEBUG on 32-bit
  architectures. Also we don't need the opt flags twice. This leads
  to a significant reduction in binary sizes on 32-bit arches.
- Make it easier to package release candidates.
- Enable most tests on 32-bit ARM, but not for libcxx.
- Add fix-atomics-test.patch for architectures where native atomics
  are not available.
- Lower build constraints for riscv64 a bit to allow building on
  more workers.
- Allow more compile jobs in stage 2.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1596110400">- Add ld.lld as an alternative for ld. (boo#1174656)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603108800">- Update to version 11.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/11.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-gsymutil, llvm-ml.
  * clang-import-test was removed.
- Drop obsolete patches:
  * clang-ignore-stack-clash-protector.patch
  * fix-atomics-test.patch
  * restore-llvm10-abi.patch
- Rebase patches:
  * clang-resourcedirs.patch
  * default-to-i586.patch
  * link-clang-shared.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Add llvm-exegesis-link-dylib.patch: link llvm-exegesis with
  libLLVM.so, the advanced functionality is not available anyway.
- Remove -fstack-clash-protection on architectures where it isn't
  actually supported, because that prevents feature detection.
- Make sure we also build AttributeReference for the documentation.
  This requires building via CMake. Also shorten the paths.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603540800">- Disable ThinLTO on aarch64 because of hangs. (boo#1178070)
- Enable ThinLTO on ppc64 and ppc64le, the internal error is gone.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1605355200">- Let CMake files in {llvm,clang}X-devel refer to the versioned
  binaries that come with the package instead of the symlink
  managed by update-alternatives. (boo#1178513)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1606132800">- Add compiler-rt-dont-compile-assembly-files-as-c.patch to fix
  build failure with newer CMake versions.</changelog>
  <changelog author="schwab@suse.de" date="1607947200">- polly-pthread.patch: Remove, std::call_once no longer needs libpthread</changelog>
  <changelog author="gmbr3@opensuse.org" date="1609502400">- Move BFD plugins to %{_libdir}</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1609934400">- Increase required RAM for aarch64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1610193600">- Update to version 11.0.1.
  * This release contains bug-fixes for the LLVM 11.0.0 release.
    This release is API and ABI compatible with 11.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Drop obsolete compiler-rt-dont-compile-assembly-files-as-c.patch.
- Make documentation tarballs more reproducible.</changelog>
  <changelog author="rguenther@suse.com" date="1664280000">- Add llvm-testsuite-keep-DFLTCC.patch to keep DFLTCC environment
  during testing so we can disable the compression facility on
  s390x which causes testsuite issues.  [bsc#1189602]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1669809600">- Drop RUNPATH from packaged binaries, instead set LD_LIBRARY_PATH
  for building and testing to simulate behavior of actual package.
  [bsc#1197773 , backported from OBS devel revision 25]
- Propagate the complete host environment to the tests run. This
  ensures that all envvars needed e.g. for the compiler to work
  correctly are present. This run libc++ tests successfully getting the env
  LD_LIBRARY_PATH, otherwise, library were not found.
  [llvm-propagate-host-env-to-libc++-test-suite.patch]</changelog>
</package>
<package pkgid="ab4605c036b4fa7dc4a111af9fb14a6706351a073cf6baccdb64e1160efa28bd" name="clang11-doc" arch="noarch">
  <version epoch="0" ver="11.0.1" rel="150300.3.8.1"/>
  <changelog author="rguenther@suse.com" date="1580990400">- Add back emacs-llvm Provides and Conflicts to clang subpackage
  originally in llvm-emacs-plugins to properly conflict with
  llvm-emacs-plugins from older llvm releases.</changelog>
  <changelog author="rguenther@suse.com" date="1581076800">- Add vim-plugin-llvm Conflicts to clang subpackage which now
  contains files formerly in llvmN-vim-plugins, conflicting with
  packages from older llvm releases.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583582400">- Move all clang-related scripts (including those originally in
  clangX-checker), hmaptool and clang-doc into a common
  unversioned subpackage clang-tools, like python3-clang.
  The scripts reference the unversioned executables, so allowing
  multiple versions via update-alternatives would be misleading.
  The clang-doc executable will come with assets in Clang 10, so
  we have to take it out of update-alternatives as well.
  This should be the proper solution to boo#1161873.
- Include run-find-all-symbols script in clang-tools.
- Remove metadata for clangX-include-fixer subpackage that never
  had any files and thus wasn't released as rpm. There are so many
  clang binaries that packaging them separately doesn't scale.
- Fix lldb version string, adapt lldb-cmake.patch (boo#1165517).
- Remove unneccesary libtool dependency.
- Don't let clang depend on libc++, we link it with libstdc++.
- Recommend gold plugin if clang and gold are installed.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583928000">- Require clang-tools for clangX-devel.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1584964800">- Remove conflicts of clang-tools with {clang,llvm}{7,8}: the
  relevant binaries have been removed from those packages. This
  allows having clang-tools together with older versions of llvm.
  For a smooth installation we add OrderWithRequires dependencies.
- Fix typos in (still inactive) !%{with clang_scripts} part.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1585051200">- Update to version 10.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/10.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-ifs, llvm-install-name-tool, llvm-reduce.
  * New Clang tools: clang-move, clang-offload-wrapper, pp-trace.
  * lldb-mi moved to a separate project and is no longer available.
- Dropped obsolete patches:
  * clang-fix-powerpc-triplet.patch
  * clang-riscv64-rv64gc.diff
  * compiler-rt-move-fdp.patch
  * compiler-rt-sanitizer-ipc-perm.patch
  * D60657-riscv-pcrel_lo.diff
  * gwp-asan-lto.patch
  * libcxx-tests-linux-distribution.patch
  * link-lldb-shared.patch
  * llvm-riscv64-fix-cffi.diff
  * openmp-export-fini.patch
  * riscv-eh-frame-fixup.patch
  * riscv64-suse-linux.patch
- Rebased patches:
  * assume-opensuse.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
  * lto-disable-cache.patch
  * polly-pthread.patch
  * tests-use-python3.patch
- Add tablegen-test-link-static.patch: fix TableGenTests.
- Add ValueLattice-Add-new-state-for-undef-constants.patch: fix
  miscompilation on ppc64/s390x that was leading to test crashes.
- Enable ThinLTO on aarch64.
- Disable ThinLTO on ppc64le due to internal error in gold.
- Delete object files and static libraries from build tree in
  %install already, because debuginfo extraction happens after
  that. If we do it after %check, we run out of disk space.
- Run tests "manually", because we've already removed many targets.
- Don't build unit tests, because some of them are now statically
  linked, which is very expensive with LTO. Also unit tests are
  probably not very interesting on the distribution level, we don't
  expect them to perform different than in upstream. The relevant
  upstream change for this is https://reviews.llvm.org/D54439.
- Drop %if for openSUSE 13.2.</changelog>
  <changelog author="idonmez@suse.com" date="1592913600">- Add lld-default-sha1.patch to make lld generate SHA1 build-ids by
  default, otherwise our tools cannot process the debuginfo.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1594555200">- Factor out computation of the number of jobs into a macro.
- Choose mem_per_compile_job dependent on build stage, let stage 1
  on x86_64 use more memory.
- More generous memory allocation on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1595419200">- Update to version 10.0.1.
  * This release contains bug-fixes for the LLVM 10.0.0 release.
    This release is API and ABI compatible with 10.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Replace ValueLattice-Add-new-state-for-undef-constants.patch,
  which landed upstream in a modified version, by
  restore-llvm10-abi.patch that resets the ABI to our 10.0.0.
- Rewrite lld-default-sha1.patch to be version-independent.
- Set flags consistently, so that we don't lose -DNDEBUG on 32-bit
  architectures. Also we don't need the opt flags twice. This leads
  to a significant reduction in binary sizes on 32-bit arches.
- Make it easier to package release candidates.
- Enable most tests on 32-bit ARM, but not for libcxx.
- Add fix-atomics-test.patch for architectures where native atomics
  are not available.
- Lower build constraints for riscv64 a bit to allow building on
  more workers.
- Allow more compile jobs in stage 2.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1596110400">- Add ld.lld as an alternative for ld. (boo#1174656)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603108800">- Update to version 11.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/11.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-gsymutil, llvm-ml.
  * clang-import-test was removed.
- Drop obsolete patches:
  * clang-ignore-stack-clash-protector.patch
  * fix-atomics-test.patch
  * restore-llvm10-abi.patch
- Rebase patches:
  * clang-resourcedirs.patch
  * default-to-i586.patch
  * link-clang-shared.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Add llvm-exegesis-link-dylib.patch: link llvm-exegesis with
  libLLVM.so, the advanced functionality is not available anyway.
- Remove -fstack-clash-protection on architectures where it isn't
  actually supported, because that prevents feature detection.
- Make sure we also build AttributeReference for the documentation.
  This requires building via CMake. Also shorten the paths.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603540800">- Disable ThinLTO on aarch64 because of hangs. (boo#1178070)
- Enable ThinLTO on ppc64 and ppc64le, the internal error is gone.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1605355200">- Let CMake files in {llvm,clang}X-devel refer to the versioned
  binaries that come with the package instead of the symlink
  managed by update-alternatives. (boo#1178513)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1606132800">- Add compiler-rt-dont-compile-assembly-files-as-c.patch to fix
  build failure with newer CMake versions.</changelog>
  <changelog author="schwab@suse.de" date="1607947200">- polly-pthread.patch: Remove, std::call_once no longer needs libpthread</changelog>
  <changelog author="gmbr3@opensuse.org" date="1609502400">- Move BFD plugins to %{_libdir}</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1609934400">- Increase required RAM for aarch64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1610193600">- Update to version 11.0.1.
  * This release contains bug-fixes for the LLVM 11.0.0 release.
    This release is API and ABI compatible with 11.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Drop obsolete compiler-rt-dont-compile-assembly-files-as-c.patch.
- Make documentation tarballs more reproducible.</changelog>
  <changelog author="rguenther@suse.com" date="1664280000">- Add llvm-testsuite-keep-DFLTCC.patch to keep DFLTCC environment
  during testing so we can disable the compression facility on
  s390x which causes testsuite issues.  [bsc#1189602]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1669809600">- Drop RUNPATH from packaged binaries, instead set LD_LIBRARY_PATH
  for building and testing to simulate behavior of actual package.
  [bsc#1197773 , backported from OBS devel revision 25]
- Propagate the complete host environment to the tests run. This
  ensures that all envvars needed e.g. for the compiler to work
  correctly are present. This run libc++ tests successfully getting the env
  LD_LIBRARY_PATH, otherwise, library were not found.
  [llvm-propagate-host-env-to-libc++-test-suite.patch]</changelog>
</package>
<package pkgid="6df836477158681db66de192b3d59ae8528c0ac72416722a5239dfd56c886cab" name="clang15" arch="aarch64">
  <version epoch="0" ver="15.0.7" rel="150500.4.11.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="f8df1e5dc3236e70a9c5c74210221db9396300a91d7c042afd6d75634bfdbe51" name="clang15" arch="ppc64le">
  <version epoch="0" ver="15.0.7" rel="150500.4.11.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="cff8951e2121b02ae7071fe4e277986415525cd6b5bf40a28f73df2a36496d56" name="clang15" arch="s390x">
  <version epoch="0" ver="15.0.7" rel="150500.4.11.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="b3d029fd87969c8a092c362eb7c3dc922c7cb2a8ddf17528a164511d48fa060c" name="clang15" arch="x86_64">
  <version epoch="0" ver="15.0.7" rel="150500.4.11.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="13d028f199e66cd4479c1c03e8eaa14c4c759770be224882a63ca4b0fa0133ed" name="clang15" arch="aarch64">
  <version epoch="0" ver="15.0.7" rel="150500.4.9.6"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="53dd147fed63d200eb705a104a9fa71e56b3d8f24d1c51786fc7fe9fedd65b22" name="clang15" arch="ppc64le">
  <version epoch="0" ver="15.0.7" rel="150500.4.9.6"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="becfa213bab11b0249ba6f06cae84bbd106225e5ef9e722d3e20614c98d302df" name="clang15" arch="s390x">
  <version epoch="0" ver="15.0.7" rel="150500.4.9.6"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="d7c4aa9d711d700394b538e050212523df0ca8ae2043cbc4ebf94c15fcbf3555" name="clang15" arch="x86_64">
  <version epoch="0" ver="15.0.7" rel="150500.4.9.6"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="b2366276e5c1eb0e95d8ec358dfd5652c69fa7d633facf8233055cdc51930934" name="clang15-devel" arch="aarch64">
  <version epoch="0" ver="15.0.7" rel="150500.4.11.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="6b1291aa8f288ec521656893ea02816bb739f89ca752b781fb3464753be099b7" name="clang15-devel" arch="ppc64le">
  <version epoch="0" ver="15.0.7" rel="150500.4.11.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="9b3bd060b1c15d1ddf552c7994c2b1c01b491ecfda0413fd59636e5d52786231" name="clang15-devel" arch="s390x">
  <version epoch="0" ver="15.0.7" rel="150500.4.11.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="3fd6bee5afee807e6f6d6c0686f8c6168a55e11ebfc2e2024be36e2d7f34bd45" name="clang15-devel" arch="x86_64">
  <version epoch="0" ver="15.0.7" rel="150500.4.11.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="8d6d5ed7cbd1be7443630c2cff06214e60fae715c2eedf1d094a37f9df5cf2f2" name="clang15-devel" arch="aarch64">
  <version epoch="0" ver="15.0.7" rel="150500.4.9.6"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="d01c311e94ba2a62676dcad13216d936df5f3c9200db90101085f153acaa8433" name="clang15-devel" arch="ppc64le">
  <version epoch="0" ver="15.0.7" rel="150500.4.9.6"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="79167cf16a7a3ae878c588302df24b237818cd214fb2c598a271ef92b0739a44" name="clang15-devel" arch="s390x">
  <version epoch="0" ver="15.0.7" rel="150500.4.9.6"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="503011da7bc6824191cc35ce6aa5336aae7e09138e8b778b1e2868fd12fe7310" name="clang15-devel" arch="x86_64">
  <version epoch="0" ver="15.0.7" rel="150500.4.9.6"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="82d05de3fe6efde7881bbc5956ce78f04c4e15b479f6e93511577c02bcad5589" name="clang15-doc" arch="noarch">
  <version epoch="0" ver="15.0.7" rel="150500.4.11.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="bcca49a7b442f8f085be402c0c6116b00004d89cbd153cd31e6b6a506de4b755" name="clang15-doc" arch="noarch">
  <version epoch="0" ver="15.0.7" rel="150500.4.9.6"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="9b41f9d7af152d86ab735e3059713aaaf1b462e0e69184271bf031da1a5f14fb" name="clang17" arch="aarch64">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="aa0e9b5659cb8b6b0a11c3b43a92df4db71d4b594cbece87d5a8243bec1aae39" name="clang17" arch="ppc64le">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="9d6dc9b63aa0a4f19c3f4ed5b347df3df40aef720ea6f00e6469736de68332bd" name="clang17" arch="s390x">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="f21d9ac4173ca52dee193db75958435506091528a8eb6eb147defddf056565fc" name="clang17" arch="x86_64">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="cc1f370a23a539da2e14f1840cd2eebe2e9af716bbe9729719aa2c6d5f35d305" name="clang17-devel" arch="aarch64">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="5aa180cfb3a4272a22b5327fc7202614787a32abdc619a97f4b261cc01604fdb" name="clang17-devel" arch="ppc64le">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="edad84247933dc6d8022ba62027966e8a69ad9b498adba5801ab84ac2f124004" name="clang17-devel" arch="s390x">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="02437eddc5a2d8436ab297f67567a2d442acb475696cf17034e436e98cd05053" name="clang17-devel" arch="x86_64">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="7f03eccda98bb6e245adc5c05d3b67c36510ff78432d97bc7c6a1b4f321051ed" name="clang17-doc" arch="noarch">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="965e2c625b4a4b67e6040639728dd70e8b81a19d77b3951a4736031f935a21a6" name="clone-master-clean-up" arch="noarch">
  <version epoch="0" ver="1.13" rel="150100.3.26.2"/>
  <changelog author="hguo@suse.com" date="1445601600">- Add clean up item: auto-generated HANA firewall script.</changelog>
  <changelog author="varkoly@suse.com" date="1449748800">- according to comment from Berthold Gunreben in comment #18 in
- FATE#318965 Allow Clone-Master creation, the random-seed files
- need to be deleted, too</changelog>
  <changelog author="hguo@suse.com" date="1452859200">- The following issues are addressed:
  * After wiping swap, the swap gets a new UUID, causing slow boot.
  * 70-persistent-net.rules is not removed.
  Along with several coding style and indentation fixes.
  (bsc#961906)</changelog>
  <changelog author="abriel@suse.com" date="1494849600">- The following changes are made to accomplish FATE#322066
  * remove some more files and directories (see man page for detailes)
  * add clone-master-clean-up.sysconfig, to give the user the possibillity for minimal intervention
  * add custom_remove.template to allow partner or customer specific removals</changelog>
  <changelog author="abriel@suse.com" date="1499342400">- The following changes are made to accomplish FATE#322066
  * Fix typos and improve man page</changelog>
  <changelog author="ro@suse.de" date="1517486400">- Prepare for new fillup location</changelog>
  <changelog author="dakechi@suse.com" date="1548849600">- Moved the configuration files out of the /var directory
  * Needed for compliance with transactional updates (bsc#1092378)</changelog>
  <changelog author="eich@suse.com" date="1564660800">- Wicked stores a number of files containing unique IDs and DHCP data
  in /var/lib/wicked/*. These files need to be removed for cloning:
  if machines with identical settings exist in the same network
  multiple times, IP addresses may change with each renewal
  (bsc#1139667)</changelog>
  <changelog author="eich@suse.com" date="1564747200">- Add _service file to fetch package form git.
  Add workaround for service osc_scm: avoid script to have the
  same name repository.</changelog>
  <changelog author="eich@suse.com" date="1565179200">- Install README.md and license file, fix build warnings.
- Fix _service-file:
  * Replace 'HEAD' version by 'master' branch:
    Right now, this project has just one single branch - track
    this as the release branch.
  * Add &lt;versionformat&gt;.</changelog>
  <changelog author="jengelh@inai.de" date="1566907200">- Use noun phrase in descriptions.</changelog>
  <changelog author="abriel@suse.com" date="1570536000">- Bump version to 1.5
- Don't show output from pushd/popd
- Make snapper snapshot removal more generic
  The output format is not really meant for machine reading, it's
  format has changed thus the simple parser broke.
  This now makes the parser more generic (using data from d-bus),
  also now it is ensured the snapshots are deleted in the correct
  order.
  (bsc#1149322)</changelog>
  <changelog author="abriel@suse.com" date="1597233600">- Bump version to 1.6
- cleanup salt client ID and osad authentication configuration
  file and the system ID
  (bsc#1174147)
- change the path of the template file in the comments of
  custom_remove.template and clone-master-clean-up.sh
  (jsc#TEAM-490)</changelog>
  <changelog author="abriel@suse.com" date="1661860800">- Bump version to 1.7
- CVE-2021-32000: fix some potentially dangerous file system
  operations
  (bsc#1181050)</changelog>
  <changelog author="varkoly@suse.com" date="1663848000">- Bump version to 1.8
- clone-master-clean-up fails to remove btrfs snapshots
  (bsc#1203651)</changelog>
  <changelog author="varkoly@suse.com" date="1663934400">- Bump version to 1.9
- [clone-master-clean-up] Cleannup initiatorname.iscsi
  Remove all no comment files
  (bsc#1203024)</changelog>
  <changelog author="varkoly@suse.com" date="1666958400">- Bump version to 1.10
- clone-master-clean-up fails if postfix is not installed (bsc#1204835)
  Check if the directory does exists.</changelog>
  <changelog author="varkoly@suse.com" date="1675771200">- Bump version to 1.11
- clone-master-clean-up fails when /etc/iscsi/initiatorname.iscsi doesn't exist
  The entire section is wrapped in a test for the existence of this file.
  (bsc#1207993)</changelog>
  <changelog author="varkoly@suse.com" date="1710849600">- Error message about 'journald.conf' (bsc#1221533)
  Check if journald.conf does exist.
- 1.12</changelog>
  <changelog author="varkoly@suse.com" date="1724500800">- clone-master-clean-up modifies fstab from UUID to /dev/sdx. (bsc#1229217)
  Introduce two command line parameters:
  - n, --dont-ask suppresses all requests.
  - f, --dont-change-fstab  Do not swap UUID and label into device name in fstab.
  Without this parameters it behaves as usual.
- 1.13</changelog>
</package>
<package pkgid="0d8c978eb92a57fc5578af3a747505f0343f799bcc2be152a1550a0589ec7f20" name="clone-master-clean-up" arch="src">
  <version epoch="0" ver="1.13" rel="150100.3.26.2"/>
  <changelog author="hguo@suse.com" date="1445601600">- Add clean up item: auto-generated HANA firewall script.</changelog>
  <changelog author="varkoly@suse.com" date="1449748800">- according to comment from Berthold Gunreben in comment #18 in
- FATE#318965 Allow Clone-Master creation, the random-seed files
- need to be deleted, too</changelog>
  <changelog author="hguo@suse.com" date="1452859200">- The following issues are addressed:
  * After wiping swap, the swap gets a new UUID, causing slow boot.
  * 70-persistent-net.rules is not removed.
  Along with several coding style and indentation fixes.
  (bsc#961906)</changelog>
  <changelog author="abriel@suse.com" date="1494849600">- The following changes are made to accomplish FATE#322066
  * remove some more files and directories (see man page for detailes)
  * add clone-master-clean-up.sysconfig, to give the user the possibillity for minimal intervention
  * add custom_remove.template to allow partner or customer specific removals</changelog>
  <changelog author="abriel@suse.com" date="1499342400">- The following changes are made to accomplish FATE#322066
  * Fix typos and improve man page</changelog>
  <changelog author="ro@suse.de" date="1517486400">- Prepare for new fillup location</changelog>
  <changelog author="dakechi@suse.com" date="1548849600">- Moved the configuration files out of the /var directory
  * Needed for compliance with transactional updates (bsc#1092378)</changelog>
  <changelog author="eich@suse.com" date="1564660800">- Wicked stores a number of files containing unique IDs and DHCP data
  in /var/lib/wicked/*. These files need to be removed for cloning:
  if machines with identical settings exist in the same network
  multiple times, IP addresses may change with each renewal
  (bsc#1139667)</changelog>
  <changelog author="eich@suse.com" date="1564747200">- Add _service file to fetch package form git.
  Add workaround for service osc_scm: avoid script to have the
  same name repository.</changelog>
  <changelog author="eich@suse.com" date="1565179200">- Install README.md and license file, fix build warnings.
- Fix _service-file:
  * Replace 'HEAD' version by 'master' branch:
    Right now, this project has just one single branch - track
    this as the release branch.
  * Add &lt;versionformat&gt;.</changelog>
  <changelog author="jengelh@inai.de" date="1566907200">- Use noun phrase in descriptions.</changelog>
  <changelog author="abriel@suse.com" date="1570536000">- Bump version to 1.5
- Don't show output from pushd/popd
- Make snapper snapshot removal more generic
  The output format is not really meant for machine reading, it's
  format has changed thus the simple parser broke.
  This now makes the parser more generic (using data from d-bus),
  also now it is ensured the snapshots are deleted in the correct
  order.
  (bsc#1149322)</changelog>
  <changelog author="abriel@suse.com" date="1597233600">- Bump version to 1.6
- cleanup salt client ID and osad authentication configuration
  file and the system ID
  (bsc#1174147)
- change the path of the template file in the comments of
  custom_remove.template and clone-master-clean-up.sh
  (jsc#TEAM-490)</changelog>
  <changelog author="abriel@suse.com" date="1661860800">- Bump version to 1.7
- CVE-2021-32000: fix some potentially dangerous file system
  operations
  (bsc#1181050)</changelog>
  <changelog author="varkoly@suse.com" date="1663848000">- Bump version to 1.8
- clone-master-clean-up fails to remove btrfs snapshots
  (bsc#1203651)</changelog>
  <changelog author="varkoly@suse.com" date="1663934400">- Bump version to 1.9
- [clone-master-clean-up] Cleannup initiatorname.iscsi
  Remove all no comment files
  (bsc#1203024)</changelog>
  <changelog author="varkoly@suse.com" date="1666958400">- Bump version to 1.10
- clone-master-clean-up fails if postfix is not installed (bsc#1204835)
  Check if the directory does exists.</changelog>
  <changelog author="varkoly@suse.com" date="1675771200">- Bump version to 1.11
- clone-master-clean-up fails when /etc/iscsi/initiatorname.iscsi doesn't exist
  The entire section is wrapped in a test for the existence of this file.
  (bsc#1207993)</changelog>
  <changelog author="varkoly@suse.com" date="1710849600">- Error message about 'journald.conf' (bsc#1221533)
  Check if journald.conf does exist.
- 1.12</changelog>
  <changelog author="varkoly@suse.com" date="1724500800">- clone-master-clean-up modifies fstab from UUID to /dev/sdx. (bsc#1229217)
  Introduce two command line parameters:
  - n, --dont-ask suppresses all requests.
  - f, --dont-change-fstab  Do not swap UUID and label into device name in fstab.
  Without this parameters it behaves as usual.
- 1.13</changelog>
</package>
<package pkgid="e02f448e3b4f41f09e822e4c0db496708790da8318f3a34d8a117c6cbd27e960" name="cloud-init" arch="aarch64">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="0d9f83e60841f3d5248a4fe2731be2369bfd9517c28ceafb80af8c71b402f91e" name="cloud-init" arch="ppc64le">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="eecac19142f7ee2d795d3ac33ed4574c06d97f52060c44fb9e116c1f31bd69b1" name="cloud-init" arch="s390x">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="96b4fcf70d3a2e40bf86acac080d9617189cc65a465d57ef8fea3d4e1e2def1b" name="cloud-init" arch="src">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="2fe568170cdc70faad398d07a75830df7ea0eb4cc6ee2feb9d72fdb700713a80" name="cloud-init" arch="x86_64">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="23d7b0f373ed8c2df3c26f43b0e9a1c0ea758c9af567e7994847af1add847925" name="cloud-init-config-suse" arch="aarch64">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="b2cc43b7475ebb68460dbb9b3abf52bd82ee6c83b70a1776365e317c99b304a2" name="cloud-init-config-suse" arch="ppc64le">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="87f5cfd26646273bb3aba72de6b1d9e121b192b83290401dace8336f7983bbf7" name="cloud-init-config-suse" arch="s390x">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="7e467efb60d9f208191636e110da38d1827d97fe5ee29e4faf4515a34cb3d366" name="cloud-init-config-suse" arch="x86_64">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="a623f3427c8995aaa853ff8ac1ac774f5ea26f749b4fbf1190b3ccb05e782d94" name="cloud-init-doc" arch="aarch64">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="b0cffe097f4e97548ec6b43d58330ba323c3c9a0c26c503138185d1caffbdd1e" name="cloud-init-doc" arch="ppc64le">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="d2b3cd8b40e0b82c511ecb5dbb01b8c9c93e9bcba1ba66a6f8c126bab114b03e" name="cloud-init-doc" arch="s390x">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="cad254a0812f7a1e50897222f1db3e0c15a4f657f05e0565cc90bcc584f7db24" name="cloud-init-doc" arch="x86_64">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="f0cd328d8891cffd15db8bee523fb6cea598864aaa8dfe5402d91c620866bb5d" name="cloud-regionsrv-client" arch="aarch64">
  <version epoch="0" ver="10.3.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="91039b015f0f50482897b159a6e26d77a27f8a942dc84f9735c067caa35d226b" name="cloud-regionsrv-client" arch="ppc64le">
  <version epoch="0" ver="10.3.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="5fda9655e65db684b9d34502cbad258dd64a49187f8fa4736481947f3db8e010" name="cloud-regionsrv-client" arch="s390x">
  <version epoch="0" ver="10.3.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="744c4d48a3c8a727967defe48a4df7eeec3773249e7acbeefd0355e46aaaa63a" name="cloud-regionsrv-client" arch="src">
  <version epoch="0" ver="10.3.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="7cef108db4915428a7f5d5a8230c529e41f64857f12efd91b167576b4f4d307a" name="cloud-regionsrv-client" arch="x86_64">
  <version epoch="0" ver="10.3.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="9bb89a6a7001b53188d4e61b360c10405a673cabfbfb699192a7cd0162085fcd" name="cloud-regionsrv-client" arch="aarch64">
  <version epoch="0" ver="10.3.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="429dd7cec423d5abfa2176b25a6b5e4f5d14fc4d80b0f15f1aa1b5516ded299b" name="cloud-regionsrv-client" arch="ppc64le">
  <version epoch="0" ver="10.3.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="cabbbad538cb978427cd5c2c261d41cac4355add617c133804812ba44bfbab60" name="cloud-regionsrv-client" arch="s390x">
  <version epoch="0" ver="10.3.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="cf541470367ecf98ecb34ff90d61a541af2dd3d9c7714e9e639efbe715ad557e" name="cloud-regionsrv-client" arch="src">
  <version epoch="0" ver="10.3.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="8d1ffcd8abe0eae20d454a9081ae9c814ab785506a9b560f2a0b32e7b2f21a53" name="cloud-regionsrv-client" arch="x86_64">
  <version epoch="0" ver="10.3.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="549fa02f39f7eeb27347f486cb14ffbdeef194bb403e0c8ba882c2d77878308b" name="cloud-regionsrv-client" arch="noarch">
  <version epoch="0" ver="10.3.4" rel="150300.13.9.1"/>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
</package>
<package pkgid="568b23b961a24b8d55d008477ce17b858816efb2fa0316e43e643c5efc377acf" name="cloud-regionsrv-client" arch="src">
  <version epoch="0" ver="10.3.4" rel="150300.13.9.1"/>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
</package>
<package pkgid="4e41a876f87d6a25d8055ac1b2dccb08e90818b61c0cde015a5988d42418afd8" name="cloud-regionsrv-client" arch="noarch">
  <version epoch="0" ver="10.3.7" rel="150300.13.14.1"/>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
  <changelog author="rjschwei@suse.com" date="1726056000">- Update to 10.3.5
  + Update spec file to build in all code streams,
    SLE 12, SLE 15, ALP, and SLFO and have proper dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1730203200">- Update to 10.3.6 (jsc#PCT-471, bsc#1230615)
  + Fix sudo setup
    ~ permissions cloudguestregistryauth
    ~ directory ownership /etc/sudoers.d
  + spec file
    ~ Remove traces of registry related entries on SLE 12
  + Forward port
    ~ fix-for-sles12-disable-registry.patch
    ~ fix-for-sles12-no-trans_update.patch
  + Deregister non free extensions at registercloudguest --clean
  + Fix registry cleanup at registercloudguest --clean, don't remove files
  + Prevent duplicate search entries in registry setup
- Update EC2 plugin to 1.0.5
  + Switch to using the region endpoint from IMDS to determine the region
    instead of deriving the data from the availability zone</changelog>
  <changelog author="rjschwei@suse.com" date="1730808000">- Update to 10.3.7 (bsc#1232770)
  + Fix the product triplet for LTSS, it is always SLES-LTSS, not
    $BASEPRODUCT-LTSS</changelog>
</package>
<package pkgid="ce162c855b68d94124cbf198fd97f7835e157c70e0c41dcf7da36c5cc1f3aab7" name="cloud-regionsrv-client" arch="src">
  <version epoch="0" ver="10.3.7" rel="150300.13.14.1"/>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
  <changelog author="rjschwei@suse.com" date="1726056000">- Update to 10.3.5
  + Update spec file to build in all code streams,
    SLE 12, SLE 15, ALP, and SLFO and have proper dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1730203200">- Update to 10.3.6 (jsc#PCT-471, bsc#1230615)
  + Fix sudo setup
    ~ permissions cloudguestregistryauth
    ~ directory ownership /etc/sudoers.d
  + spec file
    ~ Remove traces of registry related entries on SLE 12
  + Forward port
    ~ fix-for-sles12-disable-registry.patch
    ~ fix-for-sles12-no-trans_update.patch
  + Deregister non free extensions at registercloudguest --clean
  + Fix registry cleanup at registercloudguest --clean, don't remove files
  + Prevent duplicate search entries in registry setup
- Update EC2 plugin to 1.0.5
  + Switch to using the region endpoint from IMDS to determine the region
    instead of deriving the data from the availability zone</changelog>
  <changelog author="rjschwei@suse.com" date="1730808000">- Update to 10.3.7 (bsc#1232770)
  + Fix the product triplet for LTSS, it is always SLES-LTSS, not
    $BASEPRODUCT-LTSS</changelog>
</package>
<package pkgid="3372e06e660e558e6f4d9b5eab76a1fb885d0076b360b3f079a7c21d7bebf54a" name="cloud-regionsrv-client-addon-azure" arch="noarch">
  <version epoch="0" ver="1.0.5" rel="150300.13.14.1"/>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
  <changelog author="rjschwei@suse.com" date="1726056000">- Update to 10.3.5
  + Update spec file to build in all code streams,
    SLE 12, SLE 15, ALP, and SLFO and have proper dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1730203200">- Update to 10.3.6 (jsc#PCT-471, bsc#1230615)
  + Fix sudo setup
    ~ permissions cloudguestregistryauth
    ~ directory ownership /etc/sudoers.d
  + spec file
    ~ Remove traces of registry related entries on SLE 12
  + Forward port
    ~ fix-for-sles12-disable-registry.patch
    ~ fix-for-sles12-no-trans_update.patch
  + Deregister non free extensions at registercloudguest --clean
  + Fix registry cleanup at registercloudguest --clean, don't remove files
  + Prevent duplicate search entries in registry setup
- Update EC2 plugin to 1.0.5
  + Switch to using the region endpoint from IMDS to determine the region
    instead of deriving the data from the availability zone</changelog>
  <changelog author="rjschwei@suse.com" date="1730808000">- Update to 10.3.7 (bsc#1232770)
  + Fix the product triplet for LTSS, it is always SLES-LTSS, not
    $BASEPRODUCT-LTSS</changelog>
</package>
<package pkgid="ae999e5184ba0c380a5ad71dee7a5c2ef9a046c463fb081383473232ddd5d3ef" name="cloud-regionsrv-client-addon-azure" arch="noarch">
  <version epoch="0" ver="1.0.5" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="42d7c0d8ae9348713c6386f7cf388ab4946fbcf307a9fe846c026826dbe72ba9" name="cloud-regionsrv-client-addon-azure" arch="noarch">
  <version epoch="0" ver="1.0.5" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="1e821cf019d6514a0e5678fc13eeec4974a773c10742c42d33197c08b28b8fdc" name="cloud-regionsrv-client-addon-azure" arch="noarch">
  <version epoch="0" ver="1.0.5" rel="150300.13.9.1"/>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
</package>
<package pkgid="dd1afeed511785d424f6d0a3829267569169e2f069d1fc65838f158af44d42e8" name="cloud-regionsrv-client-generic-config" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="150300.13.14.1"/>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
  <changelog author="rjschwei@suse.com" date="1726056000">- Update to 10.3.5
  + Update spec file to build in all code streams,
    SLE 12, SLE 15, ALP, and SLFO and have proper dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1730203200">- Update to 10.3.6 (jsc#PCT-471, bsc#1230615)
  + Fix sudo setup
    ~ permissions cloudguestregistryauth
    ~ directory ownership /etc/sudoers.d
  + spec file
    ~ Remove traces of registry related entries on SLE 12
  + Forward port
    ~ fix-for-sles12-disable-registry.patch
    ~ fix-for-sles12-no-trans_update.patch
  + Deregister non free extensions at registercloudguest --clean
  + Fix registry cleanup at registercloudguest --clean, don't remove files
  + Prevent duplicate search entries in registry setup
- Update EC2 plugin to 1.0.5
  + Switch to using the region endpoint from IMDS to determine the region
    instead of deriving the data from the availability zone</changelog>
  <changelog author="rjschwei@suse.com" date="1730808000">- Update to 10.3.7 (bsc#1232770)
  + Fix the product triplet for LTSS, it is always SLES-LTSS, not
    $BASEPRODUCT-LTSS</changelog>
</package>
<package pkgid="33a1374433dd2123dcc9f470a995180c1938585d9f57b156124b86cd19f67c9b" name="cloud-regionsrv-client-generic-config" arch="aarch64">
  <version epoch="0" ver="1.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="d46066f079eb19cb4248331da9e68c66e91732f10b882aa3800b0e5311735252" name="cloud-regionsrv-client-generic-config" arch="ppc64le">
  <version epoch="0" ver="1.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="f7e2a00cefd5959eabba3d057da935500882e7b9988a7fe337569affab8dc16b" name="cloud-regionsrv-client-generic-config" arch="s390x">
  <version epoch="0" ver="1.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="e889e74b79c458a11512ad5a93e5763faf7878e9367920b96cef36ae6c73c3a4" name="cloud-regionsrv-client-generic-config" arch="x86_64">
  <version epoch="0" ver="1.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="d7d159e3fe580fea182261011e921db61af8e58961984800d9dc618ebae8ef7d" name="cloud-regionsrv-client-generic-config" arch="aarch64">
  <version epoch="0" ver="1.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="715ee7312a04fb2530d775bb0843c6e69ca0b27d7f4fbd1c9d019b3bc260e986" name="cloud-regionsrv-client-generic-config" arch="ppc64le">
  <version epoch="0" ver="1.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="0a337bc7ec79f3d88e48cb4ba6378efc82251a44f0e3564d2e5d9471f4167451" name="cloud-regionsrv-client-generic-config" arch="s390x">
  <version epoch="0" ver="1.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="7746fafdc52cc6403857d05170b88f6949526a1bd49dfaf4c28946964c06fbab" name="cloud-regionsrv-client-generic-config" arch="x86_64">
  <version epoch="0" ver="1.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="2801d7095111cc584030e6b7ce3b59ea9a3981e0cf611f65eb36fb8d25361bcc" name="cloud-regionsrv-client-generic-config" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="150300.13.9.1"/>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
</package>
<package pkgid="4c3febfa727780ddb931de38876a2f953b6de5a9fd6c1973d7cf2a62a4434e43" name="cloud-regionsrv-client-plugin-azure" arch="noarch">
  <version epoch="0" ver="2.0.0" rel="150300.13.14.1"/>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
  <changelog author="rjschwei@suse.com" date="1726056000">- Update to 10.3.5
  + Update spec file to build in all code streams,
    SLE 12, SLE 15, ALP, and SLFO and have proper dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1730203200">- Update to 10.3.6 (jsc#PCT-471, bsc#1230615)
  + Fix sudo setup
    ~ permissions cloudguestregistryauth
    ~ directory ownership /etc/sudoers.d
  + spec file
    ~ Remove traces of registry related entries on SLE 12
  + Forward port
    ~ fix-for-sles12-disable-registry.patch
    ~ fix-for-sles12-no-trans_update.patch
  + Deregister non free extensions at registercloudguest --clean
  + Fix registry cleanup at registercloudguest --clean, don't remove files
  + Prevent duplicate search entries in registry setup
- Update EC2 plugin to 1.0.5
  + Switch to using the region endpoint from IMDS to determine the region
    instead of deriving the data from the availability zone</changelog>
  <changelog author="rjschwei@suse.com" date="1730808000">- Update to 10.3.7 (bsc#1232770)
  + Fix the product triplet for LTSS, it is always SLES-LTSS, not
    $BASEPRODUCT-LTSS</changelog>
</package>
<package pkgid="f66d26a57ae685e4d8d28c35f1140850e9653576c7c3d2d60586f5c2208c672e" name="cloud-regionsrv-client-plugin-azure" arch="aarch64">
  <version epoch="0" ver="2.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="906f252e322d2ab57e42b1002b30872f80b8b43b34bb6119b98399d3bbabafeb" name="cloud-regionsrv-client-plugin-azure" arch="ppc64le">
  <version epoch="0" ver="2.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="75a365375e29370f469d978461a915ceeca8da8bc55faf9e4e0c09267d7f2b11" name="cloud-regionsrv-client-plugin-azure" arch="s390x">
  <version epoch="0" ver="2.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="0938f5851f75025f3fbc2c90d98e1a2ee85b3c475961c1f18829612a2fdccd7b" name="cloud-regionsrv-client-plugin-azure" arch="x86_64">
  <version epoch="0" ver="2.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="e7fa0bf9ddd9d7f143f22afa211a01648fc15a6979b7337468d39761dec06c7e" name="cloud-regionsrv-client-plugin-azure" arch="aarch64">
  <version epoch="0" ver="2.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="a589841816b2a4bc96ff220128d2a6760abc6bb0990a816c63a6d2c8fcdc5a7e" name="cloud-regionsrv-client-plugin-azure" arch="ppc64le">
  <version epoch="0" ver="2.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="64564d46f5b98efd16ac02df439ba5bd78ce67983b22c50ad106bedf30f043cb" name="cloud-regionsrv-client-plugin-azure" arch="s390x">
  <version epoch="0" ver="2.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="46803198f2d13021a1a40a877ff86f26757ab168985f3f882fe369b5facbc787" name="cloud-regionsrv-client-plugin-azure" arch="x86_64">
  <version epoch="0" ver="2.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="066bf71dba544f3ed91a7b400821ed8903b2fb238941c230294c110a6af8371e" name="cloud-regionsrv-client-plugin-azure" arch="noarch">
  <version epoch="0" ver="2.0.0" rel="150300.13.9.1"/>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
</package>
<package pkgid="cc551ffa88e35192122b03cf272175e88aa0864b7c95966ae729b6d70d778de4" name="cloud-regionsrv-client-plugin-ec2" arch="aarch64">
  <version epoch="0" ver="1.0.4" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="6449dea0e2da1c1ac4c197b193bde0528c37e27193353571f5ed3a316d48d8c8" name="cloud-regionsrv-client-plugin-ec2" arch="ppc64le">
  <version epoch="0" ver="1.0.4" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="aa56053fa756a0d37635eb34649618499ee406a38013b75f9f31bdb360192350" name="cloud-regionsrv-client-plugin-ec2" arch="s390x">
  <version epoch="0" ver="1.0.4" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="1c791f601cec59f47763f32e84fe7c2df7870bd10f88eec7f9a8dd9164a83aae" name="cloud-regionsrv-client-plugin-ec2" arch="x86_64">
  <version epoch="0" ver="1.0.4" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="b55e0548178c95e33631ed7fb279db9d7cdf1767da958f447abefbb2a0af4e21" name="cloud-regionsrv-client-plugin-ec2" arch="aarch64">
  <version epoch="0" ver="1.0.4" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="ea84184055043e37917b5ace2701e402131a4a4aa07e0f4d1536eff3a0f7e06b" name="cloud-regionsrv-client-plugin-ec2" arch="ppc64le">
  <version epoch="0" ver="1.0.4" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="44dddf9a2b3dc899fb00b0971f374af903f6ae6b22ea285fdc653da3f58b4e5b" name="cloud-regionsrv-client-plugin-ec2" arch="s390x">
  <version epoch="0" ver="1.0.4" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="a6a00fe5eaf270eb291836699738fdeb20ad291457e048e27643ff943ebc0c17" name="cloud-regionsrv-client-plugin-ec2" arch="x86_64">
  <version epoch="0" ver="1.0.4" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="32c770fdaaf76067db9f9b845365822a2846d56562521840993f078ab90815b7" name="cloud-regionsrv-client-plugin-ec2" arch="noarch">
  <version epoch="0" ver="1.0.4" rel="150300.13.9.1"/>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
</package>
<package pkgid="26b6d77cffae774b3cd0988e961406a739a4e5926ab509f3e3d6fb83376ea562" name="cloud-regionsrv-client-plugin-ec2" arch="noarch">
  <version epoch="0" ver="1.0.5" rel="150300.13.14.1"/>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
  <changelog author="rjschwei@suse.com" date="1726056000">- Update to 10.3.5
  + Update spec file to build in all code streams,
    SLE 12, SLE 15, ALP, and SLFO and have proper dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1730203200">- Update to 10.3.6 (jsc#PCT-471, bsc#1230615)
  + Fix sudo setup
    ~ permissions cloudguestregistryauth
    ~ directory ownership /etc/sudoers.d
  + spec file
    ~ Remove traces of registry related entries on SLE 12
  + Forward port
    ~ fix-for-sles12-disable-registry.patch
    ~ fix-for-sles12-no-trans_update.patch
  + Deregister non free extensions at registercloudguest --clean
  + Fix registry cleanup at registercloudguest --clean, don't remove files
  + Prevent duplicate search entries in registry setup
- Update EC2 plugin to 1.0.5
  + Switch to using the region endpoint from IMDS to determine the region
    instead of deriving the data from the availability zone</changelog>
  <changelog author="rjschwei@suse.com" date="1730808000">- Update to 10.3.7 (bsc#1232770)
  + Fix the product triplet for LTSS, it is always SLES-LTSS, not
    $BASEPRODUCT-LTSS</changelog>
</package>
<package pkgid="785db7a9168658730326073acf780f9ea1afe609b4ac8669624092ccd6dfb461" name="cloud-regionsrv-client-plugin-gce" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="150300.13.14.1"/>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
  <changelog author="rjschwei@suse.com" date="1726056000">- Update to 10.3.5
  + Update spec file to build in all code streams,
    SLE 12, SLE 15, ALP, and SLFO and have proper dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1730203200">- Update to 10.3.6 (jsc#PCT-471, bsc#1230615)
  + Fix sudo setup
    ~ permissions cloudguestregistryauth
    ~ directory ownership /etc/sudoers.d
  + spec file
    ~ Remove traces of registry related entries on SLE 12
  + Forward port
    ~ fix-for-sles12-disable-registry.patch
    ~ fix-for-sles12-no-trans_update.patch
  + Deregister non free extensions at registercloudguest --clean
  + Fix registry cleanup at registercloudguest --clean, don't remove files
  + Prevent duplicate search entries in registry setup
- Update EC2 plugin to 1.0.5
  + Switch to using the region endpoint from IMDS to determine the region
    instead of deriving the data from the availability zone</changelog>
  <changelog author="rjschwei@suse.com" date="1730808000">- Update to 10.3.7 (bsc#1232770)
  + Fix the product triplet for LTSS, it is always SLES-LTSS, not
    $BASEPRODUCT-LTSS</changelog>
</package>
<package pkgid="cc24c13100a6110a01534f1c2e05153d18f068b21789744a61743ff7b88f23be" name="cloud-regionsrv-client-plugin-gce" arch="aarch64">
  <version epoch="0" ver="1.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="aa63b4ed8103e81512f9cff798ed631af0f0db0ff5c73d9fe7762a005c4accfd" name="cloud-regionsrv-client-plugin-gce" arch="ppc64le">
  <version epoch="0" ver="1.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="15ab651d8ffedc3b7df702bf00622e29aaf6fc034d741cd1044fb2b485dd4491" name="cloud-regionsrv-client-plugin-gce" arch="s390x">
  <version epoch="0" ver="1.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="a76fdf81835c6c2bcb2945cbd56077de19c8771ba9588af62f82452ce260262e" name="cloud-regionsrv-client-plugin-gce" arch="x86_64">
  <version epoch="0" ver="1.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="7ad84442228758fca07ba7ff091a5abc31d9aa66f6a543fa8c8b043444bab078" name="cloud-regionsrv-client-plugin-gce" arch="aarch64">
  <version epoch="0" ver="1.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="26b10c2dd23935aa097db41669e6932c09d4ba44ce2eb8ab27487988c744ba1f" name="cloud-regionsrv-client-plugin-gce" arch="ppc64le">
  <version epoch="0" ver="1.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="93a71b1fb3de476deab6eb735d59824994c7cb782c90faf69ecc1079b6d6fde2" name="cloud-regionsrv-client-plugin-gce" arch="s390x">
  <version epoch="0" ver="1.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="9da0bc0c8c8670649ca5317e10c5c48b8021b4f52a8ca42eaa88376c4e805144" name="cloud-regionsrv-client-plugin-gce" arch="x86_64">
  <version epoch="0" ver="1.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="8982b3972892132e2dc9d1c1575cfbf0557a0c77ce6823f985a1bd1bd9fdaf99" name="cloud-regionsrv-client-plugin-gce" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="150300.13.9.1"/>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
</package>
<package pkgid="daccd205d3f33241e8196e50dc9197ab0b196c64f8e468cda1bd9a9424c733e0" name="cluster-md-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="047f0f423e7db63bb2a408eb38dc9c34a47bc2bc5bcdce799e9fbda1e3001b22" name="cluster-md-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="1d9e3013e73fbd245b62c8b18261d7f8d5b77c35067c4ed4c9f3a7719a17aec2" name="cluster-md-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.22.1"/>
  <changelog author="lduncan@suse.com" date="1725019200">- scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315
  CVE-2024-43821).
- commit eb73e94</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019201">- iommu/amd: Convert comma to semicolon (git-fixes).
- commit 2714d8b</changelog>
  <changelog author="mkoutny@suse.com" date="1725019202">- Update
  patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch
  (git-fixes CVE-2024-35902 bsc#1224496).
- Update
  patches.suse/ASoC-TAS2781-Fix-tasdev_load_calibrated_data.patch
  (git-fixes CVE-2024-42278 bsc#1229403).
- Update
  patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch
  (git-fixes CVE-2024-43818 bsc#1229296).
- Update
  patches.suse/ASoC-fsl-fsl_qmc_audio-Check-devm_kasprintf-returned.patch
  (git-fixes CVE-2024-42298 bsc#1229369).
- Update
  patches.suse/Bluetooth-MGMT-Add-error-handling-to-pair_device.patch
  (git-fixes CVE-2024-43884 bsc#1229739).
- Update
  patches.suse/KVM-Always-flush-async-PF-workqueue-when-vCPU-is-bei.patch
  (git-fixes CVE-2024-26976 bsc#1223635).
- Update
  patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch
  (git-fixes CVE-2024-42302 bsc#1229366).
- Update
  patches.suse/PCI-endpoint-Clean-up-error-handling-in-vpci_scan_bu.patch
  (git-fixes CVE-2024-43875 bsc#1229486).
- Update
  patches.suse/PCI-endpoint-pci-epf-test-Make-use-of-cached-epc_fea.patch
  (git-fixes CVE-2024-43824 bsc#1229320).
- Update
  patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch
  (git-fixes CVE-2024-43823 bsc#1229303).
- Update
  patches.suse/PCI-rcar-Demote-WARN-to-dev_warn_ratelimited-in-rcar.patch
  (git-fixes CVE-2024-43876 bsc#1229485).
- Update
  patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch
  (git-fixes CVE-2024-43872 bsc#1229489).
- Update
  patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch
  (git-fixes CVE-2024-42285 bsc#1229381).
- Update
  patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch
  (bsc#1208783 CVE-2024-42274 bsc#1229417).
- Update
  patches.suse/SUNRPC-add-a-missing-rpc_stat-for-TCP-TLS.patch
  (git-fixes CVE-2024-36907 bsc#1225751).
- Update
  patches.suse/bpf-arm64-Fix-trampoline-for-BPF_TRAMP_F_CALL_ORIG.patch
  (git-fixes CVE-2024-43840 bsc#1229344).
- Update
  patches.suse/btrfs-fix-double-inode-unlock-for-direct-IO-sync-wri.patch
  (git-fixes CVE-2024-43885 bsc#1229747).
- Update
  patches.suse/btrfs-fix-extent-map-use-after-free-when-adding-page.patch
  (git-fixes CVE-2024-42314 bsc#1229355).
- Update
  patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch
  (bsc#1228801 CVE-2024-43853 bsc#1229292).
- Update
  patches.suse/crypto-ccp-Fix-null-pointer-dereference-in-__sev_snp.patch
  (git-fixes CVE-2024-43874 bsc#1229487).
- Update
  patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch
  (git-fixes CVE-2024-43871 bsc#1229490).
- Update
  patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch
  (git-fixes CVE-2024-43856 bsc#1229346).
- Update
  patches.suse/drm-admgpu-fix-dereferencing-null-pointer-context.patch
  (stable-fixes CVE-2024-43906 bsc#1229785).
- Update
  patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch
  (stable-fixes CVE-2024-43903 bsc#1229781).
- Update
  patches.suse/drm-amd-display-Add-null-checker-before-passing-vari.patch
  (stable-fixes CVE-2024-43902 bsc#1229767).
- Update
  patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch
  (stable-fixes CVE-2024-43895 bsc#1229755).
- Update
  patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch
  (stable-fixes CVE-2024-43905 bsc#1229784).
- Update
  patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch
  (stable-fixes CVE-2024-43908 bsc#1229788).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch
  (stable-fixes CVE-2024-43909 bsc#1229789).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch
  (stable-fixes CVE-2024-43907 bsc#1229787).
- Update
  patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch
  (git-fixes CVE-2024-43894 bsc#1229746).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch
  (git-fixes CVE-2024-42310 bsc#1229358).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch
  (git-fixes CVE-2024-42309 bsc#1229359).
- Update
  patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch
  (git-fixes CVE-2024-43867 bsc#1229493).
- Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch
  (git-fixes CVE-2024-43829 bsc#1229341).
- Update
  patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch
  (git-fixes CVE-2024-43863 bsc#1229497).
- Update
  patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch
  (git-fixes CVE-2024-42315 bsc#1229354).
- Update
  patches.suse/gpio-prevent-potential-speculation-leaks-in-gpio_dev.patch
  (stable-fixes CVE-2024-44931 bsc#1229837).
- Update
  patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch
  (git-fixes CVE-2024-42311 bsc#1229413).
- Update
  patches.suse/iio-Fix-the-sorting-functionality-in-iio_gts_build_a.patch
  (git-fixes CVE-2024-43825 bsc#1229298).
- Update
  patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch
  (git-fixes CVE-2024-43858 bsc#1229414).
- Update
  patches.suse/jfs-Fix-shift-out-of-bounds-in-dbDiscardAG.patch
  (git-fixes CVE-2024-44938 bsc#1229792).
- Update
  patches.suse/jfs-fix-null-ptr-deref-in-dtInsertEntry.patch
  (git-fixes CVE-2024-44939 bsc#1229820).
- Update
  patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch
  (git-fixes CVE-2024-42292 bsc#1229373).
- Update
  patches.suse/kvm-s390-Reject-memory-region-operations-for-ucontrol-VMs.patch
  (git-fixes bsc#1229168 CVE-2024-43819 bsc#1229290).
- Update
  patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch
  (git-fixes CVE-2024-43830 bsc#1229305).
- Update
  patches.suse/lib-objagg-Fix-general-protection-fault.patch
  (git-fixes CVE-2024-43846 bsc#1229360).
- Update
  patches.suse/libbpf-Use-OPTS_SET-macro-in-bpf_xdp_query.patch
  (git-fixes CVE-2024-27050 bsc#1223767).
- Update
  patches.suse/mISDN-Fix-a-use-after-free-in-hfcmulti_tx.patch
  (git-fixes CVE-2024-42280 bsc#1229388).
- Update
  patches.suse/mailbox-mtk-cmdq-Move-devm_mbox_controller_register-.patch
  (git-fixes CVE-2024-42319 bsc#1229350).
- Update
  patches.suse/md-raid5-fix-deadlock-that-raid5d-wait-for-itself-to-clear-MD_SB_CHANGE_PENDING-151f.patch
  (git-fixes CVE-2024-39476 bsc#1227437).
- Update
  patches.suse/media-imx-pxp-Fix-ERR_PTR-dereference-in-pxp_probe.patch
  (git-fixes CVE-2024-42303 bsc#1229365).
- Update
  patches.suse/media-pci-ivtv-Add-check-for-DMA-map-result.patch
  (git-fixes CVE-2024-43877 bsc#1229484).
- Update
  patches.suse/media-v4l-async-Fix-NULL-pointer-dereference-in-addi.patch
  (git-fixes CVE-2024-43833 bsc#1229299).
- Update
  patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch
  (git-fixes CVE-2024-42313 bsc#1229356).
- Update
  patches.suse/media-xc2028-avoid-use-after-free-in-load_firmware_c.patch
  (stable-fixes CVE-2024-43900 bsc#1229756).
- Update
  patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch
  (git-fixes CVE-2024-43892 bsc#1229761).
- Update
  patches.suse/net-drop-bad-gso-csum_start-and-offset-in-virtio_net.patch
  (git-fixes CVE-2024-43897 bsc#1229752).
- Update
  patches.suse/net-iucv-fix-use-after-free-in-iucv_sock_close.patch
  (bsc#1228973 CVE-2024-42271 bsc#1229400).
- Update patches.suse/net-missing-check-virtio.patch (git-fixes
  CVE-2024-43817 bsc#1229312).
- Update
  patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch
  (git-fixes CVE-2024-43861 bsc#1229500).
- Update
  patches.suse/nfs-pass-explicit-offset-count-to-trace-events.patch
  (git-fixes CVE-2024-43826 bsc#1229294).
- Update
  patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch
  (git-fixes CVE-2024-42276 bsc#1229410).
- Update
  patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch
  (git-fixes CVE-2024-43889 bsc#1229743).
- Update
  patches.suse/remoteproc-imx_rproc-Skip-over-memory-region-when-no.patch
  (git-fixes CVE-2024-43860 bsc#1229319).
- Update
  patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch
  (git-fixes bsc#1229173 CVE-2024-42320 bsc#1229349).
- Update
  patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch
  (bsc#1228857 CVE-2024-43816 bsc#1229318).
- Update
  patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch
  (bsc#1228850 CVE-2024-42287 bsc#1229392).
- Update
  patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch
  (bsc#1228850 CVE-2024-42289 bsc#1229399).
- Update
  patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch
  (bsc#1228850 CVE-2024-42288 bsc#1229398).
- Update
  patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch
  (bsc#1228850 CVE-2024-42286 bsc#1229395).
- Update
  patches.suse/serial-core-check-uartclk-for-zero-to-avoid-divide-b.patch
  (stable-fixes CVE-2024-43893 bsc#1229759).
- Update
  patches.suse/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch
  (git-fixes CVE-2024-43849 bsc#1229307).
- Update
  patches.suse/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch
  (git-fixes CVE-2024-43851 bsc#1229313).
- Update
  patches.suse/spi-microchip-core-ensure-TX-and-RX-FIFOs-are-empty-.patch
  (git-fixes CVE-2024-42279 bsc#1229390).
- Update
  patches.suse/usb-vhci-hcd-Do-not-drop-references-before-new-refer.patch
  (stable-fixes CVE-2024-43883 bsc#1229707).
- Update
  patches.suse/vhost-vsock-always-initialize-seqpacket_allow.patch
  (git-fixes CVE-2024-43873 bsc#1229488).
- Update
  patches.suse/wifi-ath12k-change-DMA-direction-while-mapping-reinj.patch
  (git-fixes CVE-2024-43881 bsc#1229480).
- Update
  patches.suse/wifi-ath12k-fix-invalid-memory-access-while-processi.patch
  (git-fixes CVE-2024-43847 bsc#1229291).
- Update
  patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch
  (git-fixes CVE-2024-43879 bsc#1229482).
- Update
  patches.suse/wifi-nl80211-disallow-setting-special-AP-channel-wid.patch
  (stable-fixes CVE-2024-43912 bsc#1229830).
- Update
  patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch
  (git-fixes CVE-2024-43842 bsc#1229317).
- Update
  patches.suse/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch
  (git-fixes CVE-2024-43841 bsc#1229304).
- commit 140ec33</changelog>
  <changelog author="tiwai@suse.de" date="1725105600">- dmaengine: dw: Add memory bus width verification (git-fixes).
- dmaengine: dw: Add peripheral bus width verification
  (git-fixes).
- soundwire: stream: fix programming slave ports for non-continous
  port maps (git-fixes).
- commit b7e9784</changelog>
  <changelog author="tiwai@suse.de" date="1725192000">- usb: cdnsp: fix for Link TRB with TC (git-fixes).
- usb: dwc3: st: add missing depopulate in probe error path
  (git-fixes).
- usb: dwc3: st: fix probed platform device ref count on probe
  error path (git-fixes).
- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
  remove_power_attributes() (git-fixes).
- usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).
- usb: dwc3: omap: add missing depopulate in probe error path
  (git-fixes).
- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
  (git-fixes).
- soc: qcom: pmic_glink: Actually communicate when remote goes
  down (git-fixes).
- soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).
- commit 7121142</changelog>
  <changelog author="ailiop@suse.com" date="1725192001">- xfs: Fix the owner setting issue for rmap query in xfs fsmap
  (git-fixes).
- commit 49b5eec</changelog>
  <changelog author="ailiop@suse.com" date="1725192002">- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code
  (git-fixes).
- commit 288ad9b</changelog>
  <changelog author="ailiop@suse.com" date="1725192003">- xfs: Fix missing interval for missing_owner in xfs fsmap
  (git-fixes).
- commit 5448ab5</changelog>
  <changelog author="ohering@suse.de" date="1725278400">- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).
- commit 4dc1da1</changelog>
  <changelog author="osalvador@suse.de" date="1725278401">- mm/sparsemem: fix race in accessing memory_section-&gt;usage
  (bsc#1221326 CVE-2023-52489).
- commit 6aa8957</changelog>
  <changelog author="osalvador@suse.de" date="1725278402">- mm, kmsan: fix infinite recursion due to RCU critical section
  (git-fixes).
- commit 16ad73a</changelog>
  <changelog author="osalvador@suse.de" date="1725278403">- mm: prevent derefencing NULL ptr in pfn_section_valid()
  (git-fixes).
- commit 35f619d</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278404">- bluetooth/l2cap: sync sock recv cb and release (bsc#1228576
  CVE-2024-41062).
- commit 6553526</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278405">- Bluetooth: L2CAP: Fix deadlock (git-fixes).
- commit 13aba13</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278406">- Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).
- commit 1bec58d</changelog>
  <changelog author="lhenriques@suse.de" date="1725278407">- ceph: periodically flush the cap releases (bsc#1230056).
- commit e22b6e0</changelog>
  <changelog author="tiwai@suse.de" date="1725969600">- Drop soundwire patch that caused a regression (bsc#1230350)
  Deleted:
  patches.suse/soundwire-stream-fix-programming-slave-ports-for-non.patch
- commit 5c05eeb</changelog>
  <changelog author="osalvador@suse.de" date="1726228800">- Revert "mm: prevent derefencing NULL ptr in pfn_section_valid()"
  This reverts commit 35f619d3c421219e07bc89d2d6a37fbff25519fe to fix a refression
  (bsc#1230413)
- commit 7e5afd7</changelog>
  <changelog author="osalvador@suse.de" date="1726228801">- Revert "mm, kmsan: fix infinite recursion due to RCU critical section"
  This reverts commit 16ad73a9f4c2888f3bc28513f5e9a88d753f8741 to fix a regression (bsc#1230413)
- commit 2fd5290</changelog>
  <changelog author="osalvador@suse.de" date="1726228802">- Revert "mm/sparsemem: fix race in accessing memory_section-&gt;usage"
  This reverts commit 6aa8957889611fbe7f06353f917cfb3d9620a680 to fix a regression (bsc#1230413)
- commit 720e36b</changelog>
</package>
<package pkgid="02655f8aba1fd2713bb3fb2d7713c30879fc3dc163f4d794a17fc6fdadd13466" name="cluster-md-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.25.1"/>
  <changelog author="mwilck@suse.com" date="1727438400">- scsi: sd: Fix off-by-one error in
  sd_read_block_characteristics() (bsc#1223848).
- commit 621f2fb</changelog>
  <changelog author="ailiop@suse.com" date="1727697600">- afs: Revert "afs: Hide silly-rename files from userspace"
  (git-fixes).
- commit 11353bb</changelog>
  <changelog author="ailiop@suse.com" date="1727697601">- afs: Don't cross .backup mountpoint from backup volume
  (git-fixes).
- commit f35dae1</changelog>
  <changelog author="ailiop@suse.com" date="1727697602">- erofs: fix incorrect symlink detection in fast symlink
  (git-fixes).
- commit 2e1ae75</changelog>
  <changelog author="hare@suse.de" date="1727697603">- nvme-multipath: system fails to create generic nvme device
  (bsc#1228244).
- commit 4fc57d2</changelog>
  <changelog author="hare@suse.de" date="1727697604">- nvme-multipath: avoid hang on inaccessible namespaces
  (bsc#1228244).
- kcm: Serialise kcm_sendmsg() for the same socket
  (CVE-2024-44946,bsc#1230015).
- commit a84ca87</changelog>
  <changelog author="hare@suse.de" date="1727697605">- kcm: Serialise kcm_sendmsg() for the same socket (CVE-2024-44946
  bsc#1230015).
- commit 4310760</changelog>
  <changelog author="tiwai@suse.de" date="1727697606">- Move upstreamed SCSI patches into sorted section
- commit aba5747</changelog>
  <changelog author="tiwai@suse.de" date="1727697607">- mailbox: bcm2835: Fix timeout during suspend mode (git-fixes).
- mailbox: rockchip: fix a typo in module autoloading (git-fixes).
- i2c: designware: fix controller is holding SCL low while ENABLE
  bit is disabled (git-fixes).
- drm/amd/display: handle nulled pipe context in DCE110's
  set_drr() (git-fixes).
- drm/amdgpu: Fix get each xcp macro (git-fixes).
- tomoyo: fallback to realpath if symlink's pathname does not
  exist (git-fixes).
- cxl/pci: Fix to record only non-zero ranges (git-fixes).
- ata: libata-scsi: Fix ata_msense_control() CDL page reporting
  (git-fixes).
- firmware_loader: Block path traversal (git-fixes).
- driver core: Fix a potential null-ptr-deref in
  module_add_driver() (git-fixes).
- driver core: Fix error handling in driver API device_rename()
  (git-fixes).
- ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()
  (git-fixes).
- iio: magnetometer: ak8975: Fix reading for ak099xx sensors
  (git-fixes).
- iio: chemical: bme680: Fix read/write ops to device by adding
  mutexes (git-fixes).
- ABI: testing: fix admv8818 attr description (git-fixes).
- iio: adc: ad7606: fix standby gpio state to match the
  documentation (git-fixes).
- iio: adc: ad7606: fix oversampling gpio array (git-fixes).
- tty: rp2: Fix reset with non forgiving PCIe host bridges
  (git-fixes).
- USB: class: CDC-ACM: fix race between get_serial and set_serial
  (git-fixes).
- usb: dwc2: drd: fix clock gating on USB role switch (git-fixes).
- usb: cdnsp: Fix incorrect usb_request status (git-fixes).
- USB: usbtmc: prevent kernel-usb-infoleak (git-fixes).
- USB: serial: kobil_sct: restore initial terminal settings
  (git-fixes).
- xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and
  freeing them (git-fixes).
- usb: dwc2: Skip clock gating on Broadcom SoCs (git-fixes).
- spi: atmel-quadspi: Avoid overwriting delay register settings
  (git-fixes).
- spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
  (git-fixes).
- spi: atmel-quadspi: Undo runtime PM changes at driver exit time
  (git-fixes).
- rtc: at91sam9: fix OF node leak in probe() error path
  (git-fixes).
- i3c: master: svc: Fix use after free vulnerability in
  svc_i3c_master Driver Due to Race Condition (git-fixes).
- remoteproc: k3-r5: Fix error handling when power-up failed
  (git-fixes).
- remoteproc: imx_rproc: Initialize workqueue earlier (git-fixes).
- remoteproc: imx_rproc: Correct ddr alias for i.MX8M (git-fixes).
- KEYS: prevent NULL pointer dereference in find_asymmetric_key()
  (git-fixes).
- media: i2c: ar0521: Use cansleep version of gpiod_set_value()
  (git-fixes).
- media: ov5675: Fix power on/off delay timings (git-fixes).
- media: sun4i_csi: Implement link validate for sun4i_csi subdev
  (git-fixes).
- media: platform: rzg2l-cru: rzg2l-csi2: Add missing
  MODULE_DEVICE_TABLE (git-fixes).
- media: venus: fix use after free bug in venus_remove due to
  race condition (git-fixes).
- media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
  (git-fixes).
- clk: ti: dra7-atl: Fix leak of of_nodes (git-fixes).
- watchdog: imx_sc_wdt: Don't disable WDT in suspend (git-fixes).
- pinctrl: single: fix missing error code in pcs_probe()
  (git-fixes).
- xz: cleanup CRC32 edits from 2018 (git-fixes).
- ata: pata_macio: Use WARN instead of BUG (stable-fixes).
- commit c5ab3ca</changelog>
  <changelog author="iivanov@suse.de" date="1727697608">- arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (bsc#1231120 CVE-2024-46822)
- commit cc6d7b5</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697609">- tracing: Fix overflow in get_free_elt() (git-fixes
  CVE-2024-43890 bsc#1229764).
- commit ceb524e</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697610">- tracing: Avoid possible softlockup in tracing_iter_reset()
  (git-fixes).
- commit d5df75c</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697611">- bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()
  (git-fixes).
- commit 1884922</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697612">- Refresh
  patches.suse/bpf-kprobe-remove-unused-declaring-of-bpf_kprobe_override.patch.
- commit 5a0b269</changelog>
  <changelog author="tiwai@suse.de" date="1727697613">- supported.conf: mark adiantum and xctr crypto modules as supported (bsc#1231035)
- commit 59d03d7</changelog>
  <changelog author="pmladek@suse.com" date="1727697614">- kthread: Fix task state in kthread worker if being frozen
  (bsc#1231146).
- commit fe88a62</changelog>
  <changelog author="tiwai@suse.de" date="1727784000">- USB: serial: pl2303: add device id for Macrosilicon MS3020
  (stable-fixes).
- powercap/intel_rapl: Add support for AMD family 1Ah
  (stable-fixes).
- ASoC: amd: yc: Add a quirk for MSI Bravo 17 (D7VEK)
  (stable-fixes).
- ASoC: tda7419: fix module autoloading (stable-fixes).
- ASoC: intel: fix module autoloading (stable-fixes).
- ASoC: Intel: soc-acpi-cht: Make Lenovo Yoga Tab 3 X90F DMI
  match less strict (stable-fixes).
- ALSA: hda: add HDMI codec ID for Intel PTL (stable-fixes).
- drm: komeda: Fix an issue related to normalized zpos
  (stable-fixes).
- can: mcp251xfd: mcp251xfd_ring_init(): check TX-coalescing
  configuration (stable-fixes).
- spi: spidev: Add missing spi_device_id for jg10309-01
  (git-fixes).
- spi: bcm63xx: Enable module autoloading (stable-fixes).
- spi: spidev: Add an entry for elgin,jg10309-01 (stable-fixes).
- hwmon: (asus-ec-sensors) remove VRM temp X570-E GAMING
  (stable-fixes).
- wifi: iwlwifi: clear trans-&gt;state earlier upon error
  (stable-fixes).
- wifi: mac80211: free skb on error path in
  ieee80211_beacon_get_ap() (stable-fixes).
- wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
  (stable-fixes).
- wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
  (stable-fixes).
- wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room()
  (stable-fixes).
- wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation
  (stable-fixes).
- wifi: iwlwifi: lower message level for FW buffer destination
  (stable-fixes).
- platform/x86: x86-android-tablets: Make Lenovo Yoga Tab 3 X90F
  DMI match less strict (stable-fixes).
- pinctrl: at91: make it work with current gpiolib (stable-fixes).
- can: mcp251xfd: properly indent labels (stable-fixes).
- commit a530f31</changelog>
  <changelog author="tiwai@suse.de" date="1727784001">- can: mcp251xfd: move mcp251xfd_timestamp_start()/stop() into
  mcp251xfd_chip_start/stop() (stable-fixes).
- Refresh
  patches.suse/can-mcp251xfd-clarify-the-meaning-of-timestamp.patch.
- commit 6779985</changelog>
  <changelog author="lhenriques@suse.de" date="1727784002">- cachefiles: fix dentry leak in cachefiles_open_file()
  (bsc#1231183).
- ceph: remove the incorrect Fw reference check when dirtying
  pages (bsc#1231182).
- commit ba82da7</changelog>
  <changelog author="tiwai@suse.de" date="1727784003">- ACPICA: executer/exsystem: Don't nag user about every Stall()
  violating the spec (git-fixes).
- ACPICA: Implement ACPI_WARNING_ONCE and ACPI_ERROR_ONCE
  (stable-fixes).
- commit f94e799</changelog>
</package>
<package pkgid="8b107f44e9837c6445ae29d7c6b7c0cd02a6943354038dc85f7674c07c05ae46" name="cluster-md-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.30.1"/>
  <changelog author="iivanov@suse.de" date="1733400000">- bpf, arm64: Remove garbage frame for struct_ops trampoline (git-fixes)
- commit e1353aa</changelog>
  <changelog author="msuchanek@suse.de" date="1733400001">- powerpc/fadump: Move fadump_cma_init to setup_arch() after
  initmem_init() (bsc#1215199).
- powerpc/fadump: Refactor and prepare fadump_cma_init for late
  init (bsc#1215199).
- powerpc/pseries: Use correct data types from pseries_hp_errorlog
  struct (bsc#1215199).
- powerpc/vdso: Inconditionally use CFUNC macro (bsc#1215199).
- powerpc/64s: Fix unnecessary copy to 0 when kernel is booted
  at address 0 (bsc#1215199).
- commit d36d28e</changelog>
  <changelog author="dsterba@suse.com" date="1733400002">- net: hns3: fix kernel crash when uninstalling driver (CVE-2024-50296 bsc#1233485)
- commit 6e41fd9</changelog>
  <changelog author="dsterba@suse.com" date="1733400003">- net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (CVE-2024-26596 bsc#1220355)
- commit 4861dc8</changelog>
  <changelog author="dsterba@suse.com" date="1733400004">- Bluetooth: btnxpuart: Fix random crash seen while removing driver (CVE-2024-46680 bsc#1230557)
- commit 3831431</changelog>
  <changelog author="dsterba@suse.com" date="1733400005">- Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test (bsc#1230557)
- commit 9ca14b5</changelog>
  <changelog author="dsterba@suse.com" date="1733400006">- drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() (CVE-2024-53056 bsc#1233568)
- commit 95cef70</changelog>
  <changelog author="dsterba@suse.com" date="1733400007">- wifi: iwlwifi: mvm: fix 6 GHz scan construction (CVE-2024-53055 bsc#1233550)
- commit c2d5beb</changelog>
  <changelog author="dsterba@suse.com" date="1733400008">- mctp i2c: handle NULL header address (CVE-2024-53043 bsc#1233523)
- commit 5a81634</changelog>
  <changelog author="dsterba@suse.com" date="1733400009">- drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability (CVE-2024-53051 bsc#1233547)
- commit 5262489</changelog>
  <changelog author="iivanov@suse.de" date="1733486400">- kABI: Restore exported __arm_smccc_sve_check (git-fixes)
- commit 3817c3a</changelog>
  <changelog author="iivanov@suse.de" date="1733486401">- arm64: dts: rockchip: remove num-slots property from (git-fixes)
- commit cb47197</changelog>
  <changelog author="iivanov@suse.de" date="1733486402">- arm64: dts: rockchip: Correct GPIO polarity on brcm BT nodes (git-fixes)
- commit ed87dba</changelog>
  <changelog author="tiwai@suse.de" date="1733486403">- can: j1939: j1939_session_new(): fix skb reference counting
  (git-fixes).
- can: mcp251xfd: mcp251xfd_get_tef_len(): work around erratum
  DS80000789E 6 (git-fixes).
- can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: sja1000: sja1000_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: hi311x: hi3110_can_ist(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors
  statistics (git-fixes).
- can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors
  statistics (git-fixes).
- can: hi311x: hi3110_can_ist(): fix potential use-after-free
  (git-fixes).
- can: sun4i_can: sun4i_can_err(): call can_change_state()
  even if cf is NULL (git-fixes).
- can: c_can: c_can_handle_bus_err(): update statistics if skb
  allocation fails (git-fixes).
- can: dev: can_set_termination(): allow sleeping GPIOs
  (git-fixes).
- HID: wacom: fix when get product name maybe null pointer
  (git-fixes).
- watchdog: rti: of: honor timeout-sec property (git-fixes).
- watchdog: mediatek: Make sure system reset gets asserted in
  mtk_wdt_restart() (git-fixes).
- watchdog: apple: Actually flush writes after requesting watchdog
  restart (git-fixes).
- iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
  (git-fixes).
- commit 535e699</changelog>
  <changelog author="tiwai@suse.de" date="1733486404">- netdevsim: copy addresses for both in and out paths (git-fixes).
- commit daf115e</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1733486405">- net/mlx5: fs, lock FTE when checking if active (CVE-2024-53121
  bsc#1234078).
- mlxsw: spectrum_ipip: Fix memory leak when changing remote
  IPv6 address (CVE-2024-50252 bsc#1233201).
- commit 06c045b</changelog>
  <changelog author="jgross@suse.com" date="1733486406">- vp_vdpa: fix id_table array not null terminated error
  (CVE-2024-53110 bsc#1234085).
- commit ffc9457</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1733486407">- net/mlx5e: kTLS, Fix incorrect page refcounting (CVE-2024-53138
  bsc#1234223).
- ice: protect XDP configuration with a mutex (CVE-2024-46765
  bsc#1230807).
- sch/netem: fix use after free in netem_dequeue (CVE-2024-46800
  bsc#1230827).
- commit c9f3783</changelog>
  <changelog author="tiwai@suse.de" date="1733572800">- drm/v3d: Enable Performance Counters before clearing them
  (git-fixes).
- drm/sti: Add __iomem for mixer_dbg_mxn's parameter (git-fixes).
- dma-fence: Use kernel's sort for merging fences (git-fixes).
- dma-fence: Fix reference leak on fence merge failure path
  (git-fixes).
- ASoC: mediatek: mt8188-mt6359: Remove hardcoded dmic codec
  (git-fixes).
- ASoC: SOF: ipc3-topology: fix resource leaks in
  sof_ipc3_widget_setup_comp_dai() (git-fixes).
- ALSA: usb-audio: Fix a DMA to stack memory bug (git-fixes).
- regmap: detach regmap from dev on regmap_exit (git-fixes).
- spi: mpc52xx: Add cancel_work_sync before module remove
  (git-fixes).
- mmc: core: Further prevent card detect during shutdown
  (git-fixes).
- commit 87e627e</changelog>
  <changelog author="tiwai@suse.de" date="1733572801">- ASoC: Intel: avs: da7219: Remove suspend_pre() and resume_post()
  (stable-fixes).
- ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360
  (NP730QFG) (stable-fixes).
- ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook
  430 G8 (stable-fixes).
- ALSA: usb-audio: add mixer mapping for Corsair HS80
  (stable-fixes).
- ALSA: hda/conexant: fix Z60MR100 startup pop issue
  (stable-fixes).
- commit 8c25a0a</changelog>
</package>
<package pkgid="958182b0cd6893a5cf3f28a842349ad19b6b32922ceb9db67e59383bbf9a646d" name="cluster-md-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.3"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="5fc3d188c764a00f12ebd7d52b7392c57222cf08d08262ed71b9bbb9e3390009" name="cluster-md-kmp-azure" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.8.11.1"/>
  <changelog author="lhenriques@suse.de" date="1725019200">- virtiofs: forbid newlines in tags (bsc#1229940).
- commit 61514ce</changelog>
  <changelog author="lhenriques@suse.de" date="1725019201">- blacklist.conf: add 053fc4f755ad fuse: fix UAF in rcu pathwalks
  This commit breaks kABI and the data structure has no free room for the
  extra field, i.e. memcpy would fail to copy the additional member added by
  this patch.
- commit 941b81c</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019202">- iommufd/device: Fix hwpt at err_unresv in
  iommufd_device_do_replace() (git-fixes).
- commit bbc9a65</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019203">- iommu/vt-d: Fix identity map bounds in si_domain_init()
  (git-fixes).
- commit b4d27e5</changelog>
  <changelog author="lduncan@suse.com" date="1725019204">- scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315
  CVE-2024-43821).
- commit eb73e94</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019205">- iommu/amd: Convert comma to semicolon (git-fixes).
- commit 2714d8b</changelog>
  <changelog author="mkoutny@suse.com" date="1725019206">- Update
  patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch
  (git-fixes CVE-2024-35902 bsc#1224496).
- Update
  patches.suse/ASoC-TAS2781-Fix-tasdev_load_calibrated_data.patch
  (git-fixes CVE-2024-42278 bsc#1229403).
- Update
  patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch
  (git-fixes CVE-2024-43818 bsc#1229296).
- Update
  patches.suse/ASoC-fsl-fsl_qmc_audio-Check-devm_kasprintf-returned.patch
  (git-fixes CVE-2024-42298 bsc#1229369).
- Update
  patches.suse/Bluetooth-MGMT-Add-error-handling-to-pair_device.patch
  (git-fixes CVE-2024-43884 bsc#1229739).
- Update
  patches.suse/KVM-Always-flush-async-PF-workqueue-when-vCPU-is-bei.patch
  (git-fixes CVE-2024-26976 bsc#1223635).
- Update
  patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch
  (git-fixes CVE-2024-42302 bsc#1229366).
- Update
  patches.suse/PCI-endpoint-Clean-up-error-handling-in-vpci_scan_bu.patch
  (git-fixes CVE-2024-43875 bsc#1229486).
- Update
  patches.suse/PCI-endpoint-pci-epf-test-Make-use-of-cached-epc_fea.patch
  (git-fixes CVE-2024-43824 bsc#1229320).
- Update
  patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch
  (git-fixes CVE-2024-43823 bsc#1229303).
- Update
  patches.suse/PCI-rcar-Demote-WARN-to-dev_warn_ratelimited-in-rcar.patch
  (git-fixes CVE-2024-43876 bsc#1229485).
- Update
  patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch
  (git-fixes CVE-2024-43872 bsc#1229489).
- Update
  patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch
  (git-fixes CVE-2024-42285 bsc#1229381).
- Update
  patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch
  (bsc#1208783 CVE-2024-42274 bsc#1229417).
- Update
  patches.suse/SUNRPC-add-a-missing-rpc_stat-for-TCP-TLS.patch
  (git-fixes CVE-2024-36907 bsc#1225751).
- Update
  patches.suse/bpf-arm64-Fix-trampoline-for-BPF_TRAMP_F_CALL_ORIG.patch
  (git-fixes CVE-2024-43840 bsc#1229344).
- Update
  patches.suse/btrfs-fix-double-inode-unlock-for-direct-IO-sync-wri.patch
  (git-fixes CVE-2024-43885 bsc#1229747).
- Update
  patches.suse/btrfs-fix-extent-map-use-after-free-when-adding-page.patch
  (git-fixes CVE-2024-42314 bsc#1229355).
- Update
  patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch
  (bsc#1228801 CVE-2024-43853 bsc#1229292).
- Update
  patches.suse/crypto-ccp-Fix-null-pointer-dereference-in-__sev_snp.patch
  (git-fixes CVE-2024-43874 bsc#1229487).
- Update
  patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch
  (git-fixes CVE-2024-43871 bsc#1229490).
- Update
  patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch
  (git-fixes CVE-2024-43856 bsc#1229346).
- Update
  patches.suse/drm-admgpu-fix-dereferencing-null-pointer-context.patch
  (stable-fixes CVE-2024-43906 bsc#1229785).
- Update
  patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch
  (stable-fixes CVE-2024-43903 bsc#1229781).
- Update
  patches.suse/drm-amd-display-Add-null-checker-before-passing-vari.patch
  (stable-fixes CVE-2024-43902 bsc#1229767).
- Update
  patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch
  (stable-fixes CVE-2024-43895 bsc#1229755).
- Update
  patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch
  (stable-fixes CVE-2024-43905 bsc#1229784).
- Update
  patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch
  (stable-fixes CVE-2024-43908 bsc#1229788).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch
  (stable-fixes CVE-2024-43909 bsc#1229789).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch
  (stable-fixes CVE-2024-43907 bsc#1229787).
- Update
  patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch
  (git-fixes CVE-2024-43894 bsc#1229746).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch
  (git-fixes CVE-2024-42310 bsc#1229358).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch
  (git-fixes CVE-2024-42309 bsc#1229359).
- Update
  patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch
  (git-fixes CVE-2024-43867 bsc#1229493).
- Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch
  (git-fixes CVE-2024-43829 bsc#1229341).
- Update
  patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch
  (git-fixes CVE-2024-43863 bsc#1229497).
- Update
  patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch
  (git-fixes CVE-2024-42315 bsc#1229354).
- Update
  patches.suse/gpio-prevent-potential-speculation-leaks-in-gpio_dev.patch
  (stable-fixes CVE-2024-44931 bsc#1229837).
- Update
  patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch
  (git-fixes CVE-2024-42311 bsc#1229413).
- Update
  patches.suse/iio-Fix-the-sorting-functionality-in-iio_gts_build_a.patch
  (git-fixes CVE-2024-43825 bsc#1229298).
- Update
  patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch
  (git-fixes CVE-2024-43858 bsc#1229414).
- Update
  patches.suse/jfs-Fix-shift-out-of-bounds-in-dbDiscardAG.patch
  (git-fixes CVE-2024-44938 bsc#1229792).
- Update
  patches.suse/jfs-fix-null-ptr-deref-in-dtInsertEntry.patch
  (git-fixes CVE-2024-44939 bsc#1229820).
- Update
  patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch
  (git-fixes CVE-2024-42292 bsc#1229373).
- Update
  patches.suse/kvm-s390-Reject-memory-region-operations-for-ucontrol-VMs.patch
  (git-fixes bsc#1229168 CVE-2024-43819 bsc#1229290).
- Update
  patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch
  (git-fixes CVE-2024-43830 bsc#1229305).
- Update
  patches.suse/lib-objagg-Fix-general-protection-fault.patch
  (git-fixes CVE-2024-43846 bsc#1229360).
- Update
  patches.suse/libbpf-Use-OPTS_SET-macro-in-bpf_xdp_query.patch
  (git-fixes CVE-2024-27050 bsc#1223767).
- Update
  patches.suse/mISDN-Fix-a-use-after-free-in-hfcmulti_tx.patch
  (git-fixes CVE-2024-42280 bsc#1229388).
- Update
  patches.suse/mailbox-mtk-cmdq-Move-devm_mbox_controller_register-.patch
  (git-fixes CVE-2024-42319 bsc#1229350).
- Update
  patches.suse/md-raid5-fix-deadlock-that-raid5d-wait-for-itself-to-clear-MD_SB_CHANGE_PENDING-151f.patch
  (git-fixes CVE-2024-39476 bsc#1227437).
- Update
  patches.suse/media-imx-pxp-Fix-ERR_PTR-dereference-in-pxp_probe.patch
  (git-fixes CVE-2024-42303 bsc#1229365).
- Update
  patches.suse/media-pci-ivtv-Add-check-for-DMA-map-result.patch
  (git-fixes CVE-2024-43877 bsc#1229484).
- Update
  patches.suse/media-v4l-async-Fix-NULL-pointer-dereference-in-addi.patch
  (git-fixes CVE-2024-43833 bsc#1229299).
- Update
  patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch
  (git-fixes CVE-2024-42313 bsc#1229356).
- Update
  patches.suse/media-xc2028-avoid-use-after-free-in-load_firmware_c.patch
  (stable-fixes CVE-2024-43900 bsc#1229756).
- Update
  patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch
  (git-fixes CVE-2024-43892 bsc#1229761).
- Update
  patches.suse/net-drop-bad-gso-csum_start-and-offset-in-virtio_net.patch
  (git-fixes CVE-2024-43897 bsc#1229752).
- Update
  patches.suse/net-iucv-fix-use-after-free-in-iucv_sock_close.patch
  (bsc#1228973 CVE-2024-42271 bsc#1229400).
- Update patches.suse/net-missing-check-virtio.patch (git-fixes
  CVE-2024-43817 bsc#1229312).
- Update
  patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch
  (git-fixes CVE-2024-43861 bsc#1229500).
- Update
  patches.suse/nfs-pass-explicit-offset-count-to-trace-events.patch
  (git-fixes CVE-2024-43826 bsc#1229294).
- Update
  patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch
  (git-fixes CVE-2024-42276 bsc#1229410).
- Update
  patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch
  (git-fixes CVE-2024-43889 bsc#1229743).
- Update
  patches.suse/remoteproc-imx_rproc-Skip-over-memory-region-when-no.patch
  (git-fixes CVE-2024-43860 bsc#1229319).
- Update
  patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch
  (git-fixes bsc#1229173 CVE-2024-42320 bsc#1229349).
- Update
  patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch
  (bsc#1228857 CVE-2024-43816 bsc#1229318).
- Update
  patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch
  (bsc#1228850 CVE-2024-42287 bsc#1229392).
- Update
  patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch
  (bsc#1228850 CVE-2024-42289 bsc#1229399).
- Update
  patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch
  (bsc#1228850 CVE-2024-42288 bsc#1229398).
- Update
  patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch
  (bsc#1228850 CVE-2024-42286 bsc#1229395).
- Update
  patches.suse/serial-core-check-uartclk-for-zero-to-avoid-divide-b.patch
  (stable-fixes CVE-2024-43893 bsc#1229759).
- Update
  patches.suse/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch
  (git-fixes CVE-2024-43849 bsc#1229307).
- Update
  patches.suse/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch
  (git-fixes CVE-2024-43851 bsc#1229313).
- Update
  patches.suse/spi-microchip-core-ensure-TX-and-RX-FIFOs-are-empty-.patch
  (git-fixes CVE-2024-42279 bsc#1229390).
- Update
  patches.suse/usb-vhci-hcd-Do-not-drop-references-before-new-refer.patch
  (stable-fixes CVE-2024-43883 bsc#1229707).
- Update
  patches.suse/vhost-vsock-always-initialize-seqpacket_allow.patch
  (git-fixes CVE-2024-43873 bsc#1229488).
- Update
  patches.suse/wifi-ath12k-change-DMA-direction-while-mapping-reinj.patch
  (git-fixes CVE-2024-43881 bsc#1229480).
- Update
  patches.suse/wifi-ath12k-fix-invalid-memory-access-while-processi.patch
  (git-fixes CVE-2024-43847 bsc#1229291).
- Update
  patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch
  (git-fixes CVE-2024-43879 bsc#1229482).
- Update
  patches.suse/wifi-nl80211-disallow-setting-special-AP-channel-wid.patch
  (stable-fixes CVE-2024-43912 bsc#1229830).
- Update
  patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch
  (git-fixes CVE-2024-43842 bsc#1229317).
- Update
  patches.suse/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch
  (git-fixes CVE-2024-43841 bsc#1229304).
- commit 140ec33</changelog>
  <changelog author="tiwai@suse.de" date="1725105600">- dmaengine: dw: Add memory bus width verification (git-fixes).
- dmaengine: dw: Add peripheral bus width verification
  (git-fixes).
- soundwire: stream: fix programming slave ports for non-continous
  port maps (git-fixes).
- commit b7e9784</changelog>
  <changelog author="tiwai@suse.de" date="1725192000">- usb: cdnsp: fix for Link TRB with TC (git-fixes).
- usb: dwc3: st: add missing depopulate in probe error path
  (git-fixes).
- usb: dwc3: st: fix probed platform device ref count on probe
  error path (git-fixes).
- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
  remove_power_attributes() (git-fixes).
- usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).
- usb: dwc3: omap: add missing depopulate in probe error path
  (git-fixes).
- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
  (git-fixes).
- soc: qcom: pmic_glink: Actually communicate when remote goes
  down (git-fixes).
- soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).
- commit 7121142</changelog>
  <changelog author="ailiop@suse.com" date="1725192001">- xfs: Fix the owner setting issue for rmap query in xfs fsmap
  (git-fixes).
- commit 49b5eec</changelog>
  <changelog author="ailiop@suse.com" date="1725192002">- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code
  (git-fixes).
- commit 288ad9b</changelog>
  <changelog author="ailiop@suse.com" date="1725192003">- xfs: Fix missing interval for missing_owner in xfs fsmap
  (git-fixes).
- commit 5448ab5</changelog>
  <changelog author="ohering@suse.de" date="1725278400">- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).
- commit 4dc1da1</changelog>
  <changelog author="osalvador@suse.de" date="1725278401">- mm/sparsemem: fix race in accessing memory_section-&gt;usage
  (bsc#1221326 CVE-2023-52489).
- commit 6aa8957</changelog>
  <changelog author="osalvador@suse.de" date="1725278402">- mm, kmsan: fix infinite recursion due to RCU critical section
  (git-fixes).
- commit 16ad73a</changelog>
  <changelog author="osalvador@suse.de" date="1725278403">- mm: prevent derefencing NULL ptr in pfn_section_valid()
  (git-fixes).
- commit 35f619d</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278404">- bluetooth/l2cap: sync sock recv cb and release (bsc#1228576
  CVE-2024-41062).
- commit 6553526</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278405">- Bluetooth: L2CAP: Fix deadlock (git-fixes).
- commit 13aba13</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278406">- Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).
- commit 1bec58d</changelog>
  <changelog author="lhenriques@suse.de" date="1725278407">- ceph: periodically flush the cap releases (bsc#1230056).
- commit e22b6e0</changelog>
</package>
<package pkgid="de2f8cc3e89f41c424dd4a104628345cbdc3da43bc4bdb76a4b95d47a8461ea3" name="cluster-md-kmp-azure" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.8.11.1"/>
  <changelog author="lhenriques@suse.de" date="1725019200">- virtiofs: forbid newlines in tags (bsc#1229940).
- commit 61514ce</changelog>
  <changelog author="lhenriques@suse.de" date="1725019201">- blacklist.conf: add 053fc4f755ad fuse: fix UAF in rcu pathwalks
  This commit breaks kABI and the data structure has no free room for the
  extra field, i.e. memcpy would fail to copy the additional member added by
  this patch.
- commit 941b81c</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019202">- iommufd/device: Fix hwpt at err_unresv in
  iommufd_device_do_replace() (git-fixes).
- commit bbc9a65</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019203">- iommu/vt-d: Fix identity map bounds in si_domain_init()
  (git-fixes).
- commit b4d27e5</changelog>
  <changelog author="lduncan@suse.com" date="1725019204">- scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315
  CVE-2024-43821).
- commit eb73e94</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019205">- iommu/amd: Convert comma to semicolon (git-fixes).
- commit 2714d8b</changelog>
  <changelog author="mkoutny@suse.com" date="1725019206">- Update
  patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch
  (git-fixes CVE-2024-35902 bsc#1224496).
- Update
  patches.suse/ASoC-TAS2781-Fix-tasdev_load_calibrated_data.patch
  (git-fixes CVE-2024-42278 bsc#1229403).
- Update
  patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch
  (git-fixes CVE-2024-43818 bsc#1229296).
- Update
  patches.suse/ASoC-fsl-fsl_qmc_audio-Check-devm_kasprintf-returned.patch
  (git-fixes CVE-2024-42298 bsc#1229369).
- Update
  patches.suse/Bluetooth-MGMT-Add-error-handling-to-pair_device.patch
  (git-fixes CVE-2024-43884 bsc#1229739).
- Update
  patches.suse/KVM-Always-flush-async-PF-workqueue-when-vCPU-is-bei.patch
  (git-fixes CVE-2024-26976 bsc#1223635).
- Update
  patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch
  (git-fixes CVE-2024-42302 bsc#1229366).
- Update
  patches.suse/PCI-endpoint-Clean-up-error-handling-in-vpci_scan_bu.patch
  (git-fixes CVE-2024-43875 bsc#1229486).
- Update
  patches.suse/PCI-endpoint-pci-epf-test-Make-use-of-cached-epc_fea.patch
  (git-fixes CVE-2024-43824 bsc#1229320).
- Update
  patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch
  (git-fixes CVE-2024-43823 bsc#1229303).
- Update
  patches.suse/PCI-rcar-Demote-WARN-to-dev_warn_ratelimited-in-rcar.patch
  (git-fixes CVE-2024-43876 bsc#1229485).
- Update
  patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch
  (git-fixes CVE-2024-43872 bsc#1229489).
- Update
  patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch
  (git-fixes CVE-2024-42285 bsc#1229381).
- Update
  patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch
  (bsc#1208783 CVE-2024-42274 bsc#1229417).
- Update
  patches.suse/SUNRPC-add-a-missing-rpc_stat-for-TCP-TLS.patch
  (git-fixes CVE-2024-36907 bsc#1225751).
- Update
  patches.suse/bpf-arm64-Fix-trampoline-for-BPF_TRAMP_F_CALL_ORIG.patch
  (git-fixes CVE-2024-43840 bsc#1229344).
- Update
  patches.suse/btrfs-fix-double-inode-unlock-for-direct-IO-sync-wri.patch
  (git-fixes CVE-2024-43885 bsc#1229747).
- Update
  patches.suse/btrfs-fix-extent-map-use-after-free-when-adding-page.patch
  (git-fixes CVE-2024-42314 bsc#1229355).
- Update
  patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch
  (bsc#1228801 CVE-2024-43853 bsc#1229292).
- Update
  patches.suse/crypto-ccp-Fix-null-pointer-dereference-in-__sev_snp.patch
  (git-fixes CVE-2024-43874 bsc#1229487).
- Update
  patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch
  (git-fixes CVE-2024-43871 bsc#1229490).
- Update
  patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch
  (git-fixes CVE-2024-43856 bsc#1229346).
- Update
  patches.suse/drm-admgpu-fix-dereferencing-null-pointer-context.patch
  (stable-fixes CVE-2024-43906 bsc#1229785).
- Update
  patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch
  (stable-fixes CVE-2024-43903 bsc#1229781).
- Update
  patches.suse/drm-amd-display-Add-null-checker-before-passing-vari.patch
  (stable-fixes CVE-2024-43902 bsc#1229767).
- Update
  patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch
  (stable-fixes CVE-2024-43895 bsc#1229755).
- Update
  patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch
  (stable-fixes CVE-2024-43905 bsc#1229784).
- Update
  patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch
  (stable-fixes CVE-2024-43908 bsc#1229788).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch
  (stable-fixes CVE-2024-43909 bsc#1229789).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch
  (stable-fixes CVE-2024-43907 bsc#1229787).
- Update
  patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch
  (git-fixes CVE-2024-43894 bsc#1229746).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch
  (git-fixes CVE-2024-42310 bsc#1229358).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch
  (git-fixes CVE-2024-42309 bsc#1229359).
- Update
  patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch
  (git-fixes CVE-2024-43867 bsc#1229493).
- Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch
  (git-fixes CVE-2024-43829 bsc#1229341).
- Update
  patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch
  (git-fixes CVE-2024-43863 bsc#1229497).
- Update
  patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch
  (git-fixes CVE-2024-42315 bsc#1229354).
- Update
  patches.suse/gpio-prevent-potential-speculation-leaks-in-gpio_dev.patch
  (stable-fixes CVE-2024-44931 bsc#1229837).
- Update
  patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch
  (git-fixes CVE-2024-42311 bsc#1229413).
- Update
  patches.suse/iio-Fix-the-sorting-functionality-in-iio_gts_build_a.patch
  (git-fixes CVE-2024-43825 bsc#1229298).
- Update
  patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch
  (git-fixes CVE-2024-43858 bsc#1229414).
- Update
  patches.suse/jfs-Fix-shift-out-of-bounds-in-dbDiscardAG.patch
  (git-fixes CVE-2024-44938 bsc#1229792).
- Update
  patches.suse/jfs-fix-null-ptr-deref-in-dtInsertEntry.patch
  (git-fixes CVE-2024-44939 bsc#1229820).
- Update
  patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch
  (git-fixes CVE-2024-42292 bsc#1229373).
- Update
  patches.suse/kvm-s390-Reject-memory-region-operations-for-ucontrol-VMs.patch
  (git-fixes bsc#1229168 CVE-2024-43819 bsc#1229290).
- Update
  patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch
  (git-fixes CVE-2024-43830 bsc#1229305).
- Update
  patches.suse/lib-objagg-Fix-general-protection-fault.patch
  (git-fixes CVE-2024-43846 bsc#1229360).
- Update
  patches.suse/libbpf-Use-OPTS_SET-macro-in-bpf_xdp_query.patch
  (git-fixes CVE-2024-27050 bsc#1223767).
- Update
  patches.suse/mISDN-Fix-a-use-after-free-in-hfcmulti_tx.patch
  (git-fixes CVE-2024-42280 bsc#1229388).
- Update
  patches.suse/mailbox-mtk-cmdq-Move-devm_mbox_controller_register-.patch
  (git-fixes CVE-2024-42319 bsc#1229350).
- Update
  patches.suse/md-raid5-fix-deadlock-that-raid5d-wait-for-itself-to-clear-MD_SB_CHANGE_PENDING-151f.patch
  (git-fixes CVE-2024-39476 bsc#1227437).
- Update
  patches.suse/media-imx-pxp-Fix-ERR_PTR-dereference-in-pxp_probe.patch
  (git-fixes CVE-2024-42303 bsc#1229365).
- Update
  patches.suse/media-pci-ivtv-Add-check-for-DMA-map-result.patch
  (git-fixes CVE-2024-43877 bsc#1229484).
- Update
  patches.suse/media-v4l-async-Fix-NULL-pointer-dereference-in-addi.patch
  (git-fixes CVE-2024-43833 bsc#1229299).
- Update
  patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch
  (git-fixes CVE-2024-42313 bsc#1229356).
- Update
  patches.suse/media-xc2028-avoid-use-after-free-in-load_firmware_c.patch
  (stable-fixes CVE-2024-43900 bsc#1229756).
- Update
  patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch
  (git-fixes CVE-2024-43892 bsc#1229761).
- Update
  patches.suse/net-drop-bad-gso-csum_start-and-offset-in-virtio_net.patch
  (git-fixes CVE-2024-43897 bsc#1229752).
- Update
  patches.suse/net-iucv-fix-use-after-free-in-iucv_sock_close.patch
  (bsc#1228973 CVE-2024-42271 bsc#1229400).
- Update patches.suse/net-missing-check-virtio.patch (git-fixes
  CVE-2024-43817 bsc#1229312).
- Update
  patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch
  (git-fixes CVE-2024-43861 bsc#1229500).
- Update
  patches.suse/nfs-pass-explicit-offset-count-to-trace-events.patch
  (git-fixes CVE-2024-43826 bsc#1229294).
- Update
  patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch
  (git-fixes CVE-2024-42276 bsc#1229410).
- Update
  patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch
  (git-fixes CVE-2024-43889 bsc#1229743).
- Update
  patches.suse/remoteproc-imx_rproc-Skip-over-memory-region-when-no.patch
  (git-fixes CVE-2024-43860 bsc#1229319).
- Update
  patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch
  (git-fixes bsc#1229173 CVE-2024-42320 bsc#1229349).
- Update
  patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch
  (bsc#1228857 CVE-2024-43816 bsc#1229318).
- Update
  patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch
  (bsc#1228850 CVE-2024-42287 bsc#1229392).
- Update
  patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch
  (bsc#1228850 CVE-2024-42289 bsc#1229399).
- Update
  patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch
  (bsc#1228850 CVE-2024-42288 bsc#1229398).
- Update
  patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch
  (bsc#1228850 CVE-2024-42286 bsc#1229395).
- Update
  patches.suse/serial-core-check-uartclk-for-zero-to-avoid-divide-b.patch
  (stable-fixes CVE-2024-43893 bsc#1229759).
- Update
  patches.suse/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch
  (git-fixes CVE-2024-43849 bsc#1229307).
- Update
  patches.suse/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch
  (git-fixes CVE-2024-43851 bsc#1229313).
- Update
  patches.suse/spi-microchip-core-ensure-TX-and-RX-FIFOs-are-empty-.patch
  (git-fixes CVE-2024-42279 bsc#1229390).
- Update
  patches.suse/usb-vhci-hcd-Do-not-drop-references-before-new-refer.patch
  (stable-fixes CVE-2024-43883 bsc#1229707).
- Update
  patches.suse/vhost-vsock-always-initialize-seqpacket_allow.patch
  (git-fixes CVE-2024-43873 bsc#1229488).
- Update
  patches.suse/wifi-ath12k-change-DMA-direction-while-mapping-reinj.patch
  (git-fixes CVE-2024-43881 bsc#1229480).
- Update
  patches.suse/wifi-ath12k-fix-invalid-memory-access-while-processi.patch
  (git-fixes CVE-2024-43847 bsc#1229291).
- Update
  patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch
  (git-fixes CVE-2024-43879 bsc#1229482).
- Update
  patches.suse/wifi-nl80211-disallow-setting-special-AP-channel-wid.patch
  (stable-fixes CVE-2024-43912 bsc#1229830).
- Update
  patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch
  (git-fixes CVE-2024-43842 bsc#1229317).
- Update
  patches.suse/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch
  (git-fixes CVE-2024-43841 bsc#1229304).
- commit 140ec33</changelog>
  <changelog author="tiwai@suse.de" date="1725105600">- dmaengine: dw: Add memory bus width verification (git-fixes).
- dmaengine: dw: Add peripheral bus width verification
  (git-fixes).
- soundwire: stream: fix programming slave ports for non-continous
  port maps (git-fixes).
- commit b7e9784</changelog>
  <changelog author="tiwai@suse.de" date="1725192000">- usb: cdnsp: fix for Link TRB with TC (git-fixes).
- usb: dwc3: st: add missing depopulate in probe error path
  (git-fixes).
- usb: dwc3: st: fix probed platform device ref count on probe
  error path (git-fixes).
- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
  remove_power_attributes() (git-fixes).
- usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).
- usb: dwc3: omap: add missing depopulate in probe error path
  (git-fixes).
- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
  (git-fixes).
- soc: qcom: pmic_glink: Actually communicate when remote goes
  down (git-fixes).
- soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).
- commit 7121142</changelog>
  <changelog author="ailiop@suse.com" date="1725192001">- xfs: Fix the owner setting issue for rmap query in xfs fsmap
  (git-fixes).
- commit 49b5eec</changelog>
  <changelog author="ailiop@suse.com" date="1725192002">- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code
  (git-fixes).
- commit 288ad9b</changelog>
  <changelog author="ailiop@suse.com" date="1725192003">- xfs: Fix missing interval for missing_owner in xfs fsmap
  (git-fixes).
- commit 5448ab5</changelog>
  <changelog author="ohering@suse.de" date="1725278400">- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).
- commit 4dc1da1</changelog>
  <changelog author="osalvador@suse.de" date="1725278401">- mm/sparsemem: fix race in accessing memory_section-&gt;usage
  (bsc#1221326 CVE-2023-52489).
- commit 6aa8957</changelog>
  <changelog author="osalvador@suse.de" date="1725278402">- mm, kmsan: fix infinite recursion due to RCU critical section
  (git-fixes).
- commit 16ad73a</changelog>
  <changelog author="osalvador@suse.de" date="1725278403">- mm: prevent derefencing NULL ptr in pfn_section_valid()
  (git-fixes).
- commit 35f619d</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278404">- bluetooth/l2cap: sync sock recv cb and release (bsc#1228576
  CVE-2024-41062).
- commit 6553526</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278405">- Bluetooth: L2CAP: Fix deadlock (git-fixes).
- commit 13aba13</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278406">- Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).
- commit 1bec58d</changelog>
  <changelog author="lhenriques@suse.de" date="1725278407">- ceph: periodically flush the cap releases (bsc#1230056).
- commit e22b6e0</changelog>
</package>
<package pkgid="f6db6f3cd04a17f5c7fc96f4ee3c489b69d9683173031b2890902d34d4dcc1d2" name="cluster-md-kmp-azure" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.8.14.1"/>
  <changelog author="mwilck@suse.com" date="1727438400">- scsi: sd: Fix off-by-one error in
  sd_read_block_characteristics() (bsc#1223848).
- commit 621f2fb</changelog>
  <changelog author="ailiop@suse.com" date="1727697600">- afs: Revert "afs: Hide silly-rename files from userspace"
  (git-fixes).
- commit 11353bb</changelog>
  <changelog author="ailiop@suse.com" date="1727697601">- afs: Don't cross .backup mountpoint from backup volume
  (git-fixes).
- commit f35dae1</changelog>
  <changelog author="ailiop@suse.com" date="1727697602">- erofs: fix incorrect symlink detection in fast symlink
  (git-fixes).
- commit 2e1ae75</changelog>
  <changelog author="hare@suse.de" date="1727697603">- nvme-multipath: system fails to create generic nvme device
  (bsc#1228244).
- commit 4fc57d2</changelog>
  <changelog author="hare@suse.de" date="1727697604">- nvme-multipath: avoid hang on inaccessible namespaces
  (bsc#1228244).
- kcm: Serialise kcm_sendmsg() for the same socket
  (CVE-2024-44946,bsc#1230015).
- commit a84ca87</changelog>
  <changelog author="hare@suse.de" date="1727697605">- kcm: Serialise kcm_sendmsg() for the same socket (CVE-2024-44946
  bsc#1230015).
- commit 4310760</changelog>
  <changelog author="tiwai@suse.de" date="1727697606">- Move upstreamed SCSI patches into sorted section
- commit aba5747</changelog>
  <changelog author="tiwai@suse.de" date="1727697607">- mailbox: bcm2835: Fix timeout during suspend mode (git-fixes).
- mailbox: rockchip: fix a typo in module autoloading (git-fixes).
- i2c: designware: fix controller is holding SCL low while ENABLE
  bit is disabled (git-fixes).
- drm/amd/display: handle nulled pipe context in DCE110's
  set_drr() (git-fixes).
- drm/amdgpu: Fix get each xcp macro (git-fixes).
- tomoyo: fallback to realpath if symlink's pathname does not
  exist (git-fixes).
- cxl/pci: Fix to record only non-zero ranges (git-fixes).
- ata: libata-scsi: Fix ata_msense_control() CDL page reporting
  (git-fixes).
- firmware_loader: Block path traversal (git-fixes).
- driver core: Fix a potential null-ptr-deref in
  module_add_driver() (git-fixes).
- driver core: Fix error handling in driver API device_rename()
  (git-fixes).
- ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()
  (git-fixes).
- iio: magnetometer: ak8975: Fix reading for ak099xx sensors
  (git-fixes).
- iio: chemical: bme680: Fix read/write ops to device by adding
  mutexes (git-fixes).
- ABI: testing: fix admv8818 attr description (git-fixes).
- iio: adc: ad7606: fix standby gpio state to match the
  documentation (git-fixes).
- iio: adc: ad7606: fix oversampling gpio array (git-fixes).
- tty: rp2: Fix reset with non forgiving PCIe host bridges
  (git-fixes).
- USB: class: CDC-ACM: fix race between get_serial and set_serial
  (git-fixes).
- usb: dwc2: drd: fix clock gating on USB role switch (git-fixes).
- usb: cdnsp: Fix incorrect usb_request status (git-fixes).
- USB: usbtmc: prevent kernel-usb-infoleak (git-fixes).
- USB: serial: kobil_sct: restore initial terminal settings
  (git-fixes).
- xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and
  freeing them (git-fixes).
- usb: dwc2: Skip clock gating on Broadcom SoCs (git-fixes).
- spi: atmel-quadspi: Avoid overwriting delay register settings
  (git-fixes).
- spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
  (git-fixes).
- spi: atmel-quadspi: Undo runtime PM changes at driver exit time
  (git-fixes).
- rtc: at91sam9: fix OF node leak in probe() error path
  (git-fixes).
- i3c: master: svc: Fix use after free vulnerability in
  svc_i3c_master Driver Due to Race Condition (git-fixes).
- remoteproc: k3-r5: Fix error handling when power-up failed
  (git-fixes).
- remoteproc: imx_rproc: Initialize workqueue earlier (git-fixes).
- remoteproc: imx_rproc: Correct ddr alias for i.MX8M (git-fixes).
- KEYS: prevent NULL pointer dereference in find_asymmetric_key()
  (git-fixes).
- media: i2c: ar0521: Use cansleep version of gpiod_set_value()
  (git-fixes).
- media: ov5675: Fix power on/off delay timings (git-fixes).
- media: sun4i_csi: Implement link validate for sun4i_csi subdev
  (git-fixes).
- media: platform: rzg2l-cru: rzg2l-csi2: Add missing
  MODULE_DEVICE_TABLE (git-fixes).
- media: venus: fix use after free bug in venus_remove due to
  race condition (git-fixes).
- media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
  (git-fixes).
- clk: ti: dra7-atl: Fix leak of of_nodes (git-fixes).
- watchdog: imx_sc_wdt: Don't disable WDT in suspend (git-fixes).
- pinctrl: single: fix missing error code in pcs_probe()
  (git-fixes).
- xz: cleanup CRC32 edits from 2018 (git-fixes).
- ata: pata_macio: Use WARN instead of BUG (stable-fixes).
- commit c5ab3ca</changelog>
  <changelog author="iivanov@suse.de" date="1727697608">- arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (bsc#1231120 CVE-2024-46822)
- commit cc6d7b5</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697609">- tracing: Fix overflow in get_free_elt() (git-fixes
  CVE-2024-43890 bsc#1229764).
- commit ceb524e</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697610">- tracing: Avoid possible softlockup in tracing_iter_reset()
  (git-fixes).
- commit d5df75c</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697611">- bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()
  (git-fixes).
- commit 1884922</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697612">- Refresh
  patches.suse/bpf-kprobe-remove-unused-declaring-of-bpf_kprobe_override.patch.
- commit 5a0b269</changelog>
  <changelog author="tiwai@suse.de" date="1727697613">- supported.conf: mark adiantum and xctr crypto modules as supported (bsc#1231035)
- commit 59d03d7</changelog>
  <changelog author="pmladek@suse.com" date="1727697614">- kthread: Fix task state in kthread worker if being frozen
  (bsc#1231146).
- commit fe88a62</changelog>
  <changelog author="tiwai@suse.de" date="1727784000">- USB: serial: pl2303: add device id for Macrosilicon MS3020
  (stable-fixes).
- powercap/intel_rapl: Add support for AMD family 1Ah
  (stable-fixes).
- ASoC: amd: yc: Add a quirk for MSI Bravo 17 (D7VEK)
  (stable-fixes).
- ASoC: tda7419: fix module autoloading (stable-fixes).
- ASoC: intel: fix module autoloading (stable-fixes).
- ASoC: Intel: soc-acpi-cht: Make Lenovo Yoga Tab 3 X90F DMI
  match less strict (stable-fixes).
- ALSA: hda: add HDMI codec ID for Intel PTL (stable-fixes).
- drm: komeda: Fix an issue related to normalized zpos
  (stable-fixes).
- can: mcp251xfd: mcp251xfd_ring_init(): check TX-coalescing
  configuration (stable-fixes).
- spi: spidev: Add missing spi_device_id for jg10309-01
  (git-fixes).
- spi: bcm63xx: Enable module autoloading (stable-fixes).
- spi: spidev: Add an entry for elgin,jg10309-01 (stable-fixes).
- hwmon: (asus-ec-sensors) remove VRM temp X570-E GAMING
  (stable-fixes).
- wifi: iwlwifi: clear trans-&gt;state earlier upon error
  (stable-fixes).
- wifi: mac80211: free skb on error path in
  ieee80211_beacon_get_ap() (stable-fixes).
- wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
  (stable-fixes).
- wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
  (stable-fixes).
- wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room()
  (stable-fixes).
- wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation
  (stable-fixes).
- wifi: iwlwifi: lower message level for FW buffer destination
  (stable-fixes).
- platform/x86: x86-android-tablets: Make Lenovo Yoga Tab 3 X90F
  DMI match less strict (stable-fixes).
- pinctrl: at91: make it work with current gpiolib (stable-fixes).
- can: mcp251xfd: properly indent labels (stable-fixes).
- commit a530f31</changelog>
  <changelog author="tiwai@suse.de" date="1727784001">- can: mcp251xfd: move mcp251xfd_timestamp_start()/stop() into
  mcp251xfd_chip_start/stop() (stable-fixes).
- Refresh
  patches.suse/can-mcp251xfd-clarify-the-meaning-of-timestamp.patch.
- commit 6779985</changelog>
  <changelog author="lhenriques@suse.de" date="1727784002">- cachefiles: fix dentry leak in cachefiles_open_file()
  (bsc#1231183).
- ceph: remove the incorrect Fw reference check when dirtying
  pages (bsc#1231182).
- commit ba82da7</changelog>
  <changelog author="tiwai@suse.de" date="1727784003">- ACPICA: executer/exsystem: Don't nag user about every Stall()
  violating the spec (git-fixes).
- ACPICA: Implement ACPI_WARNING_ONCE and ACPI_ERROR_ONCE
  (stable-fixes).
- commit f94e799</changelog>
</package>
<package pkgid="966365582713ee5ed23564f96d956806242e1ddad0817980c5f06d485a6be9ba" name="cluster-md-kmp-azure" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.8.14.1"/>
  <changelog author="mwilck@suse.com" date="1727438400">- scsi: sd: Fix off-by-one error in
  sd_read_block_characteristics() (bsc#1223848).
- commit 621f2fb</changelog>
  <changelog author="ailiop@suse.com" date="1727697600">- afs: Revert "afs: Hide silly-rename files from userspace"
  (git-fixes).
- commit 11353bb</changelog>
  <changelog author="ailiop@suse.com" date="1727697601">- afs: Don't cross .backup mountpoint from backup volume
  (git-fixes).
- commit f35dae1</changelog>
  <changelog author="ailiop@suse.com" date="1727697602">- erofs: fix incorrect symlink detection in fast symlink
  (git-fixes).
- commit 2e1ae75</changelog>
  <changelog author="hare@suse.de" date="1727697603">- nvme-multipath: system fails to create generic nvme device
  (bsc#1228244).
- commit 4fc57d2</changelog>
  <changelog author="hare@suse.de" date="1727697604">- nvme-multipath: avoid hang on inaccessible namespaces
  (bsc#1228244).
- kcm: Serialise kcm_sendmsg() for the same socket
  (CVE-2024-44946,bsc#1230015).
- commit a84ca87</changelog>
  <changelog author="hare@suse.de" date="1727697605">- kcm: Serialise kcm_sendmsg() for the same socket (CVE-2024-44946
  bsc#1230015).
- commit 4310760</changelog>
  <changelog author="tiwai@suse.de" date="1727697606">- Move upstreamed SCSI patches into sorted section
- commit aba5747</changelog>
  <changelog author="tiwai@suse.de" date="1727697607">- mailbox: bcm2835: Fix timeout during suspend mode (git-fixes).
- mailbox: rockchip: fix a typo in module autoloading (git-fixes).
- i2c: designware: fix controller is holding SCL low while ENABLE
  bit is disabled (git-fixes).
- drm/amd/display: handle nulled pipe context in DCE110's
  set_drr() (git-fixes).
- drm/amdgpu: Fix get each xcp macro (git-fixes).
- tomoyo: fallback to realpath if symlink's pathname does not
  exist (git-fixes).
- cxl/pci: Fix to record only non-zero ranges (git-fixes).
- ata: libata-scsi: Fix ata_msense_control() CDL page reporting
  (git-fixes).
- firmware_loader: Block path traversal (git-fixes).
- driver core: Fix a potential null-ptr-deref in
  module_add_driver() (git-fixes).
- driver core: Fix error handling in driver API device_rename()
  (git-fixes).
- ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()
  (git-fixes).
- iio: magnetometer: ak8975: Fix reading for ak099xx sensors
  (git-fixes).
- iio: chemical: bme680: Fix read/write ops to device by adding
  mutexes (git-fixes).
- ABI: testing: fix admv8818 attr description (git-fixes).
- iio: adc: ad7606: fix standby gpio state to match the
  documentation (git-fixes).
- iio: adc: ad7606: fix oversampling gpio array (git-fixes).
- tty: rp2: Fix reset with non forgiving PCIe host bridges
  (git-fixes).
- USB: class: CDC-ACM: fix race between get_serial and set_serial
  (git-fixes).
- usb: dwc2: drd: fix clock gating on USB role switch (git-fixes).
- usb: cdnsp: Fix incorrect usb_request status (git-fixes).
- USB: usbtmc: prevent kernel-usb-infoleak (git-fixes).
- USB: serial: kobil_sct: restore initial terminal settings
  (git-fixes).
- xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and
  freeing them (git-fixes).
- usb: dwc2: Skip clock gating on Broadcom SoCs (git-fixes).
- spi: atmel-quadspi: Avoid overwriting delay register settings
  (git-fixes).
- spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
  (git-fixes).
- spi: atmel-quadspi: Undo runtime PM changes at driver exit time
  (git-fixes).
- rtc: at91sam9: fix OF node leak in probe() error path
  (git-fixes).
- i3c: master: svc: Fix use after free vulnerability in
  svc_i3c_master Driver Due to Race Condition (git-fixes).
- remoteproc: k3-r5: Fix error handling when power-up failed
  (git-fixes).
- remoteproc: imx_rproc: Initialize workqueue earlier (git-fixes).
- remoteproc: imx_rproc: Correct ddr alias for i.MX8M (git-fixes).
- KEYS: prevent NULL pointer dereference in find_asymmetric_key()
  (git-fixes).
- media: i2c: ar0521: Use cansleep version of gpiod_set_value()
  (git-fixes).
- media: ov5675: Fix power on/off delay timings (git-fixes).
- media: sun4i_csi: Implement link validate for sun4i_csi subdev
  (git-fixes).
- media: platform: rzg2l-cru: rzg2l-csi2: Add missing
  MODULE_DEVICE_TABLE (git-fixes).
- media: venus: fix use after free bug in venus_remove due to
  race condition (git-fixes).
- media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
  (git-fixes).
- clk: ti: dra7-atl: Fix leak of of_nodes (git-fixes).
- watchdog: imx_sc_wdt: Don't disable WDT in suspend (git-fixes).
- pinctrl: single: fix missing error code in pcs_probe()
  (git-fixes).
- xz: cleanup CRC32 edits from 2018 (git-fixes).
- ata: pata_macio: Use WARN instead of BUG (stable-fixes).
- commit c5ab3ca</changelog>
  <changelog author="iivanov@suse.de" date="1727697608">- arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (bsc#1231120 CVE-2024-46822)
- commit cc6d7b5</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697609">- tracing: Fix overflow in get_free_elt() (git-fixes
  CVE-2024-43890 bsc#1229764).
- commit ceb524e</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697610">- tracing: Avoid possible softlockup in tracing_iter_reset()
  (git-fixes).
- commit d5df75c</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697611">- bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()
  (git-fixes).
- commit 1884922</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697612">- Refresh
  patches.suse/bpf-kprobe-remove-unused-declaring-of-bpf_kprobe_override.patch.
- commit 5a0b269</changelog>
  <changelog author="tiwai@suse.de" date="1727697613">- supported.conf: mark adiantum and xctr crypto modules as supported (bsc#1231035)
- commit 59d03d7</changelog>
  <changelog author="pmladek@suse.com" date="1727697614">- kthread: Fix task state in kthread worker if being frozen
  (bsc#1231146).
- commit fe88a62</changelog>
  <changelog author="tiwai@suse.de" date="1727784000">- USB: serial: pl2303: add device id for Macrosilicon MS3020
  (stable-fixes).
- powercap/intel_rapl: Add support for AMD family 1Ah
  (stable-fixes).
- ASoC: amd: yc: Add a quirk for MSI Bravo 17 (D7VEK)
  (stable-fixes).
- ASoC: tda7419: fix module autoloading (stable-fixes).
- ASoC: intel: fix module autoloading (stable-fixes).
- ASoC: Intel: soc-acpi-cht: Make Lenovo Yoga Tab 3 X90F DMI
  match less strict (stable-fixes).
- ALSA: hda: add HDMI codec ID for Intel PTL (stable-fixes).
- drm: komeda: Fix an issue related to normalized zpos
  (stable-fixes).
- can: mcp251xfd: mcp251xfd_ring_init(): check TX-coalescing
  configuration (stable-fixes).
- spi: spidev: Add missing spi_device_id for jg10309-01
  (git-fixes).
- spi: bcm63xx: Enable module autoloading (stable-fixes).
- spi: spidev: Add an entry for elgin,jg10309-01 (stable-fixes).
- hwmon: (asus-ec-sensors) remove VRM temp X570-E GAMING
  (stable-fixes).
- wifi: iwlwifi: clear trans-&gt;state earlier upon error
  (stable-fixes).
- wifi: mac80211: free skb on error path in
  ieee80211_beacon_get_ap() (stable-fixes).
- wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
  (stable-fixes).
- wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
  (stable-fixes).
- wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room()
  (stable-fixes).
- wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation
  (stable-fixes).
- wifi: iwlwifi: lower message level for FW buffer destination
  (stable-fixes).
- platform/x86: x86-android-tablets: Make Lenovo Yoga Tab 3 X90F
  DMI match less strict (stable-fixes).
- pinctrl: at91: make it work with current gpiolib (stable-fixes).
- can: mcp251xfd: properly indent labels (stable-fixes).
- commit a530f31</changelog>
  <changelog author="tiwai@suse.de" date="1727784001">- can: mcp251xfd: move mcp251xfd_timestamp_start()/stop() into
  mcp251xfd_chip_start/stop() (stable-fixes).
- Refresh
  patches.suse/can-mcp251xfd-clarify-the-meaning-of-timestamp.patch.
- commit 6779985</changelog>
  <changelog author="lhenriques@suse.de" date="1727784002">- cachefiles: fix dentry leak in cachefiles_open_file()
  (bsc#1231183).
- ceph: remove the incorrect Fw reference check when dirtying
  pages (bsc#1231182).
- commit ba82da7</changelog>
  <changelog author="tiwai@suse.de" date="1727784003">- ACPICA: executer/exsystem: Don't nag user about every Stall()
  violating the spec (git-fixes).
- ACPICA: Implement ACPI_WARNING_ONCE and ACPI_ERROR_ONCE
  (stable-fixes).
- commit f94e799</changelog>
</package>
<package pkgid="2ad8d1ae0971916fe5418ef8b83314fc880798dbce28ca299b5ffb9d986cf175" name="cluster-md-kmp-azure" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.8.17.2"/>
  <changelog author="tiwai@suse.de" date="1730721600">- Add alt-commit to AMDGPU patch
- commit 9e50980</changelog>
  <changelog author="vbabka@suse.cz" date="1730721601">- mm: split critical region in remap_file_pages() and invoke
  LSMs in between (CVE-2024-47745 bsc#1232135 git-fix).
- commit 8228ecb</changelog>
  <changelog author="dwagner@suse.de" date="1730721602">- nvme: re-fix error-handling for io_uring nvme-passthrough
  (git-fixes).
- nvmet-auth: assign dh_key to NULL after kfree_sensitive
  (git-fixes).
- nvme-pci: fix race condition between reset and
  nvme_dev_disable() (git-fixes).
- nvme: null terminate nvme_tls_attrs (git-fixes).
- nvme-pci: set doorbell config before unquiescing (git-fixes).
- commit d7598b1</changelog>
  <changelog author="tiwai@suse.de" date="1730721603">- drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
  (CVE-2024-49991 bsc#1232282).
- commit 1b15839</changelog>
  <changelog author="vkarasulli@suse.de" date="1730721604">- tipc: guard against string buffer overrun (CVE-2024-49995
  bsc#1232432).
- commit ada263e</changelog>
  <changelog author="mfranc@suse.cz" date="1730721605">- net/xen-netback: prevent UAF in xenvif_flush_hash()
  (CVE-2024-49936 bsc#1232424).
- commit ae05dab</changelog>
  <changelog author="vkarasulli@suse.de" date="1730721606">- ext4: fix timer use-after-free on failed mount (CVE-2024-49960
  bsc#1232395).
- commit bd6997d</changelog>
  <changelog author="dwagner@suse.de" date="1730721607">- scsi: lpfc: Update lpfc version to 14.4.0.5 (bsc#1232757).
- scsi: lpfc: Support loopback tests with VMID enabled
  (bsc#1232757).
- scsi: lpfc: Revise TRACE_EVENT log flag severities from KERN_ERR
  to KERN_WARNING (bsc#1232757).
- scsi: lpfc: Ensure DA_ID handling completion before deleting
  an NPIV instance (bsc#1232757).
- scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo
  handler (bsc#1232757).
- scsi: lpfc: Restrict support for 32 byte CDBs to specific HBAs
  (bsc#1232757 bsc#1228119).
- scsi: lpfc: Update phba link state conditional before sending
  CMF_SYNC_WQE (bsc#1232757).
- scsi: lpfc: Add ELS_RSP cmd to the list of WQEs to flush in
  lpfc_els_flush_cmd() (bsc#1232757).
- scsi: lpfc: Remove trailing space after \n newline
  (bsc#1232757).
- commit 3cf27b4</changelog>
  <changelog author="tiwai@suse.de" date="1730721608">- Revert "ALSA: hda/conexant: Mute speakers at suspend / shutdown"
  (bsc#1228269).
- commit 13ce240</changelog>
  <changelog author="tiwai@suse.de" date="1730721609">- Move out-of-tree patch into a proper section
- commit c581359</changelog>
  <changelog author="dsterba@suse.com" date="1730721610">- Update references for patches.suse/tracing-timerlat-Fix-a-race-during-cpuhp-processing.patch (CVE-2024-49866 bsc#1232259 git-fixes)
- commit d9311d0</changelog>
  <changelog author="tiwai@suse.de" date="1730808000">- rpmsg: glink: Handle rejected intent request better (git-fixes).
- firmware: arm_scmi: Fix slab-use-after-free in
  scmi_bus_notifier() (git-fixes).
- commit 01fe6bf</changelog>
  <changelog author="tiwai@suse.de" date="1730808001">- ALSA: usb-audio: Add quirk for HP 320 FHD Webcam (bsc#1232768).
- commit 7c39137</changelog>
  <changelog author="jwiesner@suse.de" date="1730808002">- Update config files.
  c37e85c135ce ("clocksource: Loosen clocksource watchdog constraints")
  introduced a new default for the time skew measured by the clocksource
  watchdog. The value was raised from 100 to 125 microseconds. Reflect this
  change in the kernel config. This is an x86_64 option only.
- commit 14c1b2d</changelog>
  <changelog author="mfranc@suse.cz" date="1730808003">- scsi: elx: libefc: Fix potential use after free in
  efc_nport_vport_del() (CVE-2024-49852 bsc#1232819).
- commit 51395e6</changelog>
  <changelog author="oneukum@suse.com" date="1730808004">- media: bttv: use audio defaults for winfast2000 (git-fixes).
- commit 6e1da70</changelog>
  <changelog author="oneukum@suse.com" date="1730808005">- media: videobuf2: fix typo: vb2_dbuf -&gt; vb2_qbuf (git-fixes).
- commit 92209c4</changelog>
  <changelog author="oneukum@suse.com" date="1730808006">- media: core: v4l2-ioctl: check if ioctl is known to avoid NULL
  name (git-fixes).
- commit c862b93</changelog>
  <changelog author="krisman@suse.de" date="1730808007">- blk-mq: setup queue -&gt;tag_set before initializing hctx
  (CVE-2024-50081 bsc#1232501).
- commit 87d4a82</changelog>
  <changelog author="krisman@suse.de" date="1730808008">- ublk: don't allow user copy for unprivileged device
  (CVE-2024-50080 bsc#1232502).
- commit 267c92f</changelog>
</package>
<package pkgid="0fb107695408833808b4665ab21f108b391f3e7fc2426768910710a276a38ddc" name="cluster-md-kmp-azure" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.8.17.2"/>
  <changelog author="tiwai@suse.de" date="1730721600">- Add alt-commit to AMDGPU patch
- commit 9e50980</changelog>
  <changelog author="vbabka@suse.cz" date="1730721601">- mm: split critical region in remap_file_pages() and invoke
  LSMs in between (CVE-2024-47745 bsc#1232135 git-fix).
- commit 8228ecb</changelog>
  <changelog author="dwagner@suse.de" date="1730721602">- nvme: re-fix error-handling for io_uring nvme-passthrough
  (git-fixes).
- nvmet-auth: assign dh_key to NULL after kfree_sensitive
  (git-fixes).
- nvme-pci: fix race condition between reset and
  nvme_dev_disable() (git-fixes).
- nvme: null terminate nvme_tls_attrs (git-fixes).
- nvme-pci: set doorbell config before unquiescing (git-fixes).
- commit d7598b1</changelog>
  <changelog author="tiwai@suse.de" date="1730721603">- drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
  (CVE-2024-49991 bsc#1232282).
- commit 1b15839</changelog>
  <changelog author="vkarasulli@suse.de" date="1730721604">- tipc: guard against string buffer overrun (CVE-2024-49995
  bsc#1232432).
- commit ada263e</changelog>
  <changelog author="mfranc@suse.cz" date="1730721605">- net/xen-netback: prevent UAF in xenvif_flush_hash()
  (CVE-2024-49936 bsc#1232424).
- commit ae05dab</changelog>
  <changelog author="vkarasulli@suse.de" date="1730721606">- ext4: fix timer use-after-free on failed mount (CVE-2024-49960
  bsc#1232395).
- commit bd6997d</changelog>
  <changelog author="dwagner@suse.de" date="1730721607">- scsi: lpfc: Update lpfc version to 14.4.0.5 (bsc#1232757).
- scsi: lpfc: Support loopback tests with VMID enabled
  (bsc#1232757).
- scsi: lpfc: Revise TRACE_EVENT log flag severities from KERN_ERR
  to KERN_WARNING (bsc#1232757).
- scsi: lpfc: Ensure DA_ID handling completion before deleting
  an NPIV instance (bsc#1232757).
- scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo
  handler (bsc#1232757).
- scsi: lpfc: Restrict support for 32 byte CDBs to specific HBAs
  (bsc#1232757 bsc#1228119).
- scsi: lpfc: Update phba link state conditional before sending
  CMF_SYNC_WQE (bsc#1232757).
- scsi: lpfc: Add ELS_RSP cmd to the list of WQEs to flush in
  lpfc_els_flush_cmd() (bsc#1232757).
- scsi: lpfc: Remove trailing space after \n newline
  (bsc#1232757).
- commit 3cf27b4</changelog>
  <changelog author="tiwai@suse.de" date="1730721608">- Revert "ALSA: hda/conexant: Mute speakers at suspend / shutdown"
  (bsc#1228269).
- commit 13ce240</changelog>
  <changelog author="tiwai@suse.de" date="1730721609">- Move out-of-tree patch into a proper section
- commit c581359</changelog>
  <changelog author="dsterba@suse.com" date="1730721610">- Update references for patches.suse/tracing-timerlat-Fix-a-race-during-cpuhp-processing.patch (CVE-2024-49866 bsc#1232259 git-fixes)
- commit d9311d0</changelog>
  <changelog author="tiwai@suse.de" date="1730808000">- rpmsg: glink: Handle rejected intent request better (git-fixes).
- firmware: arm_scmi: Fix slab-use-after-free in
  scmi_bus_notifier() (git-fixes).
- commit 01fe6bf</changelog>
  <changelog author="tiwai@suse.de" date="1730808001">- ALSA: usb-audio: Add quirk for HP 320 FHD Webcam (bsc#1232768).
- commit 7c39137</changelog>
  <changelog author="jwiesner@suse.de" date="1730808002">- Update config files.
  c37e85c135ce ("clocksource: Loosen clocksource watchdog constraints")
  introduced a new default for the time skew measured by the clocksource
  watchdog. The value was raised from 100 to 125 microseconds. Reflect this
  change in the kernel config. This is an x86_64 option only.
- commit 14c1b2d</changelog>
  <changelog author="mfranc@suse.cz" date="1730808003">- scsi: elx: libefc: Fix potential use after free in
  efc_nport_vport_del() (CVE-2024-49852 bsc#1232819).
- commit 51395e6</changelog>
  <changelog author="oneukum@suse.com" date="1730808004">- media: bttv: use audio defaults for winfast2000 (git-fixes).
- commit 6e1da70</changelog>
  <changelog author="oneukum@suse.com" date="1730808005">- media: videobuf2: fix typo: vb2_dbuf -&gt; vb2_qbuf (git-fixes).
- commit 92209c4</changelog>
  <changelog author="oneukum@suse.com" date="1730808006">- media: core: v4l2-ioctl: check if ioctl is known to avoid NULL
  name (git-fixes).
- commit c862b93</changelog>
  <changelog author="krisman@suse.de" date="1730808007">- blk-mq: setup queue -&gt;tag_set before initializing hctx
  (CVE-2024-50081 bsc#1232501).
- commit 87d4a82</changelog>
  <changelog author="krisman@suse.de" date="1730808008">- ublk: don't allow user copy for unprivileged device
  (CVE-2024-50080 bsc#1232502).
- commit 267c92f</changelog>
</package>
<package pkgid="b6370fd4928545d565a1faad871d8b98a21c1e8ebb82a68420355d44c16e705e" name="cluster-md-kmp-azure" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.8.20.1"/>
  <changelog author="iivanov@suse.de" date="1733400000">- bpf, arm64: Remove garbage frame for struct_ops trampoline (git-fixes)
- commit e1353aa</changelog>
  <changelog author="msuchanek@suse.de" date="1733400001">- powerpc/fadump: Move fadump_cma_init to setup_arch() after
  initmem_init() (bsc#1215199).
- powerpc/fadump: Refactor and prepare fadump_cma_init for late
  init (bsc#1215199).
- powerpc/pseries: Use correct data types from pseries_hp_errorlog
  struct (bsc#1215199).
- powerpc/vdso: Inconditionally use CFUNC macro (bsc#1215199).
- powerpc/64s: Fix unnecessary copy to 0 when kernel is booted
  at address 0 (bsc#1215199).
- commit d36d28e</changelog>
  <changelog author="dsterba@suse.com" date="1733400002">- net: hns3: fix kernel crash when uninstalling driver (CVE-2024-50296 bsc#1233485)
- commit 6e41fd9</changelog>
  <changelog author="dsterba@suse.com" date="1733400003">- net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (CVE-2024-26596 bsc#1220355)
- commit 4861dc8</changelog>
  <changelog author="dsterba@suse.com" date="1733400004">- Bluetooth: btnxpuart: Fix random crash seen while removing driver (CVE-2024-46680 bsc#1230557)
- commit 3831431</changelog>
  <changelog author="dsterba@suse.com" date="1733400005">- Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test (bsc#1230557)
- commit 9ca14b5</changelog>
  <changelog author="dsterba@suse.com" date="1733400006">- drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() (CVE-2024-53056 bsc#1233568)
- commit 95cef70</changelog>
  <changelog author="dsterba@suse.com" date="1733400007">- wifi: iwlwifi: mvm: fix 6 GHz scan construction (CVE-2024-53055 bsc#1233550)
- commit c2d5beb</changelog>
  <changelog author="dsterba@suse.com" date="1733400008">- mctp i2c: handle NULL header address (CVE-2024-53043 bsc#1233523)
- commit 5a81634</changelog>
  <changelog author="dsterba@suse.com" date="1733400009">- drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability (CVE-2024-53051 bsc#1233547)
- commit 5262489</changelog>
  <changelog author="iivanov@suse.de" date="1733486400">- kABI: Restore exported __arm_smccc_sve_check (git-fixes)
- commit 3817c3a</changelog>
  <changelog author="iivanov@suse.de" date="1733486401">- arm64: dts: rockchip: remove num-slots property from (git-fixes)
- commit cb47197</changelog>
  <changelog author="iivanov@suse.de" date="1733486402">- arm64: dts: rockchip: Correct GPIO polarity on brcm BT nodes (git-fixes)
- commit ed87dba</changelog>
  <changelog author="tiwai@suse.de" date="1733486403">- can: j1939: j1939_session_new(): fix skb reference counting
  (git-fixes).
- can: mcp251xfd: mcp251xfd_get_tef_len(): work around erratum
  DS80000789E 6 (git-fixes).
- can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: sja1000: sja1000_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: hi311x: hi3110_can_ist(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors
  statistics (git-fixes).
- can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors
  statistics (git-fixes).
- can: hi311x: hi3110_can_ist(): fix potential use-after-free
  (git-fixes).
- can: sun4i_can: sun4i_can_err(): call can_change_state()
  even if cf is NULL (git-fixes).
- can: c_can: c_can_handle_bus_err(): update statistics if skb
  allocation fails (git-fixes).
- can: dev: can_set_termination(): allow sleeping GPIOs
  (git-fixes).
- HID: wacom: fix when get product name maybe null pointer
  (git-fixes).
- watchdog: rti: of: honor timeout-sec property (git-fixes).
- watchdog: mediatek: Make sure system reset gets asserted in
  mtk_wdt_restart() (git-fixes).
- watchdog: apple: Actually flush writes after requesting watchdog
  restart (git-fixes).
- iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
  (git-fixes).
- commit 535e699</changelog>
  <changelog author="tiwai@suse.de" date="1733486404">- netdevsim: copy addresses for both in and out paths (git-fixes).
- commit daf115e</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1733486405">- net/mlx5: fs, lock FTE when checking if active (CVE-2024-53121
  bsc#1234078).
- mlxsw: spectrum_ipip: Fix memory leak when changing remote
  IPv6 address (CVE-2024-50252 bsc#1233201).
- commit 06c045b</changelog>
  <changelog author="jgross@suse.com" date="1733486406">- vp_vdpa: fix id_table array not null terminated error
  (CVE-2024-53110 bsc#1234085).
- commit ffc9457</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1733486407">- net/mlx5e: kTLS, Fix incorrect page refcounting (CVE-2024-53138
  bsc#1234223).
- ice: protect XDP configuration with a mutex (CVE-2024-46765
  bsc#1230807).
- sch/netem: fix use after free in netem_dequeue (CVE-2024-46800
  bsc#1230827).
- commit c9f3783</changelog>
  <changelog author="tiwai@suse.de" date="1733572800">- drm/v3d: Enable Performance Counters before clearing them
  (git-fixes).
- drm/sti: Add __iomem for mixer_dbg_mxn's parameter (git-fixes).
- dma-fence: Use kernel's sort for merging fences (git-fixes).
- dma-fence: Fix reference leak on fence merge failure path
  (git-fixes).
- ASoC: mediatek: mt8188-mt6359: Remove hardcoded dmic codec
  (git-fixes).
- ASoC: SOF: ipc3-topology: fix resource leaks in
  sof_ipc3_widget_setup_comp_dai() (git-fixes).
- ALSA: usb-audio: Fix a DMA to stack memory bug (git-fixes).
- regmap: detach regmap from dev on regmap_exit (git-fixes).
- spi: mpc52xx: Add cancel_work_sync before module remove
  (git-fixes).
- mmc: core: Further prevent card detect during shutdown
  (git-fixes).
- commit 87e627e</changelog>
  <changelog author="tiwai@suse.de" date="1733572801">- ASoC: Intel: avs: da7219: Remove suspend_pre() and resume_post()
  (stable-fixes).
- ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360
  (NP730QFG) (stable-fixes).
- ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook
  430 G8 (stable-fixes).
- ALSA: usb-audio: add mixer mapping for Corsair HS80
  (stable-fixes).
- ALSA: hda/conexant: fix Z60MR100 startup pop issue
  (stable-fixes).
- commit 8c25a0a</changelog>
</package>
<package pkgid="2da76303718ccaf974f35c476a4c3a17bee1b8da747c4161311d017b6f63fc7e" name="cluster-md-kmp-azure" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.8.20.1"/>
  <changelog author="iivanov@suse.de" date="1733400000">- bpf, arm64: Remove garbage frame for struct_ops trampoline (git-fixes)
- commit e1353aa</changelog>
  <changelog author="msuchanek@suse.de" date="1733400001">- powerpc/fadump: Move fadump_cma_init to setup_arch() after
  initmem_init() (bsc#1215199).
- powerpc/fadump: Refactor and prepare fadump_cma_init for late
  init (bsc#1215199).
- powerpc/pseries: Use correct data types from pseries_hp_errorlog
  struct (bsc#1215199).
- powerpc/vdso: Inconditionally use CFUNC macro (bsc#1215199).
- powerpc/64s: Fix unnecessary copy to 0 when kernel is booted
  at address 0 (bsc#1215199).
- commit d36d28e</changelog>
  <changelog author="dsterba@suse.com" date="1733400002">- net: hns3: fix kernel crash when uninstalling driver (CVE-2024-50296 bsc#1233485)
- commit 6e41fd9</changelog>
  <changelog author="dsterba@suse.com" date="1733400003">- net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (CVE-2024-26596 bsc#1220355)
- commit 4861dc8</changelog>
  <changelog author="dsterba@suse.com" date="1733400004">- Bluetooth: btnxpuart: Fix random crash seen while removing driver (CVE-2024-46680 bsc#1230557)
- commit 3831431</changelog>
  <changelog author="dsterba@suse.com" date="1733400005">- Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test (bsc#1230557)
- commit 9ca14b5</changelog>
  <changelog author="dsterba@suse.com" date="1733400006">- drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() (CVE-2024-53056 bsc#1233568)
- commit 95cef70</changelog>
  <changelog author="dsterba@suse.com" date="1733400007">- wifi: iwlwifi: mvm: fix 6 GHz scan construction (CVE-2024-53055 bsc#1233550)
- commit c2d5beb</changelog>
  <changelog author="dsterba@suse.com" date="1733400008">- mctp i2c: handle NULL header address (CVE-2024-53043 bsc#1233523)
- commit 5a81634</changelog>
  <changelog author="dsterba@suse.com" date="1733400009">- drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability (CVE-2024-53051 bsc#1233547)
- commit 5262489</changelog>
  <changelog author="iivanov@suse.de" date="1733486400">- kABI: Restore exported __arm_smccc_sve_check (git-fixes)
- commit 3817c3a</changelog>
  <changelog author="iivanov@suse.de" date="1733486401">- arm64: dts: rockchip: remove num-slots property from (git-fixes)
- commit cb47197</changelog>
  <changelog author="iivanov@suse.de" date="1733486402">- arm64: dts: rockchip: Correct GPIO polarity on brcm BT nodes (git-fixes)
- commit ed87dba</changelog>
  <changelog author="tiwai@suse.de" date="1733486403">- can: j1939: j1939_session_new(): fix skb reference counting
  (git-fixes).
- can: mcp251xfd: mcp251xfd_get_tef_len(): work around erratum
  DS80000789E 6 (git-fixes).
- can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: sja1000: sja1000_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: hi311x: hi3110_can_ist(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors
  statistics (git-fixes).
- can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors
  statistics (git-fixes).
- can: hi311x: hi3110_can_ist(): fix potential use-after-free
  (git-fixes).
- can: sun4i_can: sun4i_can_err(): call can_change_state()
  even if cf is NULL (git-fixes).
- can: c_can: c_can_handle_bus_err(): update statistics if skb
  allocation fails (git-fixes).
- can: dev: can_set_termination(): allow sleeping GPIOs
  (git-fixes).
- HID: wacom: fix when get product name maybe null pointer
  (git-fixes).
- watchdog: rti: of: honor timeout-sec property (git-fixes).
- watchdog: mediatek: Make sure system reset gets asserted in
  mtk_wdt_restart() (git-fixes).
- watchdog: apple: Actually flush writes after requesting watchdog
  restart (git-fixes).
- iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
  (git-fixes).
- commit 535e699</changelog>
  <changelog author="tiwai@suse.de" date="1733486404">- netdevsim: copy addresses for both in and out paths (git-fixes).
- commit daf115e</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1733486405">- net/mlx5: fs, lock FTE when checking if active (CVE-2024-53121
  bsc#1234078).
- mlxsw: spectrum_ipip: Fix memory leak when changing remote
  IPv6 address (CVE-2024-50252 bsc#1233201).
- commit 06c045b</changelog>
  <changelog author="jgross@suse.com" date="1733486406">- vp_vdpa: fix id_table array not null terminated error
  (CVE-2024-53110 bsc#1234085).
- commit ffc9457</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1733486407">- net/mlx5e: kTLS, Fix incorrect page refcounting (CVE-2024-53138
  bsc#1234223).
- ice: protect XDP configuration with a mutex (CVE-2024-46765
  bsc#1230807).
- sch/netem: fix use after free in netem_dequeue (CVE-2024-46800
  bsc#1230827).
- commit c9f3783</changelog>
  <changelog author="tiwai@suse.de" date="1733572800">- drm/v3d: Enable Performance Counters before clearing them
  (git-fixes).
- drm/sti: Add __iomem for mixer_dbg_mxn's parameter (git-fixes).
- dma-fence: Use kernel's sort for merging fences (git-fixes).
- dma-fence: Fix reference leak on fence merge failure path
  (git-fixes).
- ASoC: mediatek: mt8188-mt6359: Remove hardcoded dmic codec
  (git-fixes).
- ASoC: SOF: ipc3-topology: fix resource leaks in
  sof_ipc3_widget_setup_comp_dai() (git-fixes).
- ALSA: usb-audio: Fix a DMA to stack memory bug (git-fixes).
- regmap: detach regmap from dev on regmap_exit (git-fixes).
- spi: mpc52xx: Add cancel_work_sync before module remove
  (git-fixes).
- mmc: core: Further prevent card detect during shutdown
  (git-fixes).
- commit 87e627e</changelog>
  <changelog author="tiwai@suse.de" date="1733572801">- ASoC: Intel: avs: da7219: Remove suspend_pre() and resume_post()
  (stable-fixes).
- ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360
  (NP730QFG) (stable-fixes).
- ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook
  430 G8 (stable-fixes).
- ALSA: usb-audio: add mixer mapping for Corsair HS80
  (stable-fixes).
- ALSA: hda/conexant: fix Z60MR100 startup pop issue
  (stable-fixes).
- commit 8c25a0a</changelog>
</package>
<package pkgid="6c42edd4bad2765dad42f1db9aa877523f53c33bee5d6e60032fbca6b3d79e33" name="cluster-md-kmp-azure" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.8.5.4"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- series.conf: cleanup
  Fix subsection header to silence series_insert error.
- commit 4628dc3</changelog>
  <changelog author="mkubecek@suse.cz" date="1717416001">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416002">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416005">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416006">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416008">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416013">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416014">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
</package>
<package pkgid="9d25650fb9b39373180ef03939986086bf8f726c8f47661afec6adeefa03bf86" name="cluster-md-kmp-azure" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.8.5.4"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- series.conf: cleanup
  Fix subsection header to silence series_insert error.
- commit 4628dc3</changelog>
  <changelog author="mkubecek@suse.cz" date="1717416001">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416002">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416005">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416006">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416008">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416013">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416014">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
</package>
<package pkgid="9e62a924abd03a691c60caf91a93079da8a2c23043720338fffc3824ac92e267" name="cluster-md-kmp-azure" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.8.8.2"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="4888bd4e42f4d25308448074b2dc460743d6cab9d800d316c262eb6170592805" name="cluster-md-kmp-azure" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.8.8.2"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="0ae66e63c48b09e959a6bccba7b155fa3e6ebb362c142409899d4eeec99746c8" name="cluster-md-kmp-default" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.2"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="b1cc34f305cba68a302cf343d3d9a327386b255da3de675a86b20c708f12f977" name="cluster-md-kmp-default" arch="ppc64le">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.2"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="bc2d8ba2bb72bea2ba43224c154edd8fccb8bdbfdaa6b1727d2c04e1b6939805" name="cluster-md-kmp-default" arch="s390x">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.2"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="13de159d55f8baaf9099ee3fac7b954785ce8f5c45d7c0f285dfee2261f6ce08" name="cluster-md-kmp-default" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.2"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="a8caff43a2e9e1d9359fd22a4a9ffc17a8988ebd76af217c65168400d6048602" name="cluster-md-kmp-default" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="73fb9b5a0176a4eab994828f0f68554740c75fa68a76ac8715500d281c109ba2" name="cluster-md-kmp-default" arch="ppc64le">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="784084fe253ed347ff2c5f5e781a63c7cd52ad450538e6f842f507b06fe27d91" name="cluster-md-kmp-default" arch="s390x">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="98378052350f54afa9566df5522c83259fab895c490735cbc73433008c7f77f2" name="cluster-md-kmp-default" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="f2e8adad7b8113cb47ad32f68cf11e164e882541d02a4741ec281145fa227c68" name="cluster-md-kmp-default" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.22.1"/>
  <changelog author="lduncan@suse.com" date="1725019200">- scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315
  CVE-2024-43821).
- commit eb73e94</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019201">- iommu/amd: Convert comma to semicolon (git-fixes).
- commit 2714d8b</changelog>
  <changelog author="mkoutny@suse.com" date="1725019202">- Update
  patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch
  (git-fixes CVE-2024-35902 bsc#1224496).
- Update
  patches.suse/ASoC-TAS2781-Fix-tasdev_load_calibrated_data.patch
  (git-fixes CVE-2024-42278 bsc#1229403).
- Update
  patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch
  (git-fixes CVE-2024-43818 bsc#1229296).
- Update
  patches.suse/ASoC-fsl-fsl_qmc_audio-Check-devm_kasprintf-returned.patch
  (git-fixes CVE-2024-42298 bsc#1229369).
- Update
  patches.suse/Bluetooth-MGMT-Add-error-handling-to-pair_device.patch
  (git-fixes CVE-2024-43884 bsc#1229739).
- Update
  patches.suse/KVM-Always-flush-async-PF-workqueue-when-vCPU-is-bei.patch
  (git-fixes CVE-2024-26976 bsc#1223635).
- Update
  patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch
  (git-fixes CVE-2024-42302 bsc#1229366).
- Update
  patches.suse/PCI-endpoint-Clean-up-error-handling-in-vpci_scan_bu.patch
  (git-fixes CVE-2024-43875 bsc#1229486).
- Update
  patches.suse/PCI-endpoint-pci-epf-test-Make-use-of-cached-epc_fea.patch
  (git-fixes CVE-2024-43824 bsc#1229320).
- Update
  patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch
  (git-fixes CVE-2024-43823 bsc#1229303).
- Update
  patches.suse/PCI-rcar-Demote-WARN-to-dev_warn_ratelimited-in-rcar.patch
  (git-fixes CVE-2024-43876 bsc#1229485).
- Update
  patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch
  (git-fixes CVE-2024-43872 bsc#1229489).
- Update
  patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch
  (git-fixes CVE-2024-42285 bsc#1229381).
- Update
  patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch
  (bsc#1208783 CVE-2024-42274 bsc#1229417).
- Update
  patches.suse/SUNRPC-add-a-missing-rpc_stat-for-TCP-TLS.patch
  (git-fixes CVE-2024-36907 bsc#1225751).
- Update
  patches.suse/bpf-arm64-Fix-trampoline-for-BPF_TRAMP_F_CALL_ORIG.patch
  (git-fixes CVE-2024-43840 bsc#1229344).
- Update
  patches.suse/btrfs-fix-double-inode-unlock-for-direct-IO-sync-wri.patch
  (git-fixes CVE-2024-43885 bsc#1229747).
- Update
  patches.suse/btrfs-fix-extent-map-use-after-free-when-adding-page.patch
  (git-fixes CVE-2024-42314 bsc#1229355).
- Update
  patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch
  (bsc#1228801 CVE-2024-43853 bsc#1229292).
- Update
  patches.suse/crypto-ccp-Fix-null-pointer-dereference-in-__sev_snp.patch
  (git-fixes CVE-2024-43874 bsc#1229487).
- Update
  patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch
  (git-fixes CVE-2024-43871 bsc#1229490).
- Update
  patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch
  (git-fixes CVE-2024-43856 bsc#1229346).
- Update
  patches.suse/drm-admgpu-fix-dereferencing-null-pointer-context.patch
  (stable-fixes CVE-2024-43906 bsc#1229785).
- Update
  patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch
  (stable-fixes CVE-2024-43903 bsc#1229781).
- Update
  patches.suse/drm-amd-display-Add-null-checker-before-passing-vari.patch
  (stable-fixes CVE-2024-43902 bsc#1229767).
- Update
  patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch
  (stable-fixes CVE-2024-43895 bsc#1229755).
- Update
  patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch
  (stable-fixes CVE-2024-43905 bsc#1229784).
- Update
  patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch
  (stable-fixes CVE-2024-43908 bsc#1229788).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch
  (stable-fixes CVE-2024-43909 bsc#1229789).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch
  (stable-fixes CVE-2024-43907 bsc#1229787).
- Update
  patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch
  (git-fixes CVE-2024-43894 bsc#1229746).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch
  (git-fixes CVE-2024-42310 bsc#1229358).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch
  (git-fixes CVE-2024-42309 bsc#1229359).
- Update
  patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch
  (git-fixes CVE-2024-43867 bsc#1229493).
- Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch
  (git-fixes CVE-2024-43829 bsc#1229341).
- Update
  patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch
  (git-fixes CVE-2024-43863 bsc#1229497).
- Update
  patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch
  (git-fixes CVE-2024-42315 bsc#1229354).
- Update
  patches.suse/gpio-prevent-potential-speculation-leaks-in-gpio_dev.patch
  (stable-fixes CVE-2024-44931 bsc#1229837).
- Update
  patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch
  (git-fixes CVE-2024-42311 bsc#1229413).
- Update
  patches.suse/iio-Fix-the-sorting-functionality-in-iio_gts_build_a.patch
  (git-fixes CVE-2024-43825 bsc#1229298).
- Update
  patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch
  (git-fixes CVE-2024-43858 bsc#1229414).
- Update
  patches.suse/jfs-Fix-shift-out-of-bounds-in-dbDiscardAG.patch
  (git-fixes CVE-2024-44938 bsc#1229792).
- Update
  patches.suse/jfs-fix-null-ptr-deref-in-dtInsertEntry.patch
  (git-fixes CVE-2024-44939 bsc#1229820).
- Update
  patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch
  (git-fixes CVE-2024-42292 bsc#1229373).
- Update
  patches.suse/kvm-s390-Reject-memory-region-operations-for-ucontrol-VMs.patch
  (git-fixes bsc#1229168 CVE-2024-43819 bsc#1229290).
- Update
  patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch
  (git-fixes CVE-2024-43830 bsc#1229305).
- Update
  patches.suse/lib-objagg-Fix-general-protection-fault.patch
  (git-fixes CVE-2024-43846 bsc#1229360).
- Update
  patches.suse/libbpf-Use-OPTS_SET-macro-in-bpf_xdp_query.patch
  (git-fixes CVE-2024-27050 bsc#1223767).
- Update
  patches.suse/mISDN-Fix-a-use-after-free-in-hfcmulti_tx.patch
  (git-fixes CVE-2024-42280 bsc#1229388).
- Update
  patches.suse/mailbox-mtk-cmdq-Move-devm_mbox_controller_register-.patch
  (git-fixes CVE-2024-42319 bsc#1229350).
- Update
  patches.suse/md-raid5-fix-deadlock-that-raid5d-wait-for-itself-to-clear-MD_SB_CHANGE_PENDING-151f.patch
  (git-fixes CVE-2024-39476 bsc#1227437).
- Update
  patches.suse/media-imx-pxp-Fix-ERR_PTR-dereference-in-pxp_probe.patch
  (git-fixes CVE-2024-42303 bsc#1229365).
- Update
  patches.suse/media-pci-ivtv-Add-check-for-DMA-map-result.patch
  (git-fixes CVE-2024-43877 bsc#1229484).
- Update
  patches.suse/media-v4l-async-Fix-NULL-pointer-dereference-in-addi.patch
  (git-fixes CVE-2024-43833 bsc#1229299).
- Update
  patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch
  (git-fixes CVE-2024-42313 bsc#1229356).
- Update
  patches.suse/media-xc2028-avoid-use-after-free-in-load_firmware_c.patch
  (stable-fixes CVE-2024-43900 bsc#1229756).
- Update
  patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch
  (git-fixes CVE-2024-43892 bsc#1229761).
- Update
  patches.suse/net-drop-bad-gso-csum_start-and-offset-in-virtio_net.patch
  (git-fixes CVE-2024-43897 bsc#1229752).
- Update
  patches.suse/net-iucv-fix-use-after-free-in-iucv_sock_close.patch
  (bsc#1228973 CVE-2024-42271 bsc#1229400).
- Update patches.suse/net-missing-check-virtio.patch (git-fixes
  CVE-2024-43817 bsc#1229312).
- Update
  patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch
  (git-fixes CVE-2024-43861 bsc#1229500).
- Update
  patches.suse/nfs-pass-explicit-offset-count-to-trace-events.patch
  (git-fixes CVE-2024-43826 bsc#1229294).
- Update
  patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch
  (git-fixes CVE-2024-42276 bsc#1229410).
- Update
  patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch
  (git-fixes CVE-2024-43889 bsc#1229743).
- Update
  patches.suse/remoteproc-imx_rproc-Skip-over-memory-region-when-no.patch
  (git-fixes CVE-2024-43860 bsc#1229319).
- Update
  patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch
  (git-fixes bsc#1229173 CVE-2024-42320 bsc#1229349).
- Update
  patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch
  (bsc#1228857 CVE-2024-43816 bsc#1229318).
- Update
  patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch
  (bsc#1228850 CVE-2024-42287 bsc#1229392).
- Update
  patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch
  (bsc#1228850 CVE-2024-42289 bsc#1229399).
- Update
  patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch
  (bsc#1228850 CVE-2024-42288 bsc#1229398).
- Update
  patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch
  (bsc#1228850 CVE-2024-42286 bsc#1229395).
- Update
  patches.suse/serial-core-check-uartclk-for-zero-to-avoid-divide-b.patch
  (stable-fixes CVE-2024-43893 bsc#1229759).
- Update
  patches.suse/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch
  (git-fixes CVE-2024-43849 bsc#1229307).
- Update
  patches.suse/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch
  (git-fixes CVE-2024-43851 bsc#1229313).
- Update
  patches.suse/spi-microchip-core-ensure-TX-and-RX-FIFOs-are-empty-.patch
  (git-fixes CVE-2024-42279 bsc#1229390).
- Update
  patches.suse/usb-vhci-hcd-Do-not-drop-references-before-new-refer.patch
  (stable-fixes CVE-2024-43883 bsc#1229707).
- Update
  patches.suse/vhost-vsock-always-initialize-seqpacket_allow.patch
  (git-fixes CVE-2024-43873 bsc#1229488).
- Update
  patches.suse/wifi-ath12k-change-DMA-direction-while-mapping-reinj.patch
  (git-fixes CVE-2024-43881 bsc#1229480).
- Update
  patches.suse/wifi-ath12k-fix-invalid-memory-access-while-processi.patch
  (git-fixes CVE-2024-43847 bsc#1229291).
- Update
  patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch
  (git-fixes CVE-2024-43879 bsc#1229482).
- Update
  patches.suse/wifi-nl80211-disallow-setting-special-AP-channel-wid.patch
  (stable-fixes CVE-2024-43912 bsc#1229830).
- Update
  patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch
  (git-fixes CVE-2024-43842 bsc#1229317).
- Update
  patches.suse/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch
  (git-fixes CVE-2024-43841 bsc#1229304).
- commit 140ec33</changelog>
  <changelog author="tiwai@suse.de" date="1725105600">- dmaengine: dw: Add memory bus width verification (git-fixes).
- dmaengine: dw: Add peripheral bus width verification
  (git-fixes).
- soundwire: stream: fix programming slave ports for non-continous
  port maps (git-fixes).
- commit b7e9784</changelog>
  <changelog author="tiwai@suse.de" date="1725192000">- usb: cdnsp: fix for Link TRB with TC (git-fixes).
- usb: dwc3: st: add missing depopulate in probe error path
  (git-fixes).
- usb: dwc3: st: fix probed platform device ref count on probe
  error path (git-fixes).
- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
  remove_power_attributes() (git-fixes).
- usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).
- usb: dwc3: omap: add missing depopulate in probe error path
  (git-fixes).
- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
  (git-fixes).
- soc: qcom: pmic_glink: Actually communicate when remote goes
  down (git-fixes).
- soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).
- commit 7121142</changelog>
  <changelog author="ailiop@suse.com" date="1725192001">- xfs: Fix the owner setting issue for rmap query in xfs fsmap
  (git-fixes).
- commit 49b5eec</changelog>
  <changelog author="ailiop@suse.com" date="1725192002">- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code
  (git-fixes).
- commit 288ad9b</changelog>
  <changelog author="ailiop@suse.com" date="1725192003">- xfs: Fix missing interval for missing_owner in xfs fsmap
  (git-fixes).
- commit 5448ab5</changelog>
  <changelog author="ohering@suse.de" date="1725278400">- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).
- commit 4dc1da1</changelog>
  <changelog author="osalvador@suse.de" date="1725278401">- mm/sparsemem: fix race in accessing memory_section-&gt;usage
  (bsc#1221326 CVE-2023-52489).
- commit 6aa8957</changelog>
  <changelog author="osalvador@suse.de" date="1725278402">- mm, kmsan: fix infinite recursion due to RCU critical section
  (git-fixes).
- commit 16ad73a</changelog>
  <changelog author="osalvador@suse.de" date="1725278403">- mm: prevent derefencing NULL ptr in pfn_section_valid()
  (git-fixes).
- commit 35f619d</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278404">- bluetooth/l2cap: sync sock recv cb and release (bsc#1228576
  CVE-2024-41062).
- commit 6553526</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278405">- Bluetooth: L2CAP: Fix deadlock (git-fixes).
- commit 13aba13</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278406">- Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).
- commit 1bec58d</changelog>
  <changelog author="lhenriques@suse.de" date="1725278407">- ceph: periodically flush the cap releases (bsc#1230056).
- commit e22b6e0</changelog>
  <changelog author="tiwai@suse.de" date="1725969600">- Drop soundwire patch that caused a regression (bsc#1230350)
  Deleted:
  patches.suse/soundwire-stream-fix-programming-slave-ports-for-non.patch
- commit 5c05eeb</changelog>
  <changelog author="osalvador@suse.de" date="1726228800">- Revert "mm: prevent derefencing NULL ptr in pfn_section_valid()"
  This reverts commit 35f619d3c421219e07bc89d2d6a37fbff25519fe to fix a refression
  (bsc#1230413)
- commit 7e5afd7</changelog>
  <changelog author="osalvador@suse.de" date="1726228801">- Revert "mm, kmsan: fix infinite recursion due to RCU critical section"
  This reverts commit 16ad73a9f4c2888f3bc28513f5e9a88d753f8741 to fix a regression (bsc#1230413)
- commit 2fd5290</changelog>
  <changelog author="osalvador@suse.de" date="1726228802">- Revert "mm/sparsemem: fix race in accessing memory_section-&gt;usage"
  This reverts commit 6aa8957889611fbe7f06353f917cfb3d9620a680 to fix a regression (bsc#1230413)
- commit 720e36b</changelog>
</package>
<package pkgid="db84593b13614317885f3da93f0e4b0a67c3cc209674fa59e0dbd08acbc69596" name="cluster-md-kmp-default" arch="ppc64le">
  <version epoch="0" ver="6.4.0" rel="150600.23.22.1"/>
  <changelog author="lduncan@suse.com" date="1725019200">- scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315
  CVE-2024-43821).
- commit eb73e94</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019201">- iommu/amd: Convert comma to semicolon (git-fixes).
- commit 2714d8b</changelog>
  <changelog author="mkoutny@suse.com" date="1725019202">- Update
  patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch
  (git-fixes CVE-2024-35902 bsc#1224496).
- Update
  patches.suse/ASoC-TAS2781-Fix-tasdev_load_calibrated_data.patch
  (git-fixes CVE-2024-42278 bsc#1229403).
- Update
  patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch
  (git-fixes CVE-2024-43818 bsc#1229296).
- Update
  patches.suse/ASoC-fsl-fsl_qmc_audio-Check-devm_kasprintf-returned.patch
  (git-fixes CVE-2024-42298 bsc#1229369).
- Update
  patches.suse/Bluetooth-MGMT-Add-error-handling-to-pair_device.patch
  (git-fixes CVE-2024-43884 bsc#1229739).
- Update
  patches.suse/KVM-Always-flush-async-PF-workqueue-when-vCPU-is-bei.patch
  (git-fixes CVE-2024-26976 bsc#1223635).
- Update
  patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch
  (git-fixes CVE-2024-42302 bsc#1229366).
- Update
  patches.suse/PCI-endpoint-Clean-up-error-handling-in-vpci_scan_bu.patch
  (git-fixes CVE-2024-43875 bsc#1229486).
- Update
  patches.suse/PCI-endpoint-pci-epf-test-Make-use-of-cached-epc_fea.patch
  (git-fixes CVE-2024-43824 bsc#1229320).
- Update
  patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch
  (git-fixes CVE-2024-43823 bsc#1229303).
- Update
  patches.suse/PCI-rcar-Demote-WARN-to-dev_warn_ratelimited-in-rcar.patch
  (git-fixes CVE-2024-43876 bsc#1229485).
- Update
  patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch
  (git-fixes CVE-2024-43872 bsc#1229489).
- Update
  patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch
  (git-fixes CVE-2024-42285 bsc#1229381).
- Update
  patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch
  (bsc#1208783 CVE-2024-42274 bsc#1229417).
- Update
  patches.suse/SUNRPC-add-a-missing-rpc_stat-for-TCP-TLS.patch
  (git-fixes CVE-2024-36907 bsc#1225751).
- Update
  patches.suse/bpf-arm64-Fix-trampoline-for-BPF_TRAMP_F_CALL_ORIG.patch
  (git-fixes CVE-2024-43840 bsc#1229344).
- Update
  patches.suse/btrfs-fix-double-inode-unlock-for-direct-IO-sync-wri.patch
  (git-fixes CVE-2024-43885 bsc#1229747).
- Update
  patches.suse/btrfs-fix-extent-map-use-after-free-when-adding-page.patch
  (git-fixes CVE-2024-42314 bsc#1229355).
- Update
  patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch
  (bsc#1228801 CVE-2024-43853 bsc#1229292).
- Update
  patches.suse/crypto-ccp-Fix-null-pointer-dereference-in-__sev_snp.patch
  (git-fixes CVE-2024-43874 bsc#1229487).
- Update
  patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch
  (git-fixes CVE-2024-43871 bsc#1229490).
- Update
  patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch
  (git-fixes CVE-2024-43856 bsc#1229346).
- Update
  patches.suse/drm-admgpu-fix-dereferencing-null-pointer-context.patch
  (stable-fixes CVE-2024-43906 bsc#1229785).
- Update
  patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch
  (stable-fixes CVE-2024-43903 bsc#1229781).
- Update
  patches.suse/drm-amd-display-Add-null-checker-before-passing-vari.patch
  (stable-fixes CVE-2024-43902 bsc#1229767).
- Update
  patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch
  (stable-fixes CVE-2024-43895 bsc#1229755).
- Update
  patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch
  (stable-fixes CVE-2024-43905 bsc#1229784).
- Update
  patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch
  (stable-fixes CVE-2024-43908 bsc#1229788).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch
  (stable-fixes CVE-2024-43909 bsc#1229789).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch
  (stable-fixes CVE-2024-43907 bsc#1229787).
- Update
  patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch
  (git-fixes CVE-2024-43894 bsc#1229746).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch
  (git-fixes CVE-2024-42310 bsc#1229358).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch
  (git-fixes CVE-2024-42309 bsc#1229359).
- Update
  patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch
  (git-fixes CVE-2024-43867 bsc#1229493).
- Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch
  (git-fixes CVE-2024-43829 bsc#1229341).
- Update
  patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch
  (git-fixes CVE-2024-43863 bsc#1229497).
- Update
  patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch
  (git-fixes CVE-2024-42315 bsc#1229354).
- Update
  patches.suse/gpio-prevent-potential-speculation-leaks-in-gpio_dev.patch
  (stable-fixes CVE-2024-44931 bsc#1229837).
- Update
  patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch
  (git-fixes CVE-2024-42311 bsc#1229413).
- Update
  patches.suse/iio-Fix-the-sorting-functionality-in-iio_gts_build_a.patch
  (git-fixes CVE-2024-43825 bsc#1229298).
- Update
  patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch
  (git-fixes CVE-2024-43858 bsc#1229414).
- Update
  patches.suse/jfs-Fix-shift-out-of-bounds-in-dbDiscardAG.patch
  (git-fixes CVE-2024-44938 bsc#1229792).
- Update
  patches.suse/jfs-fix-null-ptr-deref-in-dtInsertEntry.patch
  (git-fixes CVE-2024-44939 bsc#1229820).
- Update
  patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch
  (git-fixes CVE-2024-42292 bsc#1229373).
- Update
  patches.suse/kvm-s390-Reject-memory-region-operations-for-ucontrol-VMs.patch
  (git-fixes bsc#1229168 CVE-2024-43819 bsc#1229290).
- Update
  patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch
  (git-fixes CVE-2024-43830 bsc#1229305).
- Update
  patches.suse/lib-objagg-Fix-general-protection-fault.patch
  (git-fixes CVE-2024-43846 bsc#1229360).
- Update
  patches.suse/libbpf-Use-OPTS_SET-macro-in-bpf_xdp_query.patch
  (git-fixes CVE-2024-27050 bsc#1223767).
- Update
  patches.suse/mISDN-Fix-a-use-after-free-in-hfcmulti_tx.patch
  (git-fixes CVE-2024-42280 bsc#1229388).
- Update
  patches.suse/mailbox-mtk-cmdq-Move-devm_mbox_controller_register-.patch
  (git-fixes CVE-2024-42319 bsc#1229350).
- Update
  patches.suse/md-raid5-fix-deadlock-that-raid5d-wait-for-itself-to-clear-MD_SB_CHANGE_PENDING-151f.patch
  (git-fixes CVE-2024-39476 bsc#1227437).
- Update
  patches.suse/media-imx-pxp-Fix-ERR_PTR-dereference-in-pxp_probe.patch
  (git-fixes CVE-2024-42303 bsc#1229365).
- Update
  patches.suse/media-pci-ivtv-Add-check-for-DMA-map-result.patch
  (git-fixes CVE-2024-43877 bsc#1229484).
- Update
  patches.suse/media-v4l-async-Fix-NULL-pointer-dereference-in-addi.patch
  (git-fixes CVE-2024-43833 bsc#1229299).
- Update
  patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch
  (git-fixes CVE-2024-42313 bsc#1229356).
- Update
  patches.suse/media-xc2028-avoid-use-after-free-in-load_firmware_c.patch
  (stable-fixes CVE-2024-43900 bsc#1229756).
- Update
  patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch
  (git-fixes CVE-2024-43892 bsc#1229761).
- Update
  patches.suse/net-drop-bad-gso-csum_start-and-offset-in-virtio_net.patch
  (git-fixes CVE-2024-43897 bsc#1229752).
- Update
  patches.suse/net-iucv-fix-use-after-free-in-iucv_sock_close.patch
  (bsc#1228973 CVE-2024-42271 bsc#1229400).
- Update patches.suse/net-missing-check-virtio.patch (git-fixes
  CVE-2024-43817 bsc#1229312).
- Update
  patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch
  (git-fixes CVE-2024-43861 bsc#1229500).
- Update
  patches.suse/nfs-pass-explicit-offset-count-to-trace-events.patch
  (git-fixes CVE-2024-43826 bsc#1229294).
- Update
  patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch
  (git-fixes CVE-2024-42276 bsc#1229410).
- Update
  patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch
  (git-fixes CVE-2024-43889 bsc#1229743).
- Update
  patches.suse/remoteproc-imx_rproc-Skip-over-memory-region-when-no.patch
  (git-fixes CVE-2024-43860 bsc#1229319).
- Update
  patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch
  (git-fixes bsc#1229173 CVE-2024-42320 bsc#1229349).
- Update
  patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch
  (bsc#1228857 CVE-2024-43816 bsc#1229318).
- Update
  patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch
  (bsc#1228850 CVE-2024-42287 bsc#1229392).
- Update
  patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch
  (bsc#1228850 CVE-2024-42289 bsc#1229399).
- Update
  patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch
  (bsc#1228850 CVE-2024-42288 bsc#1229398).
- Update
  patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch
  (bsc#1228850 CVE-2024-42286 bsc#1229395).
- Update
  patches.suse/serial-core-check-uartclk-for-zero-to-avoid-divide-b.patch
  (stable-fixes CVE-2024-43893 bsc#1229759).
- Update
  patches.suse/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch
  (git-fixes CVE-2024-43849 bsc#1229307).
- Update
  patches.suse/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch
  (git-fixes CVE-2024-43851 bsc#1229313).
- Update
  patches.suse/spi-microchip-core-ensure-TX-and-RX-FIFOs-are-empty-.patch
  (git-fixes CVE-2024-42279 bsc#1229390).
- Update
  patches.suse/usb-vhci-hcd-Do-not-drop-references-before-new-refer.patch
  (stable-fixes CVE-2024-43883 bsc#1229707).
- Update
  patches.suse/vhost-vsock-always-initialize-seqpacket_allow.patch
  (git-fixes CVE-2024-43873 bsc#1229488).
- Update
  patches.suse/wifi-ath12k-change-DMA-direction-while-mapping-reinj.patch
  (git-fixes CVE-2024-43881 bsc#1229480).
- Update
  patches.suse/wifi-ath12k-fix-invalid-memory-access-while-processi.patch
  (git-fixes CVE-2024-43847 bsc#1229291).
- Update
  patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch
  (git-fixes CVE-2024-43879 bsc#1229482).
- Update
  patches.suse/wifi-nl80211-disallow-setting-special-AP-channel-wid.patch
  (stable-fixes CVE-2024-43912 bsc#1229830).
- Update
  patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch
  (git-fixes CVE-2024-43842 bsc#1229317).
- Update
  patches.suse/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch
  (git-fixes CVE-2024-43841 bsc#1229304).
- commit 140ec33</changelog>
  <changelog author="tiwai@suse.de" date="1725105600">- dmaengine: dw: Add memory bus width verification (git-fixes).
- dmaengine: dw: Add peripheral bus width verification
  (git-fixes).
- soundwire: stream: fix programming slave ports for non-continous
  port maps (git-fixes).
- commit b7e9784</changelog>
  <changelog author="tiwai@suse.de" date="1725192000">- usb: cdnsp: fix for Link TRB with TC (git-fixes).
- usb: dwc3: st: add missing depopulate in probe error path
  (git-fixes).
- usb: dwc3: st: fix probed platform device ref count on probe
  error path (git-fixes).
- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
  remove_power_attributes() (git-fixes).
- usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).
- usb: dwc3: omap: add missing depopulate in probe error path
  (git-fixes).
- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
  (git-fixes).
- soc: qcom: pmic_glink: Actually communicate when remote goes
  down (git-fixes).
- soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).
- commit 7121142</changelog>
  <changelog author="ailiop@suse.com" date="1725192001">- xfs: Fix the owner setting issue for rmap query in xfs fsmap
  (git-fixes).
- commit 49b5eec</changelog>
  <changelog author="ailiop@suse.com" date="1725192002">- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code
  (git-fixes).
- commit 288ad9b</changelog>
  <changelog author="ailiop@suse.com" date="1725192003">- xfs: Fix missing interval for missing_owner in xfs fsmap
  (git-fixes).
- commit 5448ab5</changelog>
  <changelog author="ohering@suse.de" date="1725278400">- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).
- commit 4dc1da1</changelog>
  <changelog author="osalvador@suse.de" date="1725278401">- mm/sparsemem: fix race in accessing memory_section-&gt;usage
  (bsc#1221326 CVE-2023-52489).
- commit 6aa8957</changelog>
  <changelog author="osalvador@suse.de" date="1725278402">- mm, kmsan: fix infinite recursion due to RCU critical section
  (git-fixes).
- commit 16ad73a</changelog>
  <changelog author="osalvador@suse.de" date="1725278403">- mm: prevent derefencing NULL ptr in pfn_section_valid()
  (git-fixes).
- commit 35f619d</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278404">- bluetooth/l2cap: sync sock recv cb and release (bsc#1228576
  CVE-2024-41062).
- commit 6553526</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278405">- Bluetooth: L2CAP: Fix deadlock (git-fixes).
- commit 13aba13</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278406">- Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).
- commit 1bec58d</changelog>
  <changelog author="lhenriques@suse.de" date="1725278407">- ceph: periodically flush the cap releases (bsc#1230056).
- commit e22b6e0</changelog>
  <changelog author="tiwai@suse.de" date="1725969600">- Drop soundwire patch that caused a regression (bsc#1230350)
  Deleted:
  patches.suse/soundwire-stream-fix-programming-slave-ports-for-non.patch
- commit 5c05eeb</changelog>
  <changelog author="osalvador@suse.de" date="1726228800">- Revert "mm: prevent derefencing NULL ptr in pfn_section_valid()"
  This reverts commit 35f619d3c421219e07bc89d2d6a37fbff25519fe to fix a refression
  (bsc#1230413)
- commit 7e5afd7</changelog>
  <changelog author="osalvador@suse.de" date="1726228801">- Revert "mm, kmsan: fix infinite recursion due to RCU critical section"
  This reverts commit 16ad73a9f4c2888f3bc28513f5e9a88d753f8741 to fix a regression (bsc#1230413)
- commit 2fd5290</changelog>
  <changelog author="osalvador@suse.de" date="1726228802">- Revert "mm/sparsemem: fix race in accessing memory_section-&gt;usage"
  This reverts commit 6aa8957889611fbe7f06353f917cfb3d9620a680 to fix a regression (bsc#1230413)
- commit 720e36b</changelog>
</package>
<package pkgid="4766c967412714f73987f5ed884e7a9700b072f9dfc32c3134bde858f17a1a5b" name="cluster-md-kmp-default" arch="s390x">
  <version epoch="0" ver="6.4.0" rel="150600.23.22.1"/>
  <changelog author="lduncan@suse.com" date="1725019200">- scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315
  CVE-2024-43821).
- commit eb73e94</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019201">- iommu/amd: Convert comma to semicolon (git-fixes).
- commit 2714d8b</changelog>
  <changelog author="mkoutny@suse.com" date="1725019202">- Update
  patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch
  (git-fixes CVE-2024-35902 bsc#1224496).
- Update
  patches.suse/ASoC-TAS2781-Fix-tasdev_load_calibrated_data.patch
  (git-fixes CVE-2024-42278 bsc#1229403).
- Update
  patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch
  (git-fixes CVE-2024-43818 bsc#1229296).
- Update
  patches.suse/ASoC-fsl-fsl_qmc_audio-Check-devm_kasprintf-returned.patch
  (git-fixes CVE-2024-42298 bsc#1229369).
- Update
  patches.suse/Bluetooth-MGMT-Add-error-handling-to-pair_device.patch
  (git-fixes CVE-2024-43884 bsc#1229739).
- Update
  patches.suse/KVM-Always-flush-async-PF-workqueue-when-vCPU-is-bei.patch
  (git-fixes CVE-2024-26976 bsc#1223635).
- Update
  patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch
  (git-fixes CVE-2024-42302 bsc#1229366).
- Update
  patches.suse/PCI-endpoint-Clean-up-error-handling-in-vpci_scan_bu.patch
  (git-fixes CVE-2024-43875 bsc#1229486).
- Update
  patches.suse/PCI-endpoint-pci-epf-test-Make-use-of-cached-epc_fea.patch
  (git-fixes CVE-2024-43824 bsc#1229320).
- Update
  patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch
  (git-fixes CVE-2024-43823 bsc#1229303).
- Update
  patches.suse/PCI-rcar-Demote-WARN-to-dev_warn_ratelimited-in-rcar.patch
  (git-fixes CVE-2024-43876 bsc#1229485).
- Update
  patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch
  (git-fixes CVE-2024-43872 bsc#1229489).
- Update
  patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch
  (git-fixes CVE-2024-42285 bsc#1229381).
- Update
  patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch
  (bsc#1208783 CVE-2024-42274 bsc#1229417).
- Update
  patches.suse/SUNRPC-add-a-missing-rpc_stat-for-TCP-TLS.patch
  (git-fixes CVE-2024-36907 bsc#1225751).
- Update
  patches.suse/bpf-arm64-Fix-trampoline-for-BPF_TRAMP_F_CALL_ORIG.patch
  (git-fixes CVE-2024-43840 bsc#1229344).
- Update
  patches.suse/btrfs-fix-double-inode-unlock-for-direct-IO-sync-wri.patch
  (git-fixes CVE-2024-43885 bsc#1229747).
- Update
  patches.suse/btrfs-fix-extent-map-use-after-free-when-adding-page.patch
  (git-fixes CVE-2024-42314 bsc#1229355).
- Update
  patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch
  (bsc#1228801 CVE-2024-43853 bsc#1229292).
- Update
  patches.suse/crypto-ccp-Fix-null-pointer-dereference-in-__sev_snp.patch
  (git-fixes CVE-2024-43874 bsc#1229487).
- Update
  patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch
  (git-fixes CVE-2024-43871 bsc#1229490).
- Update
  patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch
  (git-fixes CVE-2024-43856 bsc#1229346).
- Update
  patches.suse/drm-admgpu-fix-dereferencing-null-pointer-context.patch
  (stable-fixes CVE-2024-43906 bsc#1229785).
- Update
  patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch
  (stable-fixes CVE-2024-43903 bsc#1229781).
- Update
  patches.suse/drm-amd-display-Add-null-checker-before-passing-vari.patch
  (stable-fixes CVE-2024-43902 bsc#1229767).
- Update
  patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch
  (stable-fixes CVE-2024-43895 bsc#1229755).
- Update
  patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch
  (stable-fixes CVE-2024-43905 bsc#1229784).
- Update
  patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch
  (stable-fixes CVE-2024-43908 bsc#1229788).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch
  (stable-fixes CVE-2024-43909 bsc#1229789).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch
  (stable-fixes CVE-2024-43907 bsc#1229787).
- Update
  patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch
  (git-fixes CVE-2024-43894 bsc#1229746).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch
  (git-fixes CVE-2024-42310 bsc#1229358).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch
  (git-fixes CVE-2024-42309 bsc#1229359).
- Update
  patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch
  (git-fixes CVE-2024-43867 bsc#1229493).
- Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch
  (git-fixes CVE-2024-43829 bsc#1229341).
- Update
  patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch
  (git-fixes CVE-2024-43863 bsc#1229497).
- Update
  patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch
  (git-fixes CVE-2024-42315 bsc#1229354).
- Update
  patches.suse/gpio-prevent-potential-speculation-leaks-in-gpio_dev.patch
  (stable-fixes CVE-2024-44931 bsc#1229837).
- Update
  patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch
  (git-fixes CVE-2024-42311 bsc#1229413).
- Update
  patches.suse/iio-Fix-the-sorting-functionality-in-iio_gts_build_a.patch
  (git-fixes CVE-2024-43825 bsc#1229298).
- Update
  patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch
  (git-fixes CVE-2024-43858 bsc#1229414).
- Update
  patches.suse/jfs-Fix-shift-out-of-bounds-in-dbDiscardAG.patch
  (git-fixes CVE-2024-44938 bsc#1229792).
- Update
  patches.suse/jfs-fix-null-ptr-deref-in-dtInsertEntry.patch
  (git-fixes CVE-2024-44939 bsc#1229820).
- Update
  patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch
  (git-fixes CVE-2024-42292 bsc#1229373).
- Update
  patches.suse/kvm-s390-Reject-memory-region-operations-for-ucontrol-VMs.patch
  (git-fixes bsc#1229168 CVE-2024-43819 bsc#1229290).
- Update
  patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch
  (git-fixes CVE-2024-43830 bsc#1229305).
- Update
  patches.suse/lib-objagg-Fix-general-protection-fault.patch
  (git-fixes CVE-2024-43846 bsc#1229360).
- Update
  patches.suse/libbpf-Use-OPTS_SET-macro-in-bpf_xdp_query.patch
  (git-fixes CVE-2024-27050 bsc#1223767).
- Update
  patches.suse/mISDN-Fix-a-use-after-free-in-hfcmulti_tx.patch
  (git-fixes CVE-2024-42280 bsc#1229388).
- Update
  patches.suse/mailbox-mtk-cmdq-Move-devm_mbox_controller_register-.patch
  (git-fixes CVE-2024-42319 bsc#1229350).
- Update
  patches.suse/md-raid5-fix-deadlock-that-raid5d-wait-for-itself-to-clear-MD_SB_CHANGE_PENDING-151f.patch
  (git-fixes CVE-2024-39476 bsc#1227437).
- Update
  patches.suse/media-imx-pxp-Fix-ERR_PTR-dereference-in-pxp_probe.patch
  (git-fixes CVE-2024-42303 bsc#1229365).
- Update
  patches.suse/media-pci-ivtv-Add-check-for-DMA-map-result.patch
  (git-fixes CVE-2024-43877 bsc#1229484).
- Update
  patches.suse/media-v4l-async-Fix-NULL-pointer-dereference-in-addi.patch
  (git-fixes CVE-2024-43833 bsc#1229299).
- Update
  patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch
  (git-fixes CVE-2024-42313 bsc#1229356).
- Update
  patches.suse/media-xc2028-avoid-use-after-free-in-load_firmware_c.patch
  (stable-fixes CVE-2024-43900 bsc#1229756).
- Update
  patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch
  (git-fixes CVE-2024-43892 bsc#1229761).
- Update
  patches.suse/net-drop-bad-gso-csum_start-and-offset-in-virtio_net.patch
  (git-fixes CVE-2024-43897 bsc#1229752).
- Update
  patches.suse/net-iucv-fix-use-after-free-in-iucv_sock_close.patch
  (bsc#1228973 CVE-2024-42271 bsc#1229400).
- Update patches.suse/net-missing-check-virtio.patch (git-fixes
  CVE-2024-43817 bsc#1229312).
- Update
  patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch
  (git-fixes CVE-2024-43861 bsc#1229500).
- Update
  patches.suse/nfs-pass-explicit-offset-count-to-trace-events.patch
  (git-fixes CVE-2024-43826 bsc#1229294).
- Update
  patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch
  (git-fixes CVE-2024-42276 bsc#1229410).
- Update
  patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch
  (git-fixes CVE-2024-43889 bsc#1229743).
- Update
  patches.suse/remoteproc-imx_rproc-Skip-over-memory-region-when-no.patch
  (git-fixes CVE-2024-43860 bsc#1229319).
- Update
  patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch
  (git-fixes bsc#1229173 CVE-2024-42320 bsc#1229349).
- Update
  patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch
  (bsc#1228857 CVE-2024-43816 bsc#1229318).
- Update
  patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch
  (bsc#1228850 CVE-2024-42287 bsc#1229392).
- Update
  patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch
  (bsc#1228850 CVE-2024-42289 bsc#1229399).
- Update
  patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch
  (bsc#1228850 CVE-2024-42288 bsc#1229398).
- Update
  patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch
  (bsc#1228850 CVE-2024-42286 bsc#1229395).
- Update
  patches.suse/serial-core-check-uartclk-for-zero-to-avoid-divide-b.patch
  (stable-fixes CVE-2024-43893 bsc#1229759).
- Update
  patches.suse/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch
  (git-fixes CVE-2024-43849 bsc#1229307).
- Update
  patches.suse/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch
  (git-fixes CVE-2024-43851 bsc#1229313).
- Update
  patches.suse/spi-microchip-core-ensure-TX-and-RX-FIFOs-are-empty-.patch
  (git-fixes CVE-2024-42279 bsc#1229390).
- Update
  patches.suse/usb-vhci-hcd-Do-not-drop-references-before-new-refer.patch
  (stable-fixes CVE-2024-43883 bsc#1229707).
- Update
  patches.suse/vhost-vsock-always-initialize-seqpacket_allow.patch
  (git-fixes CVE-2024-43873 bsc#1229488).
- Update
  patches.suse/wifi-ath12k-change-DMA-direction-while-mapping-reinj.patch
  (git-fixes CVE-2024-43881 bsc#1229480).
- Update
  patches.suse/wifi-ath12k-fix-invalid-memory-access-while-processi.patch
  (git-fixes CVE-2024-43847 bsc#1229291).
- Update
  patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch
  (git-fixes CVE-2024-43879 bsc#1229482).
- Update
  patches.suse/wifi-nl80211-disallow-setting-special-AP-channel-wid.patch
  (stable-fixes CVE-2024-43912 bsc#1229830).
- Update
  patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch
  (git-fixes CVE-2024-43842 bsc#1229317).
- Update
  patches.suse/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch
  (git-fixes CVE-2024-43841 bsc#1229304).
- commit 140ec33</changelog>
  <changelog author="tiwai@suse.de" date="1725105600">- dmaengine: dw: Add memory bus width verification (git-fixes).
- dmaengine: dw: Add peripheral bus width verification
  (git-fixes).
- soundwire: stream: fix programming slave ports for non-continous
  port maps (git-fixes).
- commit b7e9784</changelog>
  <changelog author="tiwai@suse.de" date="1725192000">- usb: cdnsp: fix for Link TRB with TC (git-fixes).
- usb: dwc3: st: add missing depopulate in probe error path
  (git-fixes).
- usb: dwc3: st: fix probed platform device ref count on probe
  error path (git-fixes).
- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
  remove_power_attributes() (git-fixes).
- usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).
- usb: dwc3: omap: add missing depopulate in probe error path
  (git-fixes).
- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
  (git-fixes).
- soc: qcom: pmic_glink: Actually communicate when remote goes
  down (git-fixes).
- soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).
- commit 7121142</changelog>
  <changelog author="ailiop@suse.com" date="1725192001">- xfs: Fix the owner setting issue for rmap query in xfs fsmap
  (git-fixes).
- commit 49b5eec</changelog>
  <changelog author="ailiop@suse.com" date="1725192002">- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code
  (git-fixes).
- commit 288ad9b</changelog>
  <changelog author="ailiop@suse.com" date="1725192003">- xfs: Fix missing interval for missing_owner in xfs fsmap
  (git-fixes).
- commit 5448ab5</changelog>
  <changelog author="ohering@suse.de" date="1725278400">- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).
- commit 4dc1da1</changelog>
  <changelog author="osalvador@suse.de" date="1725278401">- mm/sparsemem: fix race in accessing memory_section-&gt;usage
  (bsc#1221326 CVE-2023-52489).
- commit 6aa8957</changelog>
  <changelog author="osalvador@suse.de" date="1725278402">- mm, kmsan: fix infinite recursion due to RCU critical section
  (git-fixes).
- commit 16ad73a</changelog>
  <changelog author="osalvador@suse.de" date="1725278403">- mm: prevent derefencing NULL ptr in pfn_section_valid()
  (git-fixes).
- commit 35f619d</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278404">- bluetooth/l2cap: sync sock recv cb and release (bsc#1228576
  CVE-2024-41062).
- commit 6553526</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278405">- Bluetooth: L2CAP: Fix deadlock (git-fixes).
- commit 13aba13</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278406">- Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).
- commit 1bec58d</changelog>
  <changelog author="lhenriques@suse.de" date="1725278407">- ceph: periodically flush the cap releases (bsc#1230056).
- commit e22b6e0</changelog>
  <changelog author="tiwai@suse.de" date="1725969600">- Drop soundwire patch that caused a regression (bsc#1230350)
  Deleted:
  patches.suse/soundwire-stream-fix-programming-slave-ports-for-non.patch
- commit 5c05eeb</changelog>
  <changelog author="osalvador@suse.de" date="1726228800">- Revert "mm: prevent derefencing NULL ptr in pfn_section_valid()"
  This reverts commit 35f619d3c421219e07bc89d2d6a37fbff25519fe to fix a refression
  (bsc#1230413)
- commit 7e5afd7</changelog>
  <changelog author="osalvador@suse.de" date="1726228801">- Revert "mm, kmsan: fix infinite recursion due to RCU critical section"
  This reverts commit 16ad73a9f4c2888f3bc28513f5e9a88d753f8741 to fix a regression (bsc#1230413)
- commit 2fd5290</changelog>
  <changelog author="osalvador@suse.de" date="1726228802">- Revert "mm/sparsemem: fix race in accessing memory_section-&gt;usage"
  This reverts commit 6aa8957889611fbe7f06353f917cfb3d9620a680 to fix a regression (bsc#1230413)
- commit 720e36b</changelog>
</package>
<package pkgid="1e5ef1b3b5dca618bcf1b30c0ea17d4fa92c95b5ea8b3ead496befc8f4eb19db" name="cluster-md-kmp-default" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.23.22.1"/>
  <changelog author="lduncan@suse.com" date="1725019200">- scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315
  CVE-2024-43821).
- commit eb73e94</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019201">- iommu/amd: Convert comma to semicolon (git-fixes).
- commit 2714d8b</changelog>
  <changelog author="mkoutny@suse.com" date="1725019202">- Update
  patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch
  (git-fixes CVE-2024-35902 bsc#1224496).
- Update
  patches.suse/ASoC-TAS2781-Fix-tasdev_load_calibrated_data.patch
  (git-fixes CVE-2024-42278 bsc#1229403).
- Update
  patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch
  (git-fixes CVE-2024-43818 bsc#1229296).
- Update
  patches.suse/ASoC-fsl-fsl_qmc_audio-Check-devm_kasprintf-returned.patch
  (git-fixes CVE-2024-42298 bsc#1229369).
- Update
  patches.suse/Bluetooth-MGMT-Add-error-handling-to-pair_device.patch
  (git-fixes CVE-2024-43884 bsc#1229739).
- Update
  patches.suse/KVM-Always-flush-async-PF-workqueue-when-vCPU-is-bei.patch
  (git-fixes CVE-2024-26976 bsc#1223635).
- Update
  patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch
  (git-fixes CVE-2024-42302 bsc#1229366).
- Update
  patches.suse/PCI-endpoint-Clean-up-error-handling-in-vpci_scan_bu.patch
  (git-fixes CVE-2024-43875 bsc#1229486).
- Update
  patches.suse/PCI-endpoint-pci-epf-test-Make-use-of-cached-epc_fea.patch
  (git-fixes CVE-2024-43824 bsc#1229320).
- Update
  patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch
  (git-fixes CVE-2024-43823 bsc#1229303).
- Update
  patches.suse/PCI-rcar-Demote-WARN-to-dev_warn_ratelimited-in-rcar.patch
  (git-fixes CVE-2024-43876 bsc#1229485).
- Update
  patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch
  (git-fixes CVE-2024-43872 bsc#1229489).
- Update
  patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch
  (git-fixes CVE-2024-42285 bsc#1229381).
- Update
  patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch
  (bsc#1208783 CVE-2024-42274 bsc#1229417).
- Update
  patches.suse/SUNRPC-add-a-missing-rpc_stat-for-TCP-TLS.patch
  (git-fixes CVE-2024-36907 bsc#1225751).
- Update
  patches.suse/bpf-arm64-Fix-trampoline-for-BPF_TRAMP_F_CALL_ORIG.patch
  (git-fixes CVE-2024-43840 bsc#1229344).
- Update
  patches.suse/btrfs-fix-double-inode-unlock-for-direct-IO-sync-wri.patch
  (git-fixes CVE-2024-43885 bsc#1229747).
- Update
  patches.suse/btrfs-fix-extent-map-use-after-free-when-adding-page.patch
  (git-fixes CVE-2024-42314 bsc#1229355).
- Update
  patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch
  (bsc#1228801 CVE-2024-43853 bsc#1229292).
- Update
  patches.suse/crypto-ccp-Fix-null-pointer-dereference-in-__sev_snp.patch
  (git-fixes CVE-2024-43874 bsc#1229487).
- Update
  patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch
  (git-fixes CVE-2024-43871 bsc#1229490).
- Update
  patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch
  (git-fixes CVE-2024-43856 bsc#1229346).
- Update
  patches.suse/drm-admgpu-fix-dereferencing-null-pointer-context.patch
  (stable-fixes CVE-2024-43906 bsc#1229785).
- Update
  patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch
  (stable-fixes CVE-2024-43903 bsc#1229781).
- Update
  patches.suse/drm-amd-display-Add-null-checker-before-passing-vari.patch
  (stable-fixes CVE-2024-43902 bsc#1229767).
- Update
  patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch
  (stable-fixes CVE-2024-43895 bsc#1229755).
- Update
  patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch
  (stable-fixes CVE-2024-43905 bsc#1229784).
- Update
  patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch
  (stable-fixes CVE-2024-43908 bsc#1229788).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch
  (stable-fixes CVE-2024-43909 bsc#1229789).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch
  (stable-fixes CVE-2024-43907 bsc#1229787).
- Update
  patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch
  (git-fixes CVE-2024-43894 bsc#1229746).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch
  (git-fixes CVE-2024-42310 bsc#1229358).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch
  (git-fixes CVE-2024-42309 bsc#1229359).
- Update
  patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch
  (git-fixes CVE-2024-43867 bsc#1229493).
- Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch
  (git-fixes CVE-2024-43829 bsc#1229341).
- Update
  patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch
  (git-fixes CVE-2024-43863 bsc#1229497).
- Update
  patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch
  (git-fixes CVE-2024-42315 bsc#1229354).
- Update
  patches.suse/gpio-prevent-potential-speculation-leaks-in-gpio_dev.patch
  (stable-fixes CVE-2024-44931 bsc#1229837).
- Update
  patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch
  (git-fixes CVE-2024-42311 bsc#1229413).
- Update
  patches.suse/iio-Fix-the-sorting-functionality-in-iio_gts_build_a.patch
  (git-fixes CVE-2024-43825 bsc#1229298).
- Update
  patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch
  (git-fixes CVE-2024-43858 bsc#1229414).
- Update
  patches.suse/jfs-Fix-shift-out-of-bounds-in-dbDiscardAG.patch
  (git-fixes CVE-2024-44938 bsc#1229792).
- Update
  patches.suse/jfs-fix-null-ptr-deref-in-dtInsertEntry.patch
  (git-fixes CVE-2024-44939 bsc#1229820).
- Update
  patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch
  (git-fixes CVE-2024-42292 bsc#1229373).
- Update
  patches.suse/kvm-s390-Reject-memory-region-operations-for-ucontrol-VMs.patch
  (git-fixes bsc#1229168 CVE-2024-43819 bsc#1229290).
- Update
  patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch
  (git-fixes CVE-2024-43830 bsc#1229305).
- Update
  patches.suse/lib-objagg-Fix-general-protection-fault.patch
  (git-fixes CVE-2024-43846 bsc#1229360).
- Update
  patches.suse/libbpf-Use-OPTS_SET-macro-in-bpf_xdp_query.patch
  (git-fixes CVE-2024-27050 bsc#1223767).
- Update
  patches.suse/mISDN-Fix-a-use-after-free-in-hfcmulti_tx.patch
  (git-fixes CVE-2024-42280 bsc#1229388).
- Update
  patches.suse/mailbox-mtk-cmdq-Move-devm_mbox_controller_register-.patch
  (git-fixes CVE-2024-42319 bsc#1229350).
- Update
  patches.suse/md-raid5-fix-deadlock-that-raid5d-wait-for-itself-to-clear-MD_SB_CHANGE_PENDING-151f.patch
  (git-fixes CVE-2024-39476 bsc#1227437).
- Update
  patches.suse/media-imx-pxp-Fix-ERR_PTR-dereference-in-pxp_probe.patch
  (git-fixes CVE-2024-42303 bsc#1229365).
- Update
  patches.suse/media-pci-ivtv-Add-check-for-DMA-map-result.patch
  (git-fixes CVE-2024-43877 bsc#1229484).
- Update
  patches.suse/media-v4l-async-Fix-NULL-pointer-dereference-in-addi.patch
  (git-fixes CVE-2024-43833 bsc#1229299).
- Update
  patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch
  (git-fixes CVE-2024-42313 bsc#1229356).
- Update
  patches.suse/media-xc2028-avoid-use-after-free-in-load_firmware_c.patch
  (stable-fixes CVE-2024-43900 bsc#1229756).
- Update
  patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch
  (git-fixes CVE-2024-43892 bsc#1229761).
- Update
  patches.suse/net-drop-bad-gso-csum_start-and-offset-in-virtio_net.patch
  (git-fixes CVE-2024-43897 bsc#1229752).
- Update
  patches.suse/net-iucv-fix-use-after-free-in-iucv_sock_close.patch
  (bsc#1228973 CVE-2024-42271 bsc#1229400).
- Update patches.suse/net-missing-check-virtio.patch (git-fixes
  CVE-2024-43817 bsc#1229312).
- Update
  patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch
  (git-fixes CVE-2024-43861 bsc#1229500).
- Update
  patches.suse/nfs-pass-explicit-offset-count-to-trace-events.patch
  (git-fixes CVE-2024-43826 bsc#1229294).
- Update
  patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch
  (git-fixes CVE-2024-42276 bsc#1229410).
- Update
  patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch
  (git-fixes CVE-2024-43889 bsc#1229743).
- Update
  patches.suse/remoteproc-imx_rproc-Skip-over-memory-region-when-no.patch
  (git-fixes CVE-2024-43860 bsc#1229319).
- Update
  patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch
  (git-fixes bsc#1229173 CVE-2024-42320 bsc#1229349).
- Update
  patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch
  (bsc#1228857 CVE-2024-43816 bsc#1229318).
- Update
  patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch
  (bsc#1228850 CVE-2024-42287 bsc#1229392).
- Update
  patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch
  (bsc#1228850 CVE-2024-42289 bsc#1229399).
- Update
  patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch
  (bsc#1228850 CVE-2024-42288 bsc#1229398).
- Update
  patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch
  (bsc#1228850 CVE-2024-42286 bsc#1229395).
- Update
  patches.suse/serial-core-check-uartclk-for-zero-to-avoid-divide-b.patch
  (stable-fixes CVE-2024-43893 bsc#1229759).
- Update
  patches.suse/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch
  (git-fixes CVE-2024-43849 bsc#1229307).
- Update
  patches.suse/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch
  (git-fixes CVE-2024-43851 bsc#1229313).
- Update
  patches.suse/spi-microchip-core-ensure-TX-and-RX-FIFOs-are-empty-.patch
  (git-fixes CVE-2024-42279 bsc#1229390).
- Update
  patches.suse/usb-vhci-hcd-Do-not-drop-references-before-new-refer.patch
  (stable-fixes CVE-2024-43883 bsc#1229707).
- Update
  patches.suse/vhost-vsock-always-initialize-seqpacket_allow.patch
  (git-fixes CVE-2024-43873 bsc#1229488).
- Update
  patches.suse/wifi-ath12k-change-DMA-direction-while-mapping-reinj.patch
  (git-fixes CVE-2024-43881 bsc#1229480).
- Update
  patches.suse/wifi-ath12k-fix-invalid-memory-access-while-processi.patch
  (git-fixes CVE-2024-43847 bsc#1229291).
- Update
  patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch
  (git-fixes CVE-2024-43879 bsc#1229482).
- Update
  patches.suse/wifi-nl80211-disallow-setting-special-AP-channel-wid.patch
  (stable-fixes CVE-2024-43912 bsc#1229830).
- Update
  patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch
  (git-fixes CVE-2024-43842 bsc#1229317).
- Update
  patches.suse/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch
  (git-fixes CVE-2024-43841 bsc#1229304).
- commit 140ec33</changelog>
  <changelog author="tiwai@suse.de" date="1725105600">- dmaengine: dw: Add memory bus width verification (git-fixes).
- dmaengine: dw: Add peripheral bus width verification
  (git-fixes).
- soundwire: stream: fix programming slave ports for non-continous
  port maps (git-fixes).
- commit b7e9784</changelog>
  <changelog author="tiwai@suse.de" date="1725192000">- usb: cdnsp: fix for Link TRB with TC (git-fixes).
- usb: dwc3: st: add missing depopulate in probe error path
  (git-fixes).
- usb: dwc3: st: fix probed platform device ref count on probe
  error path (git-fixes).
- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
  remove_power_attributes() (git-fixes).
- usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).
- usb: dwc3: omap: add missing depopulate in probe error path
  (git-fixes).
- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
  (git-fixes).
- soc: qcom: pmic_glink: Actually communicate when remote goes
  down (git-fixes).
- soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).
- commit 7121142</changelog>
  <changelog author="ailiop@suse.com" date="1725192001">- xfs: Fix the owner setting issue for rmap query in xfs fsmap
  (git-fixes).
- commit 49b5eec</changelog>
  <changelog author="ailiop@suse.com" date="1725192002">- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code
  (git-fixes).
- commit 288ad9b</changelog>
  <changelog author="ailiop@suse.com" date="1725192003">- xfs: Fix missing interval for missing_owner in xfs fsmap
  (git-fixes).
- commit 5448ab5</changelog>
  <changelog author="ohering@suse.de" date="1725278400">- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).
- commit 4dc1da1</changelog>
  <changelog author="osalvador@suse.de" date="1725278401">- mm/sparsemem: fix race in accessing memory_section-&gt;usage
  (bsc#1221326 CVE-2023-52489).
- commit 6aa8957</changelog>
  <changelog author="osalvador@suse.de" date="1725278402">- mm, kmsan: fix infinite recursion due to RCU critical section
  (git-fixes).
- commit 16ad73a</changelog>
  <changelog author="osalvador@suse.de" date="1725278403">- mm: prevent derefencing NULL ptr in pfn_section_valid()
  (git-fixes).
- commit 35f619d</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278404">- bluetooth/l2cap: sync sock recv cb and release (bsc#1228576
  CVE-2024-41062).
- commit 6553526</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278405">- Bluetooth: L2CAP: Fix deadlock (git-fixes).
- commit 13aba13</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278406">- Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).
- commit 1bec58d</changelog>
  <changelog author="lhenriques@suse.de" date="1725278407">- ceph: periodically flush the cap releases (bsc#1230056).
- commit e22b6e0</changelog>
  <changelog author="tiwai@suse.de" date="1725969600">- Drop soundwire patch that caused a regression (bsc#1230350)
  Deleted:
  patches.suse/soundwire-stream-fix-programming-slave-ports-for-non.patch
- commit 5c05eeb</changelog>
  <changelog author="osalvador@suse.de" date="1726228800">- Revert "mm: prevent derefencing NULL ptr in pfn_section_valid()"
  This reverts commit 35f619d3c421219e07bc89d2d6a37fbff25519fe to fix a refression
  (bsc#1230413)
- commit 7e5afd7</changelog>
  <changelog author="osalvador@suse.de" date="1726228801">- Revert "mm, kmsan: fix infinite recursion due to RCU critical section"
  This reverts commit 16ad73a9f4c2888f3bc28513f5e9a88d753f8741 to fix a regression (bsc#1230413)
- commit 2fd5290</changelog>
  <changelog author="osalvador@suse.de" date="1726228802">- Revert "mm/sparsemem: fix race in accessing memory_section-&gt;usage"
  This reverts commit 6aa8957889611fbe7f06353f917cfb3d9620a680 to fix a regression (bsc#1230413)
- commit 720e36b</changelog>
</package>
<package pkgid="0487d65d3670331936cbd93da69097b33ecdc442a6d8f9fc73c800e3b5195092" name="cluster-md-kmp-default" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.25.1"/>
  <changelog author="mwilck@suse.com" date="1727438400">- scsi: sd: Fix off-by-one error in
  sd_read_block_characteristics() (bsc#1223848).
- commit 621f2fb</changelog>
  <changelog author="ailiop@suse.com" date="1727697600">- afs: Revert "afs: Hide silly-rename files from userspace"
  (git-fixes).
- commit 11353bb</changelog>
  <changelog author="ailiop@suse.com" date="1727697601">- afs: Don't cross .backup mountpoint from backup volume
  (git-fixes).
- commit f35dae1</changelog>
  <changelog author="ailiop@suse.com" date="1727697602">- erofs: fix incorrect symlink detection in fast symlink
  (git-fixes).
- commit 2e1ae75</changelog>
  <changelog author="hare@suse.de" date="1727697603">- nvme-multipath: system fails to create generic nvme device
  (bsc#1228244).
- commit 4fc57d2</changelog>
  <changelog author="hare@suse.de" date="1727697604">- nvme-multipath: avoid hang on inaccessible namespaces
  (bsc#1228244).
- kcm: Serialise kcm_sendmsg() for the same socket
  (CVE-2024-44946,bsc#1230015).
- commit a84ca87</changelog>
  <changelog author="hare@suse.de" date="1727697605">- kcm: Serialise kcm_sendmsg() for the same socket (CVE-2024-44946
  bsc#1230015).
- commit 4310760</changelog>
  <changelog author="tiwai@suse.de" date="1727697606">- Move upstreamed SCSI patches into sorted section
- commit aba5747</changelog>
  <changelog author="tiwai@suse.de" date="1727697607">- mailbox: bcm2835: Fix timeout during suspend mode (git-fixes).
- mailbox: rockchip: fix a typo in module autoloading (git-fixes).
- i2c: designware: fix controller is holding SCL low while ENABLE
  bit is disabled (git-fixes).
- drm/amd/display: handle nulled pipe context in DCE110's
  set_drr() (git-fixes).
- drm/amdgpu: Fix get each xcp macro (git-fixes).
- tomoyo: fallback to realpath if symlink's pathname does not
  exist (git-fixes).
- cxl/pci: Fix to record only non-zero ranges (git-fixes).
- ata: libata-scsi: Fix ata_msense_control() CDL page reporting
  (git-fixes).
- firmware_loader: Block path traversal (git-fixes).
- driver core: Fix a potential null-ptr-deref in
  module_add_driver() (git-fixes).
- driver core: Fix error handling in driver API device_rename()
  (git-fixes).
- ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()
  (git-fixes).
- iio: magnetometer: ak8975: Fix reading for ak099xx sensors
  (git-fixes).
- iio: chemical: bme680: Fix read/write ops to device by adding
  mutexes (git-fixes).
- ABI: testing: fix admv8818 attr description (git-fixes).
- iio: adc: ad7606: fix standby gpio state to match the
  documentation (git-fixes).
- iio: adc: ad7606: fix oversampling gpio array (git-fixes).
- tty: rp2: Fix reset with non forgiving PCIe host bridges
  (git-fixes).
- USB: class: CDC-ACM: fix race between get_serial and set_serial
  (git-fixes).
- usb: dwc2: drd: fix clock gating on USB role switch (git-fixes).
- usb: cdnsp: Fix incorrect usb_request status (git-fixes).
- USB: usbtmc: prevent kernel-usb-infoleak (git-fixes).
- USB: serial: kobil_sct: restore initial terminal settings
  (git-fixes).
- xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and
  freeing them (git-fixes).
- usb: dwc2: Skip clock gating on Broadcom SoCs (git-fixes).
- spi: atmel-quadspi: Avoid overwriting delay register settings
  (git-fixes).
- spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
  (git-fixes).
- spi: atmel-quadspi: Undo runtime PM changes at driver exit time
  (git-fixes).
- rtc: at91sam9: fix OF node leak in probe() error path
  (git-fixes).
- i3c: master: svc: Fix use after free vulnerability in
  svc_i3c_master Driver Due to Race Condition (git-fixes).
- remoteproc: k3-r5: Fix error handling when power-up failed
  (git-fixes).
- remoteproc: imx_rproc: Initialize workqueue earlier (git-fixes).
- remoteproc: imx_rproc: Correct ddr alias for i.MX8M (git-fixes).
- KEYS: prevent NULL pointer dereference in find_asymmetric_key()
  (git-fixes).
- media: i2c: ar0521: Use cansleep version of gpiod_set_value()
  (git-fixes).
- media: ov5675: Fix power on/off delay timings (git-fixes).
- media: sun4i_csi: Implement link validate for sun4i_csi subdev
  (git-fixes).
- media: platform: rzg2l-cru: rzg2l-csi2: Add missing
  MODULE_DEVICE_TABLE (git-fixes).
- media: venus: fix use after free bug in venus_remove due to
  race condition (git-fixes).
- media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
  (git-fixes).
- clk: ti: dra7-atl: Fix leak of of_nodes (git-fixes).
- watchdog: imx_sc_wdt: Don't disable WDT in suspend (git-fixes).
- pinctrl: single: fix missing error code in pcs_probe()
  (git-fixes).
- xz: cleanup CRC32 edits from 2018 (git-fixes).
- ata: pata_macio: Use WARN instead of BUG (stable-fixes).
- commit c5ab3ca</changelog>
  <changelog author="iivanov@suse.de" date="1727697608">- arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (bsc#1231120 CVE-2024-46822)
- commit cc6d7b5</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697609">- tracing: Fix overflow in get_free_elt() (git-fixes
  CVE-2024-43890 bsc#1229764).
- commit ceb524e</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697610">- tracing: Avoid possible softlockup in tracing_iter_reset()
  (git-fixes).
- commit d5df75c</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697611">- bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()
  (git-fixes).
- commit 1884922</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697612">- Refresh
  patches.suse/bpf-kprobe-remove-unused-declaring-of-bpf_kprobe_override.patch.
- commit 5a0b269</changelog>
  <changelog author="tiwai@suse.de" date="1727697613">- supported.conf: mark adiantum and xctr crypto modules as supported (bsc#1231035)
- commit 59d03d7</changelog>
  <changelog author="pmladek@suse.com" date="1727697614">- kthread: Fix task state in kthread worker if being frozen
  (bsc#1231146).
- commit fe88a62</changelog>
  <changelog author="tiwai@suse.de" date="1727784000">- USB: serial: pl2303: add device id for Macrosilicon MS3020
  (stable-fixes).
- powercap/intel_rapl: Add support for AMD family 1Ah
  (stable-fixes).
- ASoC: amd: yc: Add a quirk for MSI Bravo 17 (D7VEK)
  (stable-fixes).
- ASoC: tda7419: fix module autoloading (stable-fixes).
- ASoC: intel: fix module autoloading (stable-fixes).
- ASoC: Intel: soc-acpi-cht: Make Lenovo Yoga Tab 3 X90F DMI
  match less strict (stable-fixes).
- ALSA: hda: add HDMI codec ID for Intel PTL (stable-fixes).
- drm: komeda: Fix an issue related to normalized zpos
  (stable-fixes).
- can: mcp251xfd: mcp251xfd_ring_init(): check TX-coalescing
  configuration (stable-fixes).
- spi: spidev: Add missing spi_device_id for jg10309-01
  (git-fixes).
- spi: bcm63xx: Enable module autoloading (stable-fixes).
- spi: spidev: Add an entry for elgin,jg10309-01 (stable-fixes).
- hwmon: (asus-ec-sensors) remove VRM temp X570-E GAMING
  (stable-fixes).
- wifi: iwlwifi: clear trans-&gt;state earlier upon error
  (stable-fixes).
- wifi: mac80211: free skb on error path in
  ieee80211_beacon_get_ap() (stable-fixes).
- wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
  (stable-fixes).
- wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
  (stable-fixes).
- wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room()
  (stable-fixes).
- wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation
  (stable-fixes).
- wifi: iwlwifi: lower message level for FW buffer destination
  (stable-fixes).
- platform/x86: x86-android-tablets: Make Lenovo Yoga Tab 3 X90F
  DMI match less strict (stable-fixes).
- pinctrl: at91: make it work with current gpiolib (stable-fixes).
- can: mcp251xfd: properly indent labels (stable-fixes).
- commit a530f31</changelog>
  <changelog author="tiwai@suse.de" date="1727784001">- can: mcp251xfd: move mcp251xfd_timestamp_start()/stop() into
  mcp251xfd_chip_start/stop() (stable-fixes).
- Refresh
  patches.suse/can-mcp251xfd-clarify-the-meaning-of-timestamp.patch.
- commit 6779985</changelog>
  <changelog author="lhenriques@suse.de" date="1727784002">- cachefiles: fix dentry leak in cachefiles_open_file()
  (bsc#1231183).
- ceph: remove the incorrect Fw reference check when dirtying
  pages (bsc#1231182).
- commit ba82da7</changelog>
  <changelog author="tiwai@suse.de" date="1727784003">- ACPICA: executer/exsystem: Don't nag user about every Stall()
  violating the spec (git-fixes).
- ACPICA: Implement ACPI_WARNING_ONCE and ACPI_ERROR_ONCE
  (stable-fixes).
- commit f94e799</changelog>
</package>
<package pkgid="8630732021567bc6eff09bbafd77d75a19ec25cb498ec38f388396a070bd2837" name="cluster-md-kmp-default" arch="ppc64le">
  <version epoch="0" ver="6.4.0" rel="150600.23.25.1"/>
  <changelog author="mwilck@suse.com" date="1727438400">- scsi: sd: Fix off-by-one error in
  sd_read_block_characteristics() (bsc#1223848).
- commit 621f2fb</changelog>
  <changelog author="ailiop@suse.com" date="1727697600">- afs: Revert "afs: Hide silly-rename files from userspace"
  (git-fixes).
- commit 11353bb</changelog>
  <changelog author="ailiop@suse.com" date="1727697601">- afs: Don't cross .backup mountpoint from backup volume
  (git-fixes).
- commit f35dae1</changelog>
  <changelog author="ailiop@suse.com" date="1727697602">- erofs: fix incorrect symlink detection in fast symlink
  (git-fixes).
- commit 2e1ae75</changelog>
  <changelog author="hare@suse.de" date="1727697603">- nvme-multipath: system fails to create generic nvme device
  (bsc#1228244).
- commit 4fc57d2</changelog>
  <changelog author="hare@suse.de" date="1727697604">- nvme-multipath: avoid hang on inaccessible namespaces
  (bsc#1228244).
- kcm: Serialise kcm_sendmsg() for the same socket
  (CVE-2024-44946,bsc#1230015).
- commit a84ca87</changelog>
  <changelog author="hare@suse.de" date="1727697605">- kcm: Serialise kcm_sendmsg() for the same socket (CVE-2024-44946
  bsc#1230015).
- commit 4310760</changelog>
  <changelog author="tiwai@suse.de" date="1727697606">- Move upstreamed SCSI patches into sorted section
- commit aba5747</changelog>
  <changelog author="tiwai@suse.de" date="1727697607">- mailbox: bcm2835: Fix timeout during suspend mode (git-fixes).
- mailbox: rockchip: fix a typo in module autoloading (git-fixes).
- i2c: designware: fix controller is holding SCL low while ENABLE
  bit is disabled (git-fixes).
- drm/amd/display: handle nulled pipe context in DCE110's
  set_drr() (git-fixes).
- drm/amdgpu: Fix get each xcp macro (git-fixes).
- tomoyo: fallback to realpath if symlink's pathname does not
  exist (git-fixes).
- cxl/pci: Fix to record only non-zero ranges (git-fixes).
- ata: libata-scsi: Fix ata_msense_control() CDL page reporting
  (git-fixes).
- firmware_loader: Block path traversal (git-fixes).
- driver core: Fix a potential null-ptr-deref in
  module_add_driver() (git-fixes).
- driver core: Fix error handling in driver API device_rename()
  (git-fixes).
- ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()
  (git-fixes).
- iio: magnetometer: ak8975: Fix reading for ak099xx sensors
  (git-fixes).
- iio: chemical: bme680: Fix read/write ops to device by adding
  mutexes (git-fixes).
- ABI: testing: fix admv8818 attr description (git-fixes).
- iio: adc: ad7606: fix standby gpio state to match the
  documentation (git-fixes).
- iio: adc: ad7606: fix oversampling gpio array (git-fixes).
- tty: rp2: Fix reset with non forgiving PCIe host bridges
  (git-fixes).
- USB: class: CDC-ACM: fix race between get_serial and set_serial
  (git-fixes).
- usb: dwc2: drd: fix clock gating on USB role switch (git-fixes).
- usb: cdnsp: Fix incorrect usb_request status (git-fixes).
- USB: usbtmc: prevent kernel-usb-infoleak (git-fixes).
- USB: serial: kobil_sct: restore initial terminal settings
  (git-fixes).
- xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and
  freeing them (git-fixes).
- usb: dwc2: Skip clock gating on Broadcom SoCs (git-fixes).
- spi: atmel-quadspi: Avoid overwriting delay register settings
  (git-fixes).
- spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
  (git-fixes).
- spi: atmel-quadspi: Undo runtime PM changes at driver exit time
  (git-fixes).
- rtc: at91sam9: fix OF node leak in probe() error path
  (git-fixes).
- i3c: master: svc: Fix use after free vulnerability in
  svc_i3c_master Driver Due to Race Condition (git-fixes).
- remoteproc: k3-r5: Fix error handling when power-up failed
  (git-fixes).
- remoteproc: imx_rproc: Initialize workqueue earlier (git-fixes).
- remoteproc: imx_rproc: Correct ddr alias for i.MX8M (git-fixes).
- KEYS: prevent NULL pointer dereference in find_asymmetric_key()
  (git-fixes).
- media: i2c: ar0521: Use cansleep version of gpiod_set_value()
  (git-fixes).
- media: ov5675: Fix power on/off delay timings (git-fixes).
- media: sun4i_csi: Implement link validate for sun4i_csi subdev
  (git-fixes).
- media: platform: rzg2l-cru: rzg2l-csi2: Add missing
  MODULE_DEVICE_TABLE (git-fixes).
- media: venus: fix use after free bug in venus_remove due to
  race condition (git-fixes).
- media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
  (git-fixes).
- clk: ti: dra7-atl: Fix leak of of_nodes (git-fixes).
- watchdog: imx_sc_wdt: Don't disable WDT in suspend (git-fixes).
- pinctrl: single: fix missing error code in pcs_probe()
  (git-fixes).
- xz: cleanup CRC32 edits from 2018 (git-fixes).
- ata: pata_macio: Use WARN instead of BUG (stable-fixes).
- commit c5ab3ca</changelog>
  <changelog author="iivanov@suse.de" date="1727697608">- arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (bsc#1231120 CVE-2024-46822)
- commit cc6d7b5</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697609">- tracing: Fix overflow in get_free_elt() (git-fixes
  CVE-2024-43890 bsc#1229764).
- commit ceb524e</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697610">- tracing: Avoid possible softlockup in tracing_iter_reset()
  (git-fixes).
- commit d5df75c</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697611">- bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()
  (git-fixes).
- commit 1884922</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697612">- Refresh
  patches.suse/bpf-kprobe-remove-unused-declaring-of-bpf_kprobe_override.patch.
- commit 5a0b269</changelog>
  <changelog author="tiwai@suse.de" date="1727697613">- supported.conf: mark adiantum and xctr crypto modules as supported (bsc#1231035)
- commit 59d03d7</changelog>
  <changelog author="pmladek@suse.com" date="1727697614">- kthread: Fix task state in kthread worker if being frozen
  (bsc#1231146).
- commit fe88a62</changelog>
  <changelog author="tiwai@suse.de" date="1727784000">- USB: serial: pl2303: add device id for Macrosilicon MS3020
  (stable-fixes).
- powercap/intel_rapl: Add support for AMD family 1Ah
  (stable-fixes).
- ASoC: amd: yc: Add a quirk for MSI Bravo 17 (D7VEK)
  (stable-fixes).
- ASoC: tda7419: fix module autoloading (stable-fixes).
- ASoC: intel: fix module autoloading (stable-fixes).
- ASoC: Intel: soc-acpi-cht: Make Lenovo Yoga Tab 3 X90F DMI
  match less strict (stable-fixes).
- ALSA: hda: add HDMI codec ID for Intel PTL (stable-fixes).
- drm: komeda: Fix an issue related to normalized zpos
  (stable-fixes).
- can: mcp251xfd: mcp251xfd_ring_init(): check TX-coalescing
  configuration (stable-fixes).
- spi: spidev: Add missing spi_device_id for jg10309-01
  (git-fixes).
- spi: bcm63xx: Enable module autoloading (stable-fixes).
- spi: spidev: Add an entry for elgin,jg10309-01 (stable-fixes).
- hwmon: (asus-ec-sensors) remove VRM temp X570-E GAMING
  (stable-fixes).
- wifi: iwlwifi: clear trans-&gt;state earlier upon error
  (stable-fixes).
- wifi: mac80211: free skb on error path in
  ieee80211_beacon_get_ap() (stable-fixes).
- wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
  (stable-fixes).
- wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
  (stable-fixes).
- wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room()
  (stable-fixes).
- wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation
  (stable-fixes).
- wifi: iwlwifi: lower message level for FW buffer destination
  (stable-fixes).
- platform/x86: x86-android-tablets: Make Lenovo Yoga Tab 3 X90F
  DMI match less strict (stable-fixes).
- pinctrl: at91: make it work with current gpiolib (stable-fixes).
- can: mcp251xfd: properly indent labels (stable-fixes).
- commit a530f31</changelog>
  <changelog author="tiwai@suse.de" date="1727784001">- can: mcp251xfd: move mcp251xfd_timestamp_start()/stop() into
  mcp251xfd_chip_start/stop() (stable-fixes).
- Refresh
  patches.suse/can-mcp251xfd-clarify-the-meaning-of-timestamp.patch.
- commit 6779985</changelog>
  <changelog author="lhenriques@suse.de" date="1727784002">- cachefiles: fix dentry leak in cachefiles_open_file()
  (bsc#1231183).
- ceph: remove the incorrect Fw reference check when dirtying
  pages (bsc#1231182).
- commit ba82da7</changelog>
  <changelog author="tiwai@suse.de" date="1727784003">- ACPICA: executer/exsystem: Don't nag user about every Stall()
  violating the spec (git-fixes).
- ACPICA: Implement ACPI_WARNING_ONCE and ACPI_ERROR_ONCE
  (stable-fixes).
- commit f94e799</changelog>
</package>
<package pkgid="fbb2e9e3b20cda75855e71c2ede4ace635893b61ad7986098466f4cea9964293" name="cluster-md-kmp-default" arch="s390x">
  <version epoch="0" ver="6.4.0" rel="150600.23.25.1"/>
  <changelog author="mwilck@suse.com" date="1727438400">- scsi: sd: Fix off-by-one error in
  sd_read_block_characteristics() (bsc#1223848).
- commit 621f2fb</changelog>
  <changelog author="ailiop@suse.com" date="1727697600">- afs: Revert "afs: Hide silly-rename files from userspace"
  (git-fixes).
- commit 11353bb</changelog>
  <changelog author="ailiop@suse.com" date="1727697601">- afs: Don't cross .backup mountpoint from backup volume
  (git-fixes).
- commit f35dae1</changelog>
  <changelog author="ailiop@suse.com" date="1727697602">- erofs: fix incorrect symlink detection in fast symlink
  (git-fixes).
- commit 2e1ae75</changelog>
  <changelog author="hare@suse.de" date="1727697603">- nvme-multipath: system fails to create generic nvme device
  (bsc#1228244).
- commit 4fc57d2</changelog>
  <changelog author="hare@suse.de" date="1727697604">- nvme-multipath: avoid hang on inaccessible namespaces
  (bsc#1228244).
- kcm: Serialise kcm_sendmsg() for the same socket
  (CVE-2024-44946,bsc#1230015).
- commit a84ca87</changelog>
  <changelog author="hare@suse.de" date="1727697605">- kcm: Serialise kcm_sendmsg() for the same socket (CVE-2024-44946
  bsc#1230015).
- commit 4310760</changelog>
  <changelog author="tiwai@suse.de" date="1727697606">- Move upstreamed SCSI patches into sorted section
- commit aba5747</changelog>
  <changelog author="tiwai@suse.de" date="1727697607">- mailbox: bcm2835: Fix timeout during suspend mode (git-fixes).
- mailbox: rockchip: fix a typo in module autoloading (git-fixes).
- i2c: designware: fix controller is holding SCL low while ENABLE
  bit is disabled (git-fixes).
- drm/amd/display: handle nulled pipe context in DCE110's
  set_drr() (git-fixes).
- drm/amdgpu: Fix get each xcp macro (git-fixes).
- tomoyo: fallback to realpath if symlink's pathname does not
  exist (git-fixes).
- cxl/pci: Fix to record only non-zero ranges (git-fixes).
- ata: libata-scsi: Fix ata_msense_control() CDL page reporting
  (git-fixes).
- firmware_loader: Block path traversal (git-fixes).
- driver core: Fix a potential null-ptr-deref in
  module_add_driver() (git-fixes).
- driver core: Fix error handling in driver API device_rename()
  (git-fixes).
- ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()
  (git-fixes).
- iio: magnetometer: ak8975: Fix reading for ak099xx sensors
  (git-fixes).
- iio: chemical: bme680: Fix read/write ops to device by adding
  mutexes (git-fixes).
- ABI: testing: fix admv8818 attr description (git-fixes).
- iio: adc: ad7606: fix standby gpio state to match the
  documentation (git-fixes).
- iio: adc: ad7606: fix oversampling gpio array (git-fixes).
- tty: rp2: Fix reset with non forgiving PCIe host bridges
  (git-fixes).
- USB: class: CDC-ACM: fix race between get_serial and set_serial
  (git-fixes).
- usb: dwc2: drd: fix clock gating on USB role switch (git-fixes).
- usb: cdnsp: Fix incorrect usb_request status (git-fixes).
- USB: usbtmc: prevent kernel-usb-infoleak (git-fixes).
- USB: serial: kobil_sct: restore initial terminal settings
  (git-fixes).
- xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and
  freeing them (git-fixes).
- usb: dwc2: Skip clock gating on Broadcom SoCs (git-fixes).
- spi: atmel-quadspi: Avoid overwriting delay register settings
  (git-fixes).
- spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
  (git-fixes).
- spi: atmel-quadspi: Undo runtime PM changes at driver exit time
  (git-fixes).
- rtc: at91sam9: fix OF node leak in probe() error path
  (git-fixes).
- i3c: master: svc: Fix use after free vulnerability in
  svc_i3c_master Driver Due to Race Condition (git-fixes).
- remoteproc: k3-r5: Fix error handling when power-up failed
  (git-fixes).
- remoteproc: imx_rproc: Initialize workqueue earlier (git-fixes).
- remoteproc: imx_rproc: Correct ddr alias for i.MX8M (git-fixes).
- KEYS: prevent NULL pointer dereference in find_asymmetric_key()
  (git-fixes).
- media: i2c: ar0521: Use cansleep version of gpiod_set_value()
  (git-fixes).
- media: ov5675: Fix power on/off delay timings (git-fixes).
- media: sun4i_csi: Implement link validate for sun4i_csi subdev
  (git-fixes).
- media: platform: rzg2l-cru: rzg2l-csi2: Add missing
  MODULE_DEVICE_TABLE (git-fixes).
- media: venus: fix use after free bug in venus_remove due to
  race condition (git-fixes).
- media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
  (git-fixes).
- clk: ti: dra7-atl: Fix leak of of_nodes (git-fixes).
- watchdog: imx_sc_wdt: Don't disable WDT in suspend (git-fixes).
- pinctrl: single: fix missing error code in pcs_probe()
  (git-fixes).
- xz: cleanup CRC32 edits from 2018 (git-fixes).
- ata: pata_macio: Use WARN instead of BUG (stable-fixes).
- commit c5ab3ca</changelog>
  <changelog author="iivanov@suse.de" date="1727697608">- arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (bsc#1231120 CVE-2024-46822)
- commit cc6d7b5</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697609">- tracing: Fix overflow in get_free_elt() (git-fixes
  CVE-2024-43890 bsc#1229764).
- commit ceb524e</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697610">- tracing: Avoid possible softlockup in tracing_iter_reset()
  (git-fixes).
- commit d5df75c</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697611">- bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()
  (git-fixes).
- commit 1884922</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697612">- Refresh
  patches.suse/bpf-kprobe-remove-unused-declaring-of-bpf_kprobe_override.patch.
- commit 5a0b269</changelog>
  <changelog author="tiwai@suse.de" date="1727697613">- supported.conf: mark adiantum and xctr crypto modules as supported (bsc#1231035)
- commit 59d03d7</changelog>
  <changelog author="pmladek@suse.com" date="1727697614">- kthread: Fix task state in kthread worker if being frozen
  (bsc#1231146).
- commit fe88a62</changelog>
  <changelog author="tiwai@suse.de" date="1727784000">- USB: serial: pl2303: add device id for Macrosilicon MS3020
  (stable-fixes).
- powercap/intel_rapl: Add support for AMD family 1Ah
  (stable-fixes).
- ASoC: amd: yc: Add a quirk for MSI Bravo 17 (D7VEK)
  (stable-fixes).
- ASoC: tda7419: fix module autoloading (stable-fixes).
- ASoC: intel: fix module autoloading (stable-fixes).
- ASoC: Intel: soc-acpi-cht: Make Lenovo Yoga Tab 3 X90F DMI
  match less strict (stable-fixes).
- ALSA: hda: add HDMI codec ID for Intel PTL (stable-fixes).
- drm: komeda: Fix an issue related to normalized zpos
  (stable-fixes).
- can: mcp251xfd: mcp251xfd_ring_init(): check TX-coalescing
  configuration (stable-fixes).
- spi: spidev: Add missing spi_device_id for jg10309-01
  (git-fixes).
- spi: bcm63xx: Enable module autoloading (stable-fixes).
- spi: spidev: Add an entry for elgin,jg10309-01 (stable-fixes).
- hwmon: (asus-ec-sensors) remove VRM temp X570-E GAMING
  (stable-fixes).
- wifi: iwlwifi: clear trans-&gt;state earlier upon error
  (stable-fixes).
- wifi: mac80211: free skb on error path in
  ieee80211_beacon_get_ap() (stable-fixes).
- wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
  (stable-fixes).
- wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
  (stable-fixes).
- wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room()
  (stable-fixes).
- wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation
  (stable-fixes).
- wifi: iwlwifi: lower message level for FW buffer destination
  (stable-fixes).
- platform/x86: x86-android-tablets: Make Lenovo Yoga Tab 3 X90F
  DMI match less strict (stable-fixes).
- pinctrl: at91: make it work with current gpiolib (stable-fixes).
- can: mcp251xfd: properly indent labels (stable-fixes).
- commit a530f31</changelog>
  <changelog author="tiwai@suse.de" date="1727784001">- can: mcp251xfd: move mcp251xfd_timestamp_start()/stop() into
  mcp251xfd_chip_start/stop() (stable-fixes).
- Refresh
  patches.suse/can-mcp251xfd-clarify-the-meaning-of-timestamp.patch.
- commit 6779985</changelog>
  <changelog author="lhenriques@suse.de" date="1727784002">- cachefiles: fix dentry leak in cachefiles_open_file()
  (bsc#1231183).
- ceph: remove the incorrect Fw reference check when dirtying
  pages (bsc#1231182).
- commit ba82da7</changelog>
  <changelog author="tiwai@suse.de" date="1727784003">- ACPICA: executer/exsystem: Don't nag user about every Stall()
  violating the spec (git-fixes).
- ACPICA: Implement ACPI_WARNING_ONCE and ACPI_ERROR_ONCE
  (stable-fixes).
- commit f94e799</changelog>
</package>
<package pkgid="4d9a25099de4696b087129fd05a674a79d446d978ece3052bd273f763b493ad8" name="cluster-md-kmp-default" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.23.25.1"/>
  <changelog author="mwilck@suse.com" date="1727438400">- scsi: sd: Fix off-by-one error in
  sd_read_block_characteristics() (bsc#1223848).
- commit 621f2fb</changelog>
  <changelog author="ailiop@suse.com" date="1727697600">- afs: Revert "afs: Hide silly-rename files from userspace"
  (git-fixes).
- commit 11353bb</changelog>
  <changelog author="ailiop@suse.com" date="1727697601">- afs: Don't cross .backup mountpoint from backup volume
  (git-fixes).
- commit f35dae1</changelog>
  <changelog author="ailiop@suse.com" date="1727697602">- erofs: fix incorrect symlink detection in fast symlink
  (git-fixes).
- commit 2e1ae75</changelog>
  <changelog author="hare@suse.de" date="1727697603">- nvme-multipath: system fails to create generic nvme device
  (bsc#1228244).
- commit 4fc57d2</changelog>
  <changelog author="hare@suse.de" date="1727697604">- nvme-multipath: avoid hang on inaccessible namespaces
  (bsc#1228244).
- kcm: Serialise kcm_sendmsg() for the same socket
  (CVE-2024-44946,bsc#1230015).
- commit a84ca87</changelog>
  <changelog author="hare@suse.de" date="1727697605">- kcm: Serialise kcm_sendmsg() for the same socket (CVE-2024-44946
  bsc#1230015).
- commit 4310760</changelog>
  <changelog author="tiwai@suse.de" date="1727697606">- Move upstreamed SCSI patches into sorted section
- commit aba5747</changelog>
  <changelog author="tiwai@suse.de" date="1727697607">- mailbox: bcm2835: Fix timeout during suspend mode (git-fixes).
- mailbox: rockchip: fix a typo in module autoloading (git-fixes).
- i2c: designware: fix controller is holding SCL low while ENABLE
  bit is disabled (git-fixes).
- drm/amd/display: handle nulled pipe context in DCE110's
  set_drr() (git-fixes).
- drm/amdgpu: Fix get each xcp macro (git-fixes).
- tomoyo: fallback to realpath if symlink's pathname does not
  exist (git-fixes).
- cxl/pci: Fix to record only non-zero ranges (git-fixes).
- ata: libata-scsi: Fix ata_msense_control() CDL page reporting
  (git-fixes).
- firmware_loader: Block path traversal (git-fixes).
- driver core: Fix a potential null-ptr-deref in
  module_add_driver() (git-fixes).
- driver core: Fix error handling in driver API device_rename()
  (git-fixes).
- ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()
  (git-fixes).
- iio: magnetometer: ak8975: Fix reading for ak099xx sensors
  (git-fixes).
- iio: chemical: bme680: Fix read/write ops to device by adding
  mutexes (git-fixes).
- ABI: testing: fix admv8818 attr description (git-fixes).
- iio: adc: ad7606: fix standby gpio state to match the
  documentation (git-fixes).
- iio: adc: ad7606: fix oversampling gpio array (git-fixes).
- tty: rp2: Fix reset with non forgiving PCIe host bridges
  (git-fixes).
- USB: class: CDC-ACM: fix race between get_serial and set_serial
  (git-fixes).
- usb: dwc2: drd: fix clock gating on USB role switch (git-fixes).
- usb: cdnsp: Fix incorrect usb_request status (git-fixes).
- USB: usbtmc: prevent kernel-usb-infoleak (git-fixes).
- USB: serial: kobil_sct: restore initial terminal settings
  (git-fixes).
- xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and
  freeing them (git-fixes).
- usb: dwc2: Skip clock gating on Broadcom SoCs (git-fixes).
- spi: atmel-quadspi: Avoid overwriting delay register settings
  (git-fixes).
- spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
  (git-fixes).
- spi: atmel-quadspi: Undo runtime PM changes at driver exit time
  (git-fixes).
- rtc: at91sam9: fix OF node leak in probe() error path
  (git-fixes).
- i3c: master: svc: Fix use after free vulnerability in
  svc_i3c_master Driver Due to Race Condition (git-fixes).
- remoteproc: k3-r5: Fix error handling when power-up failed
  (git-fixes).
- remoteproc: imx_rproc: Initialize workqueue earlier (git-fixes).
- remoteproc: imx_rproc: Correct ddr alias for i.MX8M (git-fixes).
- KEYS: prevent NULL pointer dereference in find_asymmetric_key()
  (git-fixes).
- media: i2c: ar0521: Use cansleep version of gpiod_set_value()
  (git-fixes).
- media: ov5675: Fix power on/off delay timings (git-fixes).
- media: sun4i_csi: Implement link validate for sun4i_csi subdev
  (git-fixes).
- media: platform: rzg2l-cru: rzg2l-csi2: Add missing
  MODULE_DEVICE_TABLE (git-fixes).
- media: venus: fix use after free bug in venus_remove due to
  race condition (git-fixes).
- media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
  (git-fixes).
- clk: ti: dra7-atl: Fix leak of of_nodes (git-fixes).
- watchdog: imx_sc_wdt: Don't disable WDT in suspend (git-fixes).
- pinctrl: single: fix missing error code in pcs_probe()
  (git-fixes).
- xz: cleanup CRC32 edits from 2018 (git-fixes).
- ata: pata_macio: Use WARN instead of BUG (stable-fixes).
- commit c5ab3ca</changelog>
  <changelog author="iivanov@suse.de" date="1727697608">- arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (bsc#1231120 CVE-2024-46822)
- commit cc6d7b5</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697609">- tracing: Fix overflow in get_free_elt() (git-fixes
  CVE-2024-43890 bsc#1229764).
- commit ceb524e</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697610">- tracing: Avoid possible softlockup in tracing_iter_reset()
  (git-fixes).
- commit d5df75c</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697611">- bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()
  (git-fixes).
- commit 1884922</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697612">- Refresh
  patches.suse/bpf-kprobe-remove-unused-declaring-of-bpf_kprobe_override.patch.
- commit 5a0b269</changelog>
  <changelog author="tiwai@suse.de" date="1727697613">- supported.conf: mark adiantum and xctr crypto modules as supported (bsc#1231035)
- commit 59d03d7</changelog>
  <changelog author="pmladek@suse.com" date="1727697614">- kthread: Fix task state in kthread worker if being frozen
  (bsc#1231146).
- commit fe88a62</changelog>
  <changelog author="tiwai@suse.de" date="1727784000">- USB: serial: pl2303: add device id for Macrosilicon MS3020
  (stable-fixes).
- powercap/intel_rapl: Add support for AMD family 1Ah
  (stable-fixes).
- ASoC: amd: yc: Add a quirk for MSI Bravo 17 (D7VEK)
  (stable-fixes).
- ASoC: tda7419: fix module autoloading (stable-fixes).
- ASoC: intel: fix module autoloading (stable-fixes).
- ASoC: Intel: soc-acpi-cht: Make Lenovo Yoga Tab 3 X90F DMI
  match less strict (stable-fixes).
- ALSA: hda: add HDMI codec ID for Intel PTL (stable-fixes).
- drm: komeda: Fix an issue related to normalized zpos
  (stable-fixes).
- can: mcp251xfd: mcp251xfd_ring_init(): check TX-coalescing
  configuration (stable-fixes).
- spi: spidev: Add missing spi_device_id for jg10309-01
  (git-fixes).
- spi: bcm63xx: Enable module autoloading (stable-fixes).
- spi: spidev: Add an entry for elgin,jg10309-01 (stable-fixes).
- hwmon: (asus-ec-sensors) remove VRM temp X570-E GAMING
  (stable-fixes).
- wifi: iwlwifi: clear trans-&gt;state earlier upon error
  (stable-fixes).
- wifi: mac80211: free skb on error path in
  ieee80211_beacon_get_ap() (stable-fixes).
- wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
  (stable-fixes).
- wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
  (stable-fixes).
- wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room()
  (stable-fixes).
- wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation
  (stable-fixes).
- wifi: iwlwifi: lower message level for FW buffer destination
  (stable-fixes).
- platform/x86: x86-android-tablets: Make Lenovo Yoga Tab 3 X90F
  DMI match less strict (stable-fixes).
- pinctrl: at91: make it work with current gpiolib (stable-fixes).
- can: mcp251xfd: properly indent labels (stable-fixes).
- commit a530f31</changelog>
  <changelog author="tiwai@suse.de" date="1727784001">- can: mcp251xfd: move mcp251xfd_timestamp_start()/stop() into
  mcp251xfd_chip_start/stop() (stable-fixes).
- Refresh
  patches.suse/can-mcp251xfd-clarify-the-meaning-of-timestamp.patch.
- commit 6779985</changelog>
  <changelog author="lhenriques@suse.de" date="1727784002">- cachefiles: fix dentry leak in cachefiles_open_file()
  (bsc#1231183).
- ceph: remove the incorrect Fw reference check when dirtying
  pages (bsc#1231182).
- commit ba82da7</changelog>
  <changelog author="tiwai@suse.de" date="1727784003">- ACPICA: executer/exsystem: Don't nag user about every Stall()
  violating the spec (git-fixes).
- ACPICA: Implement ACPI_WARNING_ONCE and ACPI_ERROR_ONCE
  (stable-fixes).
- commit f94e799</changelog>
</package>
<package pkgid="b2000f813857e1c02baec30792abf04f820ca862432bebb312ad85e94310fb68" name="cluster-md-kmp-default" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.30.1"/>
  <changelog author="iivanov@suse.de" date="1733400000">- bpf, arm64: Remove garbage frame for struct_ops trampoline (git-fixes)
- commit e1353aa</changelog>
  <changelog author="msuchanek@suse.de" date="1733400001">- powerpc/fadump: Move fadump_cma_init to setup_arch() after
  initmem_init() (bsc#1215199).
- powerpc/fadump: Refactor and prepare fadump_cma_init for late
  init (bsc#1215199).
- powerpc/pseries: Use correct data types from pseries_hp_errorlog
  struct (bsc#1215199).
- powerpc/vdso: Inconditionally use CFUNC macro (bsc#1215199).
- powerpc/64s: Fix unnecessary copy to 0 when kernel is booted
  at address 0 (bsc#1215199).
- commit d36d28e</changelog>
  <changelog author="dsterba@suse.com" date="1733400002">- net: hns3: fix kernel crash when uninstalling driver (CVE-2024-50296 bsc#1233485)
- commit 6e41fd9</changelog>
  <changelog author="dsterba@suse.com" date="1733400003">- net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (CVE-2024-26596 bsc#1220355)
- commit 4861dc8</changelog>
  <changelog author="dsterba@suse.com" date="1733400004">- Bluetooth: btnxpuart: Fix random crash seen while removing driver (CVE-2024-46680 bsc#1230557)
- commit 3831431</changelog>
  <changelog author="dsterba@suse.com" date="1733400005">- Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test (bsc#1230557)
- commit 9ca14b5</changelog>
  <changelog author="dsterba@suse.com" date="1733400006">- drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() (CVE-2024-53056 bsc#1233568)
- commit 95cef70</changelog>
  <changelog author="dsterba@suse.com" date="1733400007">- wifi: iwlwifi: mvm: fix 6 GHz scan construction (CVE-2024-53055 bsc#1233550)
- commit c2d5beb</changelog>
  <changelog author="dsterba@suse.com" date="1733400008">- mctp i2c: handle NULL header address (CVE-2024-53043 bsc#1233523)
- commit 5a81634</changelog>
  <changelog author="dsterba@suse.com" date="1733400009">- drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability (CVE-2024-53051 bsc#1233547)
- commit 5262489</changelog>
  <changelog author="iivanov@suse.de" date="1733486400">- kABI: Restore exported __arm_smccc_sve_check (git-fixes)
- commit 3817c3a</changelog>
  <changelog author="iivanov@suse.de" date="1733486401">- arm64: dts: rockchip: remove num-slots property from (git-fixes)
- commit cb47197</changelog>
  <changelog author="iivanov@suse.de" date="1733486402">- arm64: dts: rockchip: Correct GPIO polarity on brcm BT nodes (git-fixes)
- commit ed87dba</changelog>
  <changelog author="tiwai@suse.de" date="1733486403">- can: j1939: j1939_session_new(): fix skb reference counting
  (git-fixes).
- can: mcp251xfd: mcp251xfd_get_tef_len(): work around erratum
  DS80000789E 6 (git-fixes).
- can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: sja1000: sja1000_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: hi311x: hi3110_can_ist(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors
  statistics (git-fixes).
- can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors
  statistics (git-fixes).
- can: hi311x: hi3110_can_ist(): fix potential use-after-free
  (git-fixes).
- can: sun4i_can: sun4i_can_err(): call can_change_state()
  even if cf is NULL (git-fixes).
- can: c_can: c_can_handle_bus_err(): update statistics if skb
  allocation fails (git-fixes).
- can: dev: can_set_termination(): allow sleeping GPIOs
  (git-fixes).
- HID: wacom: fix when get product name maybe null pointer
  (git-fixes).
- watchdog: rti: of: honor timeout-sec property (git-fixes).
- watchdog: mediatek: Make sure system reset gets asserted in
  mtk_wdt_restart() (git-fixes).
- watchdog: apple: Actually flush writes after requesting watchdog
  restart (git-fixes).
- iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
  (git-fixes).
- commit 535e699</changelog>
  <changelog author="tiwai@suse.de" date="1733486404">- netdevsim: copy addresses for both in and out paths (git-fixes).
- commit daf115e</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1733486405">- net/mlx5: fs, lock FTE when checking if active (CVE-2024-53121
  bsc#1234078).
- mlxsw: spectrum_ipip: Fix memory leak when changing remote
  IPv6 address (CVE-2024-50252 bsc#1233201).
- commit 06c045b</changelog>
  <changelog author="jgross@suse.com" date="1733486406">- vp_vdpa: fix id_table array not null terminated error
  (CVE-2024-53110 bsc#1234085).
- commit ffc9457</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1733486407">- net/mlx5e: kTLS, Fix incorrect page refcounting (CVE-2024-53138
  bsc#1234223).
- ice: protect XDP configuration with a mutex (CVE-2024-46765
  bsc#1230807).
- sch/netem: fix use after free in netem_dequeue (CVE-2024-46800
  bsc#1230827).
- commit c9f3783</changelog>
  <changelog author="tiwai@suse.de" date="1733572800">- drm/v3d: Enable Performance Counters before clearing them
  (git-fixes).
- drm/sti: Add __iomem for mixer_dbg_mxn's parameter (git-fixes).
- dma-fence: Use kernel's sort for merging fences (git-fixes).
- dma-fence: Fix reference leak on fence merge failure path
  (git-fixes).
- ASoC: mediatek: mt8188-mt6359: Remove hardcoded dmic codec
  (git-fixes).
- ASoC: SOF: ipc3-topology: fix resource leaks in
  sof_ipc3_widget_setup_comp_dai() (git-fixes).
- ALSA: usb-audio: Fix a DMA to stack memory bug (git-fixes).
- regmap: detach regmap from dev on regmap_exit (git-fixes).
- spi: mpc52xx: Add cancel_work_sync before module remove
  (git-fixes).
- mmc: core: Further prevent card detect during shutdown
  (git-fixes).
- commit 87e627e</changelog>
  <changelog author="tiwai@suse.de" date="1733572801">- ASoC: Intel: avs: da7219: Remove suspend_pre() and resume_post()
  (stable-fixes).
- ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360
  (NP730QFG) (stable-fixes).
- ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook
  430 G8 (stable-fixes).
- ALSA: usb-audio: add mixer mapping for Corsair HS80
  (stable-fixes).
- ALSA: hda/conexant: fix Z60MR100 startup pop issue
  (stable-fixes).
- commit 8c25a0a</changelog>
</package>
<package pkgid="d3681d398034dc9ed3578f85dd87ba021180e9705a5fde2cc15e3ee807b0e793" name="cluster-md-kmp-default" arch="ppc64le">
  <version epoch="0" ver="6.4.0" rel="150600.23.30.1"/>
  <changelog author="iivanov@suse.de" date="1733400000">- bpf, arm64: Remove garbage frame for struct_ops trampoline (git-fixes)
- commit e1353aa</changelog>
  <changelog author="msuchanek@suse.de" date="1733400001">- powerpc/fadump: Move fadump_cma_init to setup_arch() after
  initmem_init() (bsc#1215199).
- powerpc/fadump: Refactor and prepare fadump_cma_init for late
  init (bsc#1215199).
- powerpc/pseries: Use correct data types from pseries_hp_errorlog
  struct (bsc#1215199).
- powerpc/vdso: Inconditionally use CFUNC macro (bsc#1215199).
- powerpc/64s: Fix unnecessary copy to 0 when kernel is booted
  at address 0 (bsc#1215199).
- commit d36d28e</changelog>
  <changelog author="dsterba@suse.com" date="1733400002">- net: hns3: fix kernel crash when uninstalling driver (CVE-2024-50296 bsc#1233485)
- commit 6e41fd9</changelog>
  <changelog author="dsterba@suse.com" date="1733400003">- net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (CVE-2024-26596 bsc#1220355)
- commit 4861dc8</changelog>
  <changelog author="dsterba@suse.com" date="1733400004">- Bluetooth: btnxpuart: Fix random crash seen while removing driver (CVE-2024-46680 bsc#1230557)
- commit 3831431</changelog>
  <changelog author="dsterba@suse.com" date="1733400005">- Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test (bsc#1230557)
- commit 9ca14b5</changelog>
  <changelog author="dsterba@suse.com" date="1733400006">- drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() (CVE-2024-53056 bsc#1233568)
- commit 95cef70</changelog>
  <changelog author="dsterba@suse.com" date="1733400007">- wifi: iwlwifi: mvm: fix 6 GHz scan construction (CVE-2024-53055 bsc#1233550)
- commit c2d5beb</changelog>
  <changelog author="dsterba@suse.com" date="1733400008">- mctp i2c: handle NULL header address (CVE-2024-53043 bsc#1233523)
- commit 5a81634</changelog>
  <changelog author="dsterba@suse.com" date="1733400009">- drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability (CVE-2024-53051 bsc#1233547)
- commit 5262489</changelog>
  <changelog author="iivanov@suse.de" date="1733486400">- kABI: Restore exported __arm_smccc_sve_check (git-fixes)
- commit 3817c3a</changelog>
  <changelog author="iivanov@suse.de" date="1733486401">- arm64: dts: rockchip: remove num-slots property from (git-fixes)
- commit cb47197</changelog>
  <changelog author="iivanov@suse.de" date="1733486402">- arm64: dts: rockchip: Correct GPIO polarity on brcm BT nodes (git-fixes)
- commit ed87dba</changelog>
  <changelog author="tiwai@suse.de" date="1733486403">- can: j1939: j1939_session_new(): fix skb reference counting
  (git-fixes).
- can: mcp251xfd: mcp251xfd_get_tef_len(): work around erratum
  DS80000789E 6 (git-fixes).
- can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: sja1000: sja1000_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: hi311x: hi3110_can_ist(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors
  statistics (git-fixes).
- can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors
  statistics (git-fixes).
- can: hi311x: hi3110_can_ist(): fix potential use-after-free
  (git-fixes).
- can: sun4i_can: sun4i_can_err(): call can_change_state()
  even if cf is NULL (git-fixes).
- can: c_can: c_can_handle_bus_err(): update statistics if skb
  allocation fails (git-fixes).
- can: dev: can_set_termination(): allow sleeping GPIOs
  (git-fixes).
- HID: wacom: fix when get product name maybe null pointer
  (git-fixes).
- watchdog: rti: of: honor timeout-sec property (git-fixes).
- watchdog: mediatek: Make sure system reset gets asserted in
  mtk_wdt_restart() (git-fixes).
- watchdog: apple: Actually flush writes after requesting watchdog
  restart (git-fixes).
- iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
  (git-fixes).
- commit 535e699</changelog>
  <changelog author="tiwai@suse.de" date="1733486404">- netdevsim: copy addresses for both in and out paths (git-fixes).
- commit daf115e</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1733486405">- net/mlx5: fs, lock FTE when checking if active (CVE-2024-53121
  bsc#1234078).
- mlxsw: spectrum_ipip: Fix memory leak when changing remote
  IPv6 address (CVE-2024-50252 bsc#1233201).
- commit 06c045b</changelog>
  <changelog author="jgross@suse.com" date="1733486406">- vp_vdpa: fix id_table array not null terminated error
  (CVE-2024-53110 bsc#1234085).
- commit ffc9457</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1733486407">- net/mlx5e: kTLS, Fix incorrect page refcounting (CVE-2024-53138
  bsc#1234223).
- ice: protect XDP configuration with a mutex (CVE-2024-46765
  bsc#1230807).
- sch/netem: fix use after free in netem_dequeue (CVE-2024-46800
  bsc#1230827).
- commit c9f3783</changelog>
  <changelog author="tiwai@suse.de" date="1733572800">- drm/v3d: Enable Performance Counters before clearing them
  (git-fixes).
- drm/sti: Add __iomem for mixer_dbg_mxn's parameter (git-fixes).
- dma-fence: Use kernel's sort for merging fences (git-fixes).
- dma-fence: Fix reference leak on fence merge failure path
  (git-fixes).
- ASoC: mediatek: mt8188-mt6359: Remove hardcoded dmic codec
  (git-fixes).
- ASoC: SOF: ipc3-topology: fix resource leaks in
  sof_ipc3_widget_setup_comp_dai() (git-fixes).
- ALSA: usb-audio: Fix a DMA to stack memory bug (git-fixes).
- regmap: detach regmap from dev on regmap_exit (git-fixes).
- spi: mpc52xx: Add cancel_work_sync before module remove
  (git-fixes).
- mmc: core: Further prevent card detect during shutdown
  (git-fixes).
- commit 87e627e</changelog>
  <changelog author="tiwai@suse.de" date="1733572801">- ASoC: Intel: avs: da7219: Remove suspend_pre() and resume_post()
  (stable-fixes).
- ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360
  (NP730QFG) (stable-fixes).
- ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook
  430 G8 (stable-fixes).
- ALSA: usb-audio: add mixer mapping for Corsair HS80
  (stable-fixes).
- ALSA: hda/conexant: fix Z60MR100 startup pop issue
  (stable-fixes).
- commit 8c25a0a</changelog>
</package>
<package pkgid="ed81ea5b1da5dd94b6a3df9c842f0f43cdeee0bccb6eae0846c4df225c7aff69" name="cluster-md-kmp-default" arch="s390x">
  <version epoch="0" ver="6.4.0" rel="150600.23.30.1"/>
  <changelog author="iivanov@suse.de" date="1733400000">- bpf, arm64: Remove garbage frame for struct_ops trampoline (git-fixes)
- commit e1353aa</changelog>
  <changelog author="msuchanek@suse.de" date="1733400001">- powerpc/fadump: Move fadump_cma_init to setup_arch() after
  initmem_init() (bsc#1215199).
- powerpc/fadump: Refactor and prepare fadump_cma_init for late
  init (bsc#1215199).
- powerpc/pseries: Use correct data types from pseries_hp_errorlog
  struct (bsc#1215199).
- powerpc/vdso: Inconditionally use CFUNC macro (bsc#1215199).
- powerpc/64s: Fix unnecessary copy to 0 when kernel is booted
  at address 0 (bsc#1215199).
- commit d36d28e</changelog>
  <changelog author="dsterba@suse.com" date="1733400002">- net: hns3: fix kernel crash when uninstalling driver (CVE-2024-50296 bsc#1233485)
- commit 6e41fd9</changelog>
  <changelog author="dsterba@suse.com" date="1733400003">- net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (CVE-2024-26596 bsc#1220355)
- commit 4861dc8</changelog>
  <changelog author="dsterba@suse.com" date="1733400004">- Bluetooth: btnxpuart: Fix random crash seen while removing driver (CVE-2024-46680 bsc#1230557)
- commit 3831431</changelog>
  <changelog author="dsterba@suse.com" date="1733400005">- Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test (bsc#1230557)
- commit 9ca14b5</changelog>
  <changelog author="dsterba@suse.com" date="1733400006">- drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() (CVE-2024-53056 bsc#1233568)
- commit 95cef70</changelog>
  <changelog author="dsterba@suse.com" date="1733400007">- wifi: iwlwifi: mvm: fix 6 GHz scan construction (CVE-2024-53055 bsc#1233550)
- commit c2d5beb</changelog>
  <changelog author="dsterba@suse.com" date="1733400008">- mctp i2c: handle NULL header address (CVE-2024-53043 bsc#1233523)
- commit 5a81634</changelog>
  <changelog author="dsterba@suse.com" date="1733400009">- drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability (CVE-2024-53051 bsc#1233547)
- commit 5262489</changelog>
  <changelog author="iivanov@suse.de" date="1733486400">- kABI: Restore exported __arm_smccc_sve_check (git-fixes)
- commit 3817c3a</changelog>
  <changelog author="iivanov@suse.de" date="1733486401">- arm64: dts: rockchip: remove num-slots property from (git-fixes)
- commit cb47197</changelog>
  <changelog author="iivanov@suse.de" date="1733486402">- arm64: dts: rockchip: Correct GPIO polarity on brcm BT nodes (git-fixes)
- commit ed87dba</changelog>
  <changelog author="tiwai@suse.de" date="1733486403">- can: j1939: j1939_session_new(): fix skb reference counting
  (git-fixes).
- can: mcp251xfd: mcp251xfd_get_tef_len(): work around erratum
  DS80000789E 6 (git-fixes).
- can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: sja1000: sja1000_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: hi311x: hi3110_can_ist(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors
  statistics (git-fixes).
- can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors
  statistics (git-fixes).
- can: hi311x: hi3110_can_ist(): fix potential use-after-free
  (git-fixes).
- can: sun4i_can: sun4i_can_err(): call can_change_state()
  even if cf is NULL (git-fixes).
- can: c_can: c_can_handle_bus_err(): update statistics if skb
  allocation fails (git-fixes).
- can: dev: can_set_termination(): allow sleeping GPIOs
  (git-fixes).
- HID: wacom: fix when get product name maybe null pointer
  (git-fixes).
- watchdog: rti: of: honor timeout-sec property (git-fixes).
- watchdog: mediatek: Make sure system reset gets asserted in
  mtk_wdt_restart() (git-fixes).
- watchdog: apple: Actually flush writes after requesting watchdog
  restart (git-fixes).
- iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
  (git-fixes).
- commit 535e699</changelog>
  <changelog author="tiwai@suse.de" date="1733486404">- netdevsim: copy addresses for both in and out paths (git-fixes).
- commit daf115e</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1733486405">- net/mlx5: fs, lock FTE when checking if active (CVE-2024-53121
  bsc#1234078).
- mlxsw: spectrum_ipip: Fix memory leak when changing remote
  IPv6 address (CVE-2024-50252 bsc#1233201).
- commit 06c045b</changelog>
  <changelog author="jgross@suse.com" date="1733486406">- vp_vdpa: fix id_table array not null terminated error
  (CVE-2024-53110 bsc#1234085).
- commit ffc9457</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1733486407">- net/mlx5e: kTLS, Fix incorrect page refcounting (CVE-2024-53138
  bsc#1234223).
- ice: protect XDP configuration with a mutex (CVE-2024-46765
  bsc#1230807).
- sch/netem: fix use after free in netem_dequeue (CVE-2024-46800
  bsc#1230827).
- commit c9f3783</changelog>
  <changelog author="tiwai@suse.de" date="1733572800">- drm/v3d: Enable Performance Counters before clearing them
  (git-fixes).
- drm/sti: Add __iomem for mixer_dbg_mxn's parameter (git-fixes).
- dma-fence: Use kernel's sort for merging fences (git-fixes).
- dma-fence: Fix reference leak on fence merge failure path
  (git-fixes).
- ASoC: mediatek: mt8188-mt6359: Remove hardcoded dmic codec
  (git-fixes).
- ASoC: SOF: ipc3-topology: fix resource leaks in
  sof_ipc3_widget_setup_comp_dai() (git-fixes).
- ALSA: usb-audio: Fix a DMA to stack memory bug (git-fixes).
- regmap: detach regmap from dev on regmap_exit (git-fixes).
- spi: mpc52xx: Add cancel_work_sync before module remove
  (git-fixes).
- mmc: core: Further prevent card detect during shutdown
  (git-fixes).
- commit 87e627e</changelog>
  <changelog author="tiwai@suse.de" date="1733572801">- ASoC: Intel: avs: da7219: Remove suspend_pre() and resume_post()
  (stable-fixes).
- ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360
  (NP730QFG) (stable-fixes).
- ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook
  430 G8 (stable-fixes).
- ALSA: usb-audio: add mixer mapping for Corsair HS80
  (stable-fixes).
- ALSA: hda/conexant: fix Z60MR100 startup pop issue
  (stable-fixes).
- commit 8c25a0a</changelog>
</package>
<package pkgid="53c05c19ad25abb2c2b6b60ac8f92eec634056b757b17803fec16e4f43309156" name="cluster-md-kmp-default" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.23.30.1"/>
  <changelog author="iivanov@suse.de" date="1733400000">- bpf, arm64: Remove garbage frame for struct_ops trampoline (git-fixes)
- commit e1353aa</changelog>
  <changelog author="msuchanek@suse.de" date="1733400001">- powerpc/fadump: Move fadump_cma_init to setup_arch() after
  initmem_init() (bsc#1215199).
- powerpc/fadump: Refactor and prepare fadump_cma_init for late
  init (bsc#1215199).
- powerpc/pseries: Use correct data types from pseries_hp_errorlog
  struct (bsc#1215199).
- powerpc/vdso: Inconditionally use CFUNC macro (bsc#1215199).
- powerpc/64s: Fix unnecessary copy to 0 when kernel is booted
  at address 0 (bsc#1215199).
- commit d36d28e</changelog>
  <changelog author="dsterba@suse.com" date="1733400002">- net: hns3: fix kernel crash when uninstalling driver (CVE-2024-50296 bsc#1233485)
- commit 6e41fd9</changelog>
  <changelog author="dsterba@suse.com" date="1733400003">- net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (CVE-2024-26596 bsc#1220355)
- commit 4861dc8</changelog>
  <changelog author="dsterba@suse.com" date="1733400004">- Bluetooth: btnxpuart: Fix random crash seen while removing driver (CVE-2024-46680 bsc#1230557)
- commit 3831431</changelog>
  <changelog author="dsterba@suse.com" date="1733400005">- Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test (bsc#1230557)
- commit 9ca14b5</changelog>
  <changelog author="dsterba@suse.com" date="1733400006">- drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() (CVE-2024-53056 bsc#1233568)
- commit 95cef70</changelog>
  <changelog author="dsterba@suse.com" date="1733400007">- wifi: iwlwifi: mvm: fix 6 GHz scan construction (CVE-2024-53055 bsc#1233550)
- commit c2d5beb</changelog>
  <changelog author="dsterba@suse.com" date="1733400008">- mctp i2c: handle NULL header address (CVE-2024-53043 bsc#1233523)
- commit 5a81634</changelog>
  <changelog author="dsterba@suse.com" date="1733400009">- drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability (CVE-2024-53051 bsc#1233547)
- commit 5262489</changelog>
  <changelog author="iivanov@suse.de" date="1733486400">- kABI: Restore exported __arm_smccc_sve_check (git-fixes)
- commit 3817c3a</changelog>
  <changelog author="iivanov@suse.de" date="1733486401">- arm64: dts: rockchip: remove num-slots property from (git-fixes)
- commit cb47197</changelog>
  <changelog author="iivanov@suse.de" date="1733486402">- arm64: dts: rockchip: Correct GPIO polarity on brcm BT nodes (git-fixes)
- commit ed87dba</changelog>
  <changelog author="tiwai@suse.de" date="1733486403">- can: j1939: j1939_session_new(): fix skb reference counting
  (git-fixes).
- can: mcp251xfd: mcp251xfd_get_tef_len(): work around erratum
  DS80000789E 6 (git-fixes).
- can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: sja1000: sja1000_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: hi311x: hi3110_can_ist(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors
  statistics (git-fixes).
- can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors
  statistics (git-fixes).
- can: hi311x: hi3110_can_ist(): fix potential use-after-free
  (git-fixes).
- can: sun4i_can: sun4i_can_err(): call can_change_state()
  even if cf is NULL (git-fixes).
- can: c_can: c_can_handle_bus_err(): update statistics if skb
  allocation fails (git-fixes).
- can: dev: can_set_termination(): allow sleeping GPIOs
  (git-fixes).
- HID: wacom: fix when get product name maybe null pointer
  (git-fixes).
- watchdog: rti: of: honor timeout-sec property (git-fixes).
- watchdog: mediatek: Make sure system reset gets asserted in
  mtk_wdt_restart() (git-fixes).
- watchdog: apple: Actually flush writes after requesting watchdog
  restart (git-fixes).
- iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
  (git-fixes).
- commit 535e699</changelog>
  <changelog author="tiwai@suse.de" date="1733486404">- netdevsim: copy addresses for both in and out paths (git-fixes).
- commit daf115e</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1733486405">- net/mlx5: fs, lock FTE when checking if active (CVE-2024-53121
  bsc#1234078).
- mlxsw: spectrum_ipip: Fix memory leak when changing remote
  IPv6 address (CVE-2024-50252 bsc#1233201).
- commit 06c045b</changelog>
  <changelog author="jgross@suse.com" date="1733486406">- vp_vdpa: fix id_table array not null terminated error
  (CVE-2024-53110 bsc#1234085).
- commit ffc9457</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1733486407">- net/mlx5e: kTLS, Fix incorrect page refcounting (CVE-2024-53138
  bsc#1234223).
- ice: protect XDP configuration with a mutex (CVE-2024-46765
  bsc#1230807).
- sch/netem: fix use after free in netem_dequeue (CVE-2024-46800
  bsc#1230827).
- commit c9f3783</changelog>
  <changelog author="tiwai@suse.de" date="1733572800">- drm/v3d: Enable Performance Counters before clearing them
  (git-fixes).
- drm/sti: Add __iomem for mixer_dbg_mxn's parameter (git-fixes).
- dma-fence: Use kernel's sort for merging fences (git-fixes).
- dma-fence: Fix reference leak on fence merge failure path
  (git-fixes).
- ASoC: mediatek: mt8188-mt6359: Remove hardcoded dmic codec
  (git-fixes).
- ASoC: SOF: ipc3-topology: fix resource leaks in
  sof_ipc3_widget_setup_comp_dai() (git-fixes).
- ALSA: usb-audio: Fix a DMA to stack memory bug (git-fixes).
- regmap: detach regmap from dev on regmap_exit (git-fixes).
- spi: mpc52xx: Add cancel_work_sync before module remove
  (git-fixes).
- mmc: core: Further prevent card detect during shutdown
  (git-fixes).
- commit 87e627e</changelog>
  <changelog author="tiwai@suse.de" date="1733572801">- ASoC: Intel: avs: da7219: Remove suspend_pre() and resume_post()
  (stable-fixes).
- ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360
  (NP730QFG) (stable-fixes).
- ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook
  430 G8 (stable-fixes).
- ALSA: usb-audio: add mixer mapping for Corsair HS80
  (stable-fixes).
- ALSA: hda/conexant: fix Z60MR100 startup pop issue
  (stable-fixes).
- commit 8c25a0a</changelog>
</package>
<package pkgid="2053de1a29d5e28dec2663ac8fb834a20571e0086f119b69a21ecbb2915b416c" name="cluster-md-kmp-default" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.3"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="09894bd4f0b0d0cfaa6b0fa6326756f67122973d4e25e8fb387347509f29e75f" name="cluster-md-kmp-default" arch="ppc64le">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.3"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="8d33030930afc040d469c3a62c810f31aac4a0faca01cae26a4dbd5d728323bc" name="cluster-md-kmp-default" arch="s390x">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.3"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="89a8f01b3def4051ef9d4fba553880b7bb82a6fa4739b6b9c188d3090f9a06ec" name="cluster-md-kmp-default" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.3"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="06bb6db856e760b7919e2e9c077d4f10ebe31ca2d440148f8b12cca27aa48cac" name="cluster-md-kmp-rt" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.10.11.2"/>
  <changelog author="lduncan@suse.com" date="1725019200">- scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315
  CVE-2024-43821).
- commit eb73e94</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019201">- iommu/amd: Convert comma to semicolon (git-fixes).
- commit 2714d8b</changelog>
  <changelog author="mkoutny@suse.com" date="1725019202">- Update
  patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch
  (git-fixes CVE-2024-35902 bsc#1224496).
- Update
  patches.suse/ASoC-TAS2781-Fix-tasdev_load_calibrated_data.patch
  (git-fixes CVE-2024-42278 bsc#1229403).
- Update
  patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch
  (git-fixes CVE-2024-43818 bsc#1229296).
- Update
  patches.suse/ASoC-fsl-fsl_qmc_audio-Check-devm_kasprintf-returned.patch
  (git-fixes CVE-2024-42298 bsc#1229369).
- Update
  patches.suse/Bluetooth-MGMT-Add-error-handling-to-pair_device.patch
  (git-fixes CVE-2024-43884 bsc#1229739).
- Update
  patches.suse/KVM-Always-flush-async-PF-workqueue-when-vCPU-is-bei.patch
  (git-fixes CVE-2024-26976 bsc#1223635).
- Update
  patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch
  (git-fixes CVE-2024-42302 bsc#1229366).
- Update
  patches.suse/PCI-endpoint-Clean-up-error-handling-in-vpci_scan_bu.patch
  (git-fixes CVE-2024-43875 bsc#1229486).
- Update
  patches.suse/PCI-endpoint-pci-epf-test-Make-use-of-cached-epc_fea.patch
  (git-fixes CVE-2024-43824 bsc#1229320).
- Update
  patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch
  (git-fixes CVE-2024-43823 bsc#1229303).
- Update
  patches.suse/PCI-rcar-Demote-WARN-to-dev_warn_ratelimited-in-rcar.patch
  (git-fixes CVE-2024-43876 bsc#1229485).
- Update
  patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch
  (git-fixes CVE-2024-43872 bsc#1229489).
- Update
  patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch
  (git-fixes CVE-2024-42285 bsc#1229381).
- Update
  patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch
  (bsc#1208783 CVE-2024-42274 bsc#1229417).
- Update
  patches.suse/SUNRPC-add-a-missing-rpc_stat-for-TCP-TLS.patch
  (git-fixes CVE-2024-36907 bsc#1225751).
- Update
  patches.suse/bpf-arm64-Fix-trampoline-for-BPF_TRAMP_F_CALL_ORIG.patch
  (git-fixes CVE-2024-43840 bsc#1229344).
- Update
  patches.suse/btrfs-fix-double-inode-unlock-for-direct-IO-sync-wri.patch
  (git-fixes CVE-2024-43885 bsc#1229747).
- Update
  patches.suse/btrfs-fix-extent-map-use-after-free-when-adding-page.patch
  (git-fixes CVE-2024-42314 bsc#1229355).
- Update
  patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch
  (bsc#1228801 CVE-2024-43853 bsc#1229292).
- Update
  patches.suse/crypto-ccp-Fix-null-pointer-dereference-in-__sev_snp.patch
  (git-fixes CVE-2024-43874 bsc#1229487).
- Update
  patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch
  (git-fixes CVE-2024-43871 bsc#1229490).
- Update
  patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch
  (git-fixes CVE-2024-43856 bsc#1229346).
- Update
  patches.suse/drm-admgpu-fix-dereferencing-null-pointer-context.patch
  (stable-fixes CVE-2024-43906 bsc#1229785).
- Update
  patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch
  (stable-fixes CVE-2024-43903 bsc#1229781).
- Update
  patches.suse/drm-amd-display-Add-null-checker-before-passing-vari.patch
  (stable-fixes CVE-2024-43902 bsc#1229767).
- Update
  patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch
  (stable-fixes CVE-2024-43895 bsc#1229755).
- Update
  patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch
  (stable-fixes CVE-2024-43905 bsc#1229784).
- Update
  patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch
  (stable-fixes CVE-2024-43908 bsc#1229788).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch
  (stable-fixes CVE-2024-43909 bsc#1229789).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch
  (stable-fixes CVE-2024-43907 bsc#1229787).
- Update
  patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch
  (git-fixes CVE-2024-43894 bsc#1229746).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch
  (git-fixes CVE-2024-42310 bsc#1229358).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch
  (git-fixes CVE-2024-42309 bsc#1229359).
- Update
  patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch
  (git-fixes CVE-2024-43867 bsc#1229493).
- Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch
  (git-fixes CVE-2024-43829 bsc#1229341).
- Update
  patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch
  (git-fixes CVE-2024-43863 bsc#1229497).
- Update
  patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch
  (git-fixes CVE-2024-42315 bsc#1229354).
- Update
  patches.suse/gpio-prevent-potential-speculation-leaks-in-gpio_dev.patch
  (stable-fixes CVE-2024-44931 bsc#1229837).
- Update
  patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch
  (git-fixes CVE-2024-42311 bsc#1229413).
- Update
  patches.suse/iio-Fix-the-sorting-functionality-in-iio_gts_build_a.patch
  (git-fixes CVE-2024-43825 bsc#1229298).
- Update
  patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch
  (git-fixes CVE-2024-43858 bsc#1229414).
- Update
  patches.suse/jfs-Fix-shift-out-of-bounds-in-dbDiscardAG.patch
  (git-fixes CVE-2024-44938 bsc#1229792).
- Update
  patches.suse/jfs-fix-null-ptr-deref-in-dtInsertEntry.patch
  (git-fixes CVE-2024-44939 bsc#1229820).
- Update
  patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch
  (git-fixes CVE-2024-42292 bsc#1229373).
- Update
  patches.suse/kvm-s390-Reject-memory-region-operations-for-ucontrol-VMs.patch
  (git-fixes bsc#1229168 CVE-2024-43819 bsc#1229290).
- Update
  patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch
  (git-fixes CVE-2024-43830 bsc#1229305).
- Update
  patches.suse/lib-objagg-Fix-general-protection-fault.patch
  (git-fixes CVE-2024-43846 bsc#1229360).
- Update
  patches.suse/libbpf-Use-OPTS_SET-macro-in-bpf_xdp_query.patch
  (git-fixes CVE-2024-27050 bsc#1223767).
- Update
  patches.suse/mISDN-Fix-a-use-after-free-in-hfcmulti_tx.patch
  (git-fixes CVE-2024-42280 bsc#1229388).
- Update
  patches.suse/mailbox-mtk-cmdq-Move-devm_mbox_controller_register-.patch
  (git-fixes CVE-2024-42319 bsc#1229350).
- Update
  patches.suse/md-raid5-fix-deadlock-that-raid5d-wait-for-itself-to-clear-MD_SB_CHANGE_PENDING-151f.patch
  (git-fixes CVE-2024-39476 bsc#1227437).
- Update
  patches.suse/media-imx-pxp-Fix-ERR_PTR-dereference-in-pxp_probe.patch
  (git-fixes CVE-2024-42303 bsc#1229365).
- Update
  patches.suse/media-pci-ivtv-Add-check-for-DMA-map-result.patch
  (git-fixes CVE-2024-43877 bsc#1229484).
- Update
  patches.suse/media-v4l-async-Fix-NULL-pointer-dereference-in-addi.patch
  (git-fixes CVE-2024-43833 bsc#1229299).
- Update
  patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch
  (git-fixes CVE-2024-42313 bsc#1229356).
- Update
  patches.suse/media-xc2028-avoid-use-after-free-in-load_firmware_c.patch
  (stable-fixes CVE-2024-43900 bsc#1229756).
- Update
  patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch
  (git-fixes CVE-2024-43892 bsc#1229761).
- Update
  patches.suse/net-drop-bad-gso-csum_start-and-offset-in-virtio_net.patch
  (git-fixes CVE-2024-43897 bsc#1229752).
- Update
  patches.suse/net-iucv-fix-use-after-free-in-iucv_sock_close.patch
  (bsc#1228973 CVE-2024-42271 bsc#1229400).
- Update patches.suse/net-missing-check-virtio.patch (git-fixes
  CVE-2024-43817 bsc#1229312).
- Update
  patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch
  (git-fixes CVE-2024-43861 bsc#1229500).
- Update
  patches.suse/nfs-pass-explicit-offset-count-to-trace-events.patch
  (git-fixes CVE-2024-43826 bsc#1229294).
- Update
  patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch
  (git-fixes CVE-2024-42276 bsc#1229410).
- Update
  patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch
  (git-fixes CVE-2024-43889 bsc#1229743).
- Update
  patches.suse/remoteproc-imx_rproc-Skip-over-memory-region-when-no.patch
  (git-fixes CVE-2024-43860 bsc#1229319).
- Update
  patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch
  (git-fixes bsc#1229173 CVE-2024-42320 bsc#1229349).
- Update
  patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch
  (bsc#1228857 CVE-2024-43816 bsc#1229318).
- Update
  patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch
  (bsc#1228850 CVE-2024-42287 bsc#1229392).
- Update
  patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch
  (bsc#1228850 CVE-2024-42289 bsc#1229399).
- Update
  patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch
  (bsc#1228850 CVE-2024-42288 bsc#1229398).
- Update
  patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch
  (bsc#1228850 CVE-2024-42286 bsc#1229395).
- Update
  patches.suse/serial-core-check-uartclk-for-zero-to-avoid-divide-b.patch
  (stable-fixes CVE-2024-43893 bsc#1229759).
- Update
  patches.suse/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch
  (git-fixes CVE-2024-43849 bsc#1229307).
- Update
  patches.suse/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch
  (git-fixes CVE-2024-43851 bsc#1229313).
- Update
  patches.suse/spi-microchip-core-ensure-TX-and-RX-FIFOs-are-empty-.patch
  (git-fixes CVE-2024-42279 bsc#1229390).
- Update
  patches.suse/usb-vhci-hcd-Do-not-drop-references-before-new-refer.patch
  (stable-fixes CVE-2024-43883 bsc#1229707).
- Update
  patches.suse/vhost-vsock-always-initialize-seqpacket_allow.patch
  (git-fixes CVE-2024-43873 bsc#1229488).
- Update
  patches.suse/wifi-ath12k-change-DMA-direction-while-mapping-reinj.patch
  (git-fixes CVE-2024-43881 bsc#1229480).
- Update
  patches.suse/wifi-ath12k-fix-invalid-memory-access-while-processi.patch
  (git-fixes CVE-2024-43847 bsc#1229291).
- Update
  patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch
  (git-fixes CVE-2024-43879 bsc#1229482).
- Update
  patches.suse/wifi-nl80211-disallow-setting-special-AP-channel-wid.patch
  (stable-fixes CVE-2024-43912 bsc#1229830).
- Update
  patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch
  (git-fixes CVE-2024-43842 bsc#1229317).
- Update
  patches.suse/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch
  (git-fixes CVE-2024-43841 bsc#1229304).
- commit 140ec33</changelog>
  <changelog author="tiwai@suse.de" date="1725105600">- dmaengine: dw: Add memory bus width verification (git-fixes).
- dmaengine: dw: Add peripheral bus width verification
  (git-fixes).
- soundwire: stream: fix programming slave ports for non-continous
  port maps (git-fixes).
- commit b7e9784</changelog>
  <changelog author="tiwai@suse.de" date="1725192000">- usb: cdnsp: fix for Link TRB with TC (git-fixes).
- usb: dwc3: st: add missing depopulate in probe error path
  (git-fixes).
- usb: dwc3: st: fix probed platform device ref count on probe
  error path (git-fixes).
- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
  remove_power_attributes() (git-fixes).
- usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).
- usb: dwc3: omap: add missing depopulate in probe error path
  (git-fixes).
- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
  (git-fixes).
- soc: qcom: pmic_glink: Actually communicate when remote goes
  down (git-fixes).
- soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).
- commit 7121142</changelog>
  <changelog author="ailiop@suse.com" date="1725192001">- xfs: Fix the owner setting issue for rmap query in xfs fsmap
  (git-fixes).
- commit 49b5eec</changelog>
  <changelog author="ailiop@suse.com" date="1725192002">- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code
  (git-fixes).
- commit 288ad9b</changelog>
  <changelog author="ailiop@suse.com" date="1725192003">- xfs: Fix missing interval for missing_owner in xfs fsmap
  (git-fixes).
- commit 5448ab5</changelog>
  <changelog author="ohering@suse.de" date="1725278400">- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).
- commit 4dc1da1</changelog>
  <changelog author="osalvador@suse.de" date="1725278401">- mm/sparsemem: fix race in accessing memory_section-&gt;usage
  (bsc#1221326 CVE-2023-52489).
- commit 6aa8957</changelog>
  <changelog author="osalvador@suse.de" date="1725278402">- mm, kmsan: fix infinite recursion due to RCU critical section
  (git-fixes).
- commit 16ad73a</changelog>
  <changelog author="osalvador@suse.de" date="1725278403">- mm: prevent derefencing NULL ptr in pfn_section_valid()
  (git-fixes).
- commit 35f619d</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278404">- bluetooth/l2cap: sync sock recv cb and release (bsc#1228576
  CVE-2024-41062).
- commit 6553526</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278405">- Bluetooth: L2CAP: Fix deadlock (git-fixes).
- commit 13aba13</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278406">- Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).
- commit 1bec58d</changelog>
  <changelog author="lhenriques@suse.de" date="1725278407">- ceph: periodically flush the cap releases (bsc#1230056).
- commit e22b6e0</changelog>
  <changelog author="tiwai@suse.de" date="1725969600">- Drop soundwire patch that caused a regression (bsc#1230350)
  Deleted:
  patches.suse/soundwire-stream-fix-programming-slave-ports-for-non.patch
- commit 5c05eeb</changelog>
  <changelog author="osalvador@suse.de" date="1726228800">- Revert "mm: prevent derefencing NULL ptr in pfn_section_valid()"
  This reverts commit 35f619d3c421219e07bc89d2d6a37fbff25519fe to fix a refression
  (bsc#1230413)
- commit 7e5afd7</changelog>
  <changelog author="osalvador@suse.de" date="1726228801">- Revert "mm, kmsan: fix infinite recursion due to RCU critical section"
  This reverts commit 16ad73a9f4c2888f3bc28513f5e9a88d753f8741 to fix a regression (bsc#1230413)
- commit 2fd5290</changelog>
  <changelog author="osalvador@suse.de" date="1726228802">- Revert "mm/sparsemem: fix race in accessing memory_section-&gt;usage"
  This reverts commit 6aa8957889611fbe7f06353f917cfb3d9620a680 to fix a regression (bsc#1230413)
- commit 720e36b</changelog>
</package>
<package pkgid="e2c7c1ae8628cf846023be55ab8240fe675c795ec33ea49ecb628b6c97bf3002" name="cluster-md-kmp-rt" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.10.14.1"/>
  <changelog author="ailiop@suse.com" date="1727697600">- erofs: fix incorrect symlink detection in fast symlink
  (git-fixes).
- commit 2e1ae75</changelog>
  <changelog author="hare@suse.de" date="1727697601">- nvme-multipath: system fails to create generic nvme device
  (bsc#1228244).
- commit 4fc57d2</changelog>
  <changelog author="hare@suse.de" date="1727697602">- nvme-multipath: avoid hang on inaccessible namespaces
  (bsc#1228244).
- kcm: Serialise kcm_sendmsg() for the same socket
  (CVE-2024-44946,bsc#1230015).
- commit a84ca87</changelog>
  <changelog author="hare@suse.de" date="1727697603">- kcm: Serialise kcm_sendmsg() for the same socket (CVE-2024-44946
  bsc#1230015).
- commit 4310760</changelog>
  <changelog author="tiwai@suse.de" date="1727697604">- Move upstreamed SCSI patches into sorted section
- commit aba5747</changelog>
  <changelog author="tiwai@suse.de" date="1727697605">- mailbox: bcm2835: Fix timeout during suspend mode (git-fixes).
- mailbox: rockchip: fix a typo in module autoloading (git-fixes).
- i2c: designware: fix controller is holding SCL low while ENABLE
  bit is disabled (git-fixes).
- drm/amd/display: handle nulled pipe context in DCE110's
  set_drr() (git-fixes).
- drm/amdgpu: Fix get each xcp macro (git-fixes).
- tomoyo: fallback to realpath if symlink's pathname does not
  exist (git-fixes).
- cxl/pci: Fix to record only non-zero ranges (git-fixes).
- ata: libata-scsi: Fix ata_msense_control() CDL page reporting
  (git-fixes).
- firmware_loader: Block path traversal (git-fixes).
- driver core: Fix a potential null-ptr-deref in
  module_add_driver() (git-fixes).
- driver core: Fix error handling in driver API device_rename()
  (git-fixes).
- ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()
  (git-fixes).
- iio: magnetometer: ak8975: Fix reading for ak099xx sensors
  (git-fixes).
- iio: chemical: bme680: Fix read/write ops to device by adding
  mutexes (git-fixes).
- ABI: testing: fix admv8818 attr description (git-fixes).
- iio: adc: ad7606: fix standby gpio state to match the
  documentation (git-fixes).
- iio: adc: ad7606: fix oversampling gpio array (git-fixes).
- tty: rp2: Fix reset with non forgiving PCIe host bridges
  (git-fixes).
- USB: class: CDC-ACM: fix race between get_serial and set_serial
  (git-fixes).
- usb: dwc2: drd: fix clock gating on USB role switch (git-fixes).
- usb: cdnsp: Fix incorrect usb_request status (git-fixes).
- USB: usbtmc: prevent kernel-usb-infoleak (git-fixes).
- USB: serial: kobil_sct: restore initial terminal settings
  (git-fixes).
- xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and
  freeing them (git-fixes).
- usb: dwc2: Skip clock gating on Broadcom SoCs (git-fixes).
- spi: atmel-quadspi: Avoid overwriting delay register settings
  (git-fixes).
- spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
  (git-fixes).
- spi: atmel-quadspi: Undo runtime PM changes at driver exit time
  (git-fixes).
- rtc: at91sam9: fix OF node leak in probe() error path
  (git-fixes).
- i3c: master: svc: Fix use after free vulnerability in
  svc_i3c_master Driver Due to Race Condition (git-fixes).
- remoteproc: k3-r5: Fix error handling when power-up failed
  (git-fixes).
- remoteproc: imx_rproc: Initialize workqueue earlier (git-fixes).
- remoteproc: imx_rproc: Correct ddr alias for i.MX8M (git-fixes).
- KEYS: prevent NULL pointer dereference in find_asymmetric_key()
  (git-fixes).
- media: i2c: ar0521: Use cansleep version of gpiod_set_value()
  (git-fixes).
- media: ov5675: Fix power on/off delay timings (git-fixes).
- media: sun4i_csi: Implement link validate for sun4i_csi subdev
  (git-fixes).
- media: platform: rzg2l-cru: rzg2l-csi2: Add missing
  MODULE_DEVICE_TABLE (git-fixes).
- media: venus: fix use after free bug in venus_remove due to
  race condition (git-fixes).
- media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
  (git-fixes).
- clk: ti: dra7-atl: Fix leak of of_nodes (git-fixes).
- watchdog: imx_sc_wdt: Don't disable WDT in suspend (git-fixes).
- pinctrl: single: fix missing error code in pcs_probe()
  (git-fixes).
- xz: cleanup CRC32 edits from 2018 (git-fixes).
- ata: pata_macio: Use WARN instead of BUG (stable-fixes).
- commit c5ab3ca</changelog>
  <changelog author="iivanov@suse.de" date="1727697606">- arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (bsc#1231120 CVE-2024-46822)
- commit cc6d7b5</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697607">- tracing: Fix overflow in get_free_elt() (git-fixes
  CVE-2024-43890 bsc#1229764).
- commit ceb524e</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697608">- tracing: Avoid possible softlockup in tracing_iter_reset()
  (git-fixes).
- commit d5df75c</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697609">- bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()
  (git-fixes).
- commit 1884922</changelog>
  <changelog author="petr.pavlu@suse.com" date="1727697610">- Refresh
  patches.suse/bpf-kprobe-remove-unused-declaring-of-bpf_kprobe_override.patch.
- commit 5a0b269</changelog>
  <changelog author="tiwai@suse.de" date="1727697611">- supported.conf: mark adiantum and xctr crypto modules as supported (bsc#1231035)
- commit 59d03d7</changelog>
  <changelog author="pmladek@suse.com" date="1727697612">- kthread: Fix task state in kthread worker if being frozen
  (bsc#1231146).
- commit fe88a62</changelog>
  <changelog author="tiwai@suse.de" date="1727784000">- USB: serial: pl2303: add device id for Macrosilicon MS3020
  (stable-fixes).
- powercap/intel_rapl: Add support for AMD family 1Ah
  (stable-fixes).
- ASoC: amd: yc: Add a quirk for MSI Bravo 17 (D7VEK)
  (stable-fixes).
- ASoC: tda7419: fix module autoloading (stable-fixes).
- ASoC: intel: fix module autoloading (stable-fixes).
- ASoC: Intel: soc-acpi-cht: Make Lenovo Yoga Tab 3 X90F DMI
  match less strict (stable-fixes).
- ALSA: hda: add HDMI codec ID for Intel PTL (stable-fixes).
- drm: komeda: Fix an issue related to normalized zpos
  (stable-fixes).
- can: mcp251xfd: mcp251xfd_ring_init(): check TX-coalescing
  configuration (stable-fixes).
- spi: spidev: Add missing spi_device_id for jg10309-01
  (git-fixes).
- spi: bcm63xx: Enable module autoloading (stable-fixes).
- spi: spidev: Add an entry for elgin,jg10309-01 (stable-fixes).
- hwmon: (asus-ec-sensors) remove VRM temp X570-E GAMING
  (stable-fixes).
- wifi: iwlwifi: clear trans-&gt;state earlier upon error
  (stable-fixes).
- wifi: mac80211: free skb on error path in
  ieee80211_beacon_get_ap() (stable-fixes).
- wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
  (stable-fixes).
- wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
  (stable-fixes).
- wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room()
  (stable-fixes).
- wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation
  (stable-fixes).
- wifi: iwlwifi: lower message level for FW buffer destination
  (stable-fixes).
- platform/x86: x86-android-tablets: Make Lenovo Yoga Tab 3 X90F
  DMI match less strict (stable-fixes).
- pinctrl: at91: make it work with current gpiolib (stable-fixes).
- can: mcp251xfd: properly indent labels (stable-fixes).
- commit a530f31</changelog>
  <changelog author="tiwai@suse.de" date="1727784001">- can: mcp251xfd: move mcp251xfd_timestamp_start()/stop() into
  mcp251xfd_chip_start/stop() (stable-fixes).
- Refresh
  patches.suse/can-mcp251xfd-clarify-the-meaning-of-timestamp.patch.
- commit 6779985</changelog>
  <changelog author="lhenriques@suse.de" date="1727784002">- cachefiles: fix dentry leak in cachefiles_open_file()
  (bsc#1231183).
- ceph: remove the incorrect Fw reference check when dirtying
  pages (bsc#1231182).
- commit ba82da7</changelog>
  <changelog author="tiwai@suse.de" date="1727784003">- ACPICA: executer/exsystem: Don't nag user about every Stall()
  violating the spec (git-fixes).
- ACPICA: Implement ACPI_WARNING_ONCE and ACPI_ERROR_ONCE
  (stable-fixes).
- commit f94e799</changelog>
  <changelog author="mgorman@suse.de" date="1727870400">- Merge branch 'SLE15-SP6' (ea7c56db3e5d) into 'SLE15-SP6-RT'
- No -rt specific changes this merge.
- commit 9288a8a</changelog>
  <changelog author="mgorman@suse.de" date="1727870401">- Merge branch 'SLE15-SP6' (ea7c56db3e5d) into 'SLE15-SP6-RT'
- No -rt specific changes this merge.
- commit f95dc7e</changelog>
  <changelog author="mgorman@suse.de" date="1727870402">- Merge branch 'SLE15-SP6' (ea7c56db3e5d) into 'SLE15-SP6-RT'
- Refreshed -rt patches
  patches.suse/perf-Enqueue-SIGTRAP-always-via-task_work.patch
  patches.suse/perf-Move-irq_work_queue-where-the-event-is-prepared.patch
  patches.suse/perf-Split-__perf_pending_irq-out-of-perf_pending_irq.patch
  patches.suse/task_work-Add-TWA_NMI_CURRENT-as-an-additional-notify-mode.patch
- commit 9a06068</changelog>
</package>
<package pkgid="fbb250babb1bb7a65e81bf7ed08a9570db3a3477e9a1661e139ba0e19de7d02b" name="cluster-md-kmp-rt" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.10.17.1"/>
  <changelog author="petr.pavlu@suse.com" date="1730635200">- fgraph: Change the name of cpuhp state to "fgraph:online"
  (git-fixes).
- commit 59421b3</changelog>
  <changelog author="neilb@suse.de" date="1730721600">- NFSD: Force all NFSv4.2 COPY requests to be synchronous
  (CVE-2024-49974 bsc#1232383).
- commit 16045fc</changelog>
  <changelog author="jlee@suse.com" date="1730721601">- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766 bsc#1230620).
- Update
  patches.suse/media-pci-cx23885-check-cx23885_vdev_init-return.patch
  (stable-fixes CVE-2023-52918 bsc#1232047).
- Update
  patches.suse/nfc-nci-fix-possible-NULL-pointer-dereference-in-sen.patch
  (git-fixes CVE-2023-52919 bsc#1231988).
- Update
  patches.suse/ntb-intel-Fix-the-NULL-vs-IS_ERR-bug-for-debugfs_cre.patch
  (git-fixes CVE-2023-52917 bsc#1231849).
- Update
  patches.suse/tcp-do-not-accept-ACK-of-bytes-we-never-sent.patch
  (CVE-2023-52881 bsc#1225611 bsc#1223384).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800 bsc#1230600).
- commit 9859953</changelog>
  <changelog author="jlee@suse.com" date="1730721602">- Update
  patches.suse/0002-x86-mm-ident_map-Use-gbpages-only-where-full-GB-page.patch
  (bsc#1220382 CVE-2024-50017 bsc#1232312).
- Update patches.suse/ACPI-PAD-fix-crash-in-exit_round_robin.patch
  (stable-fixes CVE-2024-49935 bsc#1232370).
- Update
  patches.suse/ACPI-battery-Fix-possible-crash-when-unregistering-a.patch
  (git-fixes CVE-2024-49955 bsc#1232154).
- Update
  patches.suse/ACPI-sysfs-validate-return-type-of-_STR-method.patch
  (git-fixes CVE-2024-49860 bsc#1231861).
- Update
  patches.suse/ACPICA-check-null-return-of-ACPI_ALLOCATE_ZEROED-in-.patch
  (stable-fixes CVE-2024-49962 bsc#1232314).
- Update
  patches.suse/ALSA-asihpi-Fix-potential-OOB-array-access.patch
  (stable-fixes CVE-2024-50007 bsc#1232394).
- Update
  patches.suse/Bluetooth-Call-iso_exit-on-module-unload.patch
  (git-fixes CVE-2024-50078 bsc#1232503).
- Update
  patches.suse/Bluetooth-ISO-Fix-multiple-init-when-debugfs-is-disa.patch
  (git-fixes CVE-2024-50077 bsc#1232504).
- Update
  patches.suse/Bluetooth-RFCOMM-FIX-possible-deadlock-in-rfcomm_sk_.patch
  (git-fixes CVE-2024-50044 bsc#1231904).
- Update
  patches.suse/IB-core-Fix-ib_cache_setup_one-error-flow-cleanup.patch
  (git-fixes CVE-2024-47693 bsc#1232013).
- Update
  patches.suse/IB-core-Implement-a-limit-on-UMAD-receive-List.patch
  (bsc#1228743 CVE-2024-42145 bsc#1223384).
- Update
  patches.suse/Input-adp5589-keys-fix-NULL-pointer-dereference.patch
  (git-fixes CVE-2024-49871 bsc#1232287).
- Update
  patches.suse/KEYS-prevent-NULL-pointer-dereference-in-find_asymme.patch
  (git-fixes CVE-2024-47743 bsc#1232129).
- Update
  patches.suse/KVM-Use-dedicated-mutex-to-protect-kvm_usage_count-t.patch
  (git-fixes CVE-2024-47744 bsc#1232132).
- Update
  patches.suse/PCI-keystone-Fix-if-statement-expression-in-ks_pcie_.patch
  (git-fixes CVE-2024-47756 bsc#1232185).
- Update
  patches.suse/PCI-kirin-Fix-buffer-overflow-in-kirin_pcie_parse_po.patch
  (git-fixes CVE-2024-47751 bsc#1232127).
- Update
  patches.suse/RDMA-cxgb4-Added-NULL-check-for-lookup_atid.patch
  (git-fixes CVE-2024-47749 bsc#1232180).
- Update
  patches.suse/RDMA-hns-Fix-Use-After-Free-of-rsv_qp-on-HIP08.patch
  (git-fixes CVE-2024-47750 bsc#1232182).
- Update
  patches.suse/RDMA-hns-Fix-spin_unlock_irqrestore-called-with-IRQs.patch
  (git-fixes CVE-2024-47735 bsc#1232111).
- Update
  patches.suse/RDMA-iwcm-Fix-WARNING-at_kernel-workqueue.c-check_fl.patch
  (git-fixes CVE-2024-47696 bsc#1231864).
- Update
  patches.suse/RDMA-rtrs-clt-Reset-cid-to-con_num-1-to-stay-in-boun.patch
  (git-fixes CVE-2024-47695 bsc#1231931).
- Update
  patches.suse/RDMA-rtrs-srv-Avoid-null-pointer-deref-during-path-e.patch
  (git-fixes CVE-2024-50062 bsc#1232232).
- Update
  patches.suse/aoe-fix-the-potential-use-after-free-problem-in-more.patch
  (bsc#1218562 CVE-2023-6270 CVE-2024-49982 bsc#1232097).
- Update
  patches.suse/bpf-Fail-verification-for-sign-extension-of-packet-d.patch
  (git-fixes CVE-2024-47702 bsc#1231924).
- Update
  patches.suse/bpf-Fix-helper-writes-to-read-only-maps.patch
  (git-fixes CVE-2024-49861 bsc#1232254).
- Update
  patches.suse/bpf-Fix-use-after-free-in-bpf_uprobe_multi_link_attach.patch
  (git-fixes CVE-2024-47675 bsc#1231926).
- Update
  patches.suse/bpf-Zero-former-ARG_PTR_TO_-LONG-INT-args-in-case-of.patch
  (git-fixes CVE-2024-47728 bsc#1232076).
- Update
  patches.suse/bpf-correctly-handle-malformed-BPF_CORE_TYPE_ID_LOCA.patch
  (git-fixes CVE-2024-49850 bsc#1232189).
- Update
  patches.suse/cachefiles-fix-dentry-leak-in-cachefiles_open_file.patch
  (bsc#1231183 CVE-2024-49870 bsc#1232279).
- Update
  patches.suse/can-bcm-Clear-bo-bcm_proc_read-after-remove_proc_ent.patch
  (git-fixes CVE-2024-47709 bsc#1232048).
- Update
  patches.suse/crypto-iaa-Fix-potential-use-after-free-bug.patch
  (git-fixes CVE-2024-47732 bsc#1232109).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761 bsc#1230375).
- Update
  patches.suse/driver-core-Fix-a-potential-null-ptr-deref-in-module.patch
  (git-fixes CVE-2024-47688 bsc#1232009).
- Update
  patches.suse/driver-core-bus-Fix-double-free-in-driver-API-bus_re.patch
  (stable-fixes CVE-2024-50055 bsc#1232329).
- Update
  patches.suse/drivers-media-dvb-frontends-rtl2830-fix-an-out-of-bo.patch
  (git-fixes CVE-2024-47697 bsc#1231858).
- Update
  patches.suse/drivers-media-dvb-frontends-rtl2832-fix-an-out-of-bo.patch
  (git-fixes CVE-2024-47698 bsc#1231859).
- Update
  patches.suse/drm-amd-display-Add-null-check-for-set_output_gamma-.patch
  (git-fixes CVE-2024-47720 bsc#1232043).
- Update
  patches.suse/drm-amd-display-Check-null-pointer-before-dereferenc.patch
  (stable-fixes CVE-2024-50049 bsc#1232309).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767 bsc#1230339).
- Update
  patches.suse/drm-omapdrm-Add-missing-check-for-alloc_ordered_work.patch
  (git-fixes CVE-2024-49879 bsc#1232349).
- Update
  patches.suse/drm-v3d-Stop-the-active-perfmon-before-being-destroy.patch
  (git-fixes CVE-2024-50031 bsc#1231947).
- Update
  patches.suse/efistub-tpm-Use-ACPI-reclaim-memory-for-event-log-to.patch
  (stable-fixes CVE-2024-49858 bsc#1232251).
- Update
  patches.suse/ep93xx-clock-Fix-off-by-one-in-ep93xx_div_recalc_rat.patch
  (git-fixes CVE-2024-47686 bsc#1232000).
- Update
  patches.suse/exfat-fix-memory-leak-in-exfat_load_bitmap.patch
  (git-fixes CVE-2024-50013 bsc#1232080).
- Update
  patches.suse/fbcon-Fix-a-NULL-pointer-dereference-issue-in-fbcon_.patch
  (stable-fixes CVE-2024-50048 bsc#1232310).
- Update
  patches.suse/firmware-arm_scmi-Fix-double-free-in-OPTEE-transport.patch
  (git-fixes CVE-2024-49853 bsc#1232192).
- Update patches.suse/firmware_loader-Block-path-traversal.patch
  (git-fixes CVE-2024-47742 bsc#1232126).
- Update
  patches.suse/i2c-stm32f7-Do-not-prepare-unprepare-clock-during-ru.patch
  (git-fixes CVE-2024-49985 bsc#1232094).
- Update
  patches.suse/i3c-master-cdns-Fix-use-after-free-vulnerability-in-.patch
  (stable-fixes CVE-2024-50061 bsc#1232263).
- Update
  patches.suse/i3c-master-svc-Fix-use-after-free-vulnerability-in-s.patch
  (git-fixes CVE-2024-49874 bsc#1232295).
- Update
  patches.suse/i40e-Fix-XDP-program-unloading-while-removing-the-dr.patch
  (git-fixes CVE-2024-41047 bsc#1228537).
- Update
  patches.suse/idpf-fix-UAFs-when-destroying-the-queues.patch
  (git-fixes CVE-2024-44932 bsc#1229808).
- Update
  patches.suse/idpf-fix-memory-leaks-and-crashes-while-performing-a.patch
  (git-fixes CVE-2024-44964 bsc#1230220).
- Update
  patches.suse/iommufd-Protect-against-overflow-of-ALIGN-during-iov.patch
  (git-fixes CVE-2024-47719 bsc#1231865).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848 bsc#1223384).
- Update patches.suse/jfs-Fix-uaf-in-dbFreeBits.patch (git-fixes
  CVE-2024-49903 bsc#1232362).
- Update
  patches.suse/jfs-Fix-uninit-value-access-of-new_ea-in-ea_buffer.patch
  (git-fixes CVE-2024-49900 bsc#1232359).
- Update
  patches.suse/jfs-check-if-leafidx-greater-than-num-leaves-per-dmap-tree.patch
  (git-fixes CVE-2024-49902 bsc#1232378).
- Update
  patches.suse/jfs-fix-out-of-bounds-in-dbNextAG-and-diAlloc.patch
  (git-fixes CVE-2024-47723 bsc#1232050).
- Update
  patches.suse/mailbox-bcm2835-Fix-timeout-during-suspend-mode.patch
  (git-fixes CVE-2024-49963 bsc#1232147).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758 bsc#1230341).
- Update patches.suse/media-edia-dvbdev-fix-a-use-after-free.patch
  (git-fixes CVE-2024-27043 bsc#1223824 bsc#1218562).
- Update
  patches.suse/media-i2c-ar0521-Use-cansleep-version-of-gpiod_set_v.patch
  (git-fixes CVE-2024-49961 bsc#1232148).
- Update
  patches.suse/media-venus-fix-use-after-free-bug-in-venus_remove-d.patch
  (git-fixes CVE-2024-49981 bsc#1232098).
- Update
  patches.suse/nbd-fix-race-between-timeout-and-normal-completion.patch
  (bsc#1230918 CVE-2024-49855 bsc#1232195).
- Update
  patches.suse/net-phy-Remove-LED-entry-from-LEDs-list-on-unregiste.patch
  (git-fixes CVE-2024-50023 bsc#1231955).
- Update
  patches.suse/net-test-for-not-too-small-csum_start-in-virtio_net_.patch
  (git-fixes CVE-2024-49947 bsc#1232162).
- Update
  patches.suse/nfsd-call-cache_put-if-xdr_reserve_space-returns-NULL.patch
  (git-fixes CVE-2024-47737 bsc#1232056).
- Update
  patches.suse/nfsd-map-the-EBADMSG-to-nfserr_io-to-avoid-warning.patch
  (git-fixes CVE-2024-49875 bsc#1232333).
- Update
  patches.suse/nilfs2-fix-potential-null-ptr-deref-in-nilfs_btree_insert.patch
  (git-fixes CVE-2024-47699 bsc#1231916).
- Update
  patches.suse/nilfs2-fix-potential-oob-read-in-nilfs_btree_check_delete.patch
  (git-fixes CVE-2024-47757 bsc#1232187).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943 bsc#1230527).
- Update
  patches.suse/ocfs2-cancel-dqi_sync_work-before-freeing-oinfo.patch
  (git-fixes CVE-2024-49966 bsc#1232141).
- Update
  patches.suse/ocfs2-fix-null-ptr-deref-when-journal-load-failed.patch
  (git-fixes CVE-2024-49957 bsc#1232152).
- Update
  patches.suse/ocfs2-fix-possible-null-ptr-deref-in-ocfs2_set_buffer_uptodate.patch
  (git-fixes CVE-2024-49877 bsc#1232339).
- Update
  patches.suse/ocfs2-remove-unreasonable-unlock-in-ocfs2_read_blocks.patch
  (git-fixes CVE-2024-49965 bsc#1232142).
- Update
  patches.suse/parport-Proper-fix-for-array-out-of-bounds-access.patch
  (git-fixes CVE-2024-50074 bsc#1232507).
- Update
  patches.suse/pinctrl-apple-check-devm_kasprintf-returned-value.patch
  (git-fixes CVE-2024-50069 bsc#1232511).
- Update
  patches.suse/platform-x86-ISST-Fix-the-KASAN-report-slab-out-of-b.patch
  (git-fixes CVE-2024-49886 bsc#1232196).
- Update
  patches.suse/powercap-intel_rapl-Fix-off-by-one-in-get_rpi.patch
  (git-fixes CVE-2024-49862 bsc#1231871).
- Update
  patches.suse/resource-fix-region_intersects-vs-add_memory_driver_.patch
  (git-fixes CVE-2024-49878 bsc#1232340).
- Update
  patches.suse/scsi-fnic-Move-flush_work-initialization-out-of-if-b.patch
  (bsc#1230055 CVE-2024-50025 bsc#1231953).
- Update
  patches.suse/scsi-lpfc-validate-hdwq-pointers-before-dereferencing-in.patch
  (bsc#1229429 jsc#PED-9899 CVE-2024-49891 bsc#1232218).
- Update
  patches.suse/scsi-sd-Fix-off-by-one-error-in-sd_read_block_charac.patch
  (bsc#1223848 CVE-2024-47682 bsc#1231856).
- Update
  patches.suse/serial-protect-uart_port_dtr_rts-in-uart_shutdown-to.patch
  (stable-fixes CVE-2024-50058 bsc#1232285).
- Update
  patches.suse/tpm-Clean-up-TPM-space-after-command-failure.patch
  (git-fixes CVE-2024-49851 bsc#1232134).
- Update
  patches.suse/tty-n_gsm-Fix-use-after-free-in-gsm_cleanup_mux.patch
  (stable-fixes CVE-2024-50073 bsc#1232520).
- Update
  patches.suse/vhost-scsi-null-ptr-dereference-in-vhost_scsi_get_re.patch
  (git-fixes CVE-2024-49863 bsc#1232255).
- Update
  patches.suse/vhost_vdpa-assign-irq-bypass-producer-token-correctl.patch
  (git-fixes CVE-2024-47748 bsc#1232174).
- Update patches.suse/vmxnet3-Fix-missing-reserved-tailroom.patch
  (bsc#1226498 CVE-2024-27026 bsc#1223700).
- Update
  patches.suse/vt-prevent-kernel-infoleak-in-con_font_get.patch
  (git-fixes CVE-2024-50076 bsc#1232505).
- Update
  patches.suse/wifi-ath11k-fix-array-out-of-bound-access-in-SoC-sta.patch
  (stable-fixes CVE-2024-49930 bsc#1232260).
- Update
  patches.suse/wifi-ath12k-fix-array-out-of-bound-access-in-SoC-sta.patch
  (stable-fixes CVE-2024-49931 bsc#1232275).
- Update
  patches.suse/wifi-ath9k_htc-Use-__skb_set_length-for-resetting-ur.patch
  (stable-fixes CVE-2024-49938 bsc#1232552).
- Update
  patches.suse/wifi-cfg80211-Set-correct-chandef-when-starting-CAC.patch
  (stable-fixes CVE-2024-49937 bsc#1232427).
- Update
  patches.suse/wifi-iwlwifi-mvm-avoid-NULL-pointer-dereference.patch
  (stable-fixes CVE-2024-49929 bsc#1232253).
- Update
  patches.suse/wifi-mac80211-don-t-use-rate-mask-for-offchannel-TX-.patch
  (git-fixes CVE-2024-47738 bsc#1232114).
- Update
  patches.suse/wifi-mac80211-use-two-phase-skb-reclamation-in-ieee8.patch
  (git-fixes CVE-2024-47713 bsc#1232016).
- Update
  patches.suse/wifi-mt76-mt7915-fix-oops-on-non-dbdc-mt7986.patch
  (git-fixes CVE-2024-47715 bsc#1231860).
- Update
  patches.suse/wifi-mt76-mt7996-fix-NULL-pointer-dereference-in-mt7.patch
  (git-fixes CVE-2024-47681 bsc#1231855).
- Update
  patches.suse/wifi-mt76-mt7996-use-hweight16-to-get-correct-tx-ant.patch
  (git-fixes CVE-2024-47714 bsc#1232018).
- Update
  patches.suse/wifi-mwifiex-Fix-memcpy-field-spanning-write-warning.patch
  (stable-fixes CVE-2024-50008 bsc#1232317).
- Update
  patches.suse/wifi-rtw88-always-wait-for-both-firmware-loading-att.patch
  (git-fixes CVE-2024-47718 bsc#1232015).
- Update
  patches.suse/wifi-rtw89-avoid-reading-out-of-bounds-when-loading-.patch
  (stable-fixes CVE-2024-49928 bsc#1232250).
- Update
  patches.suse/wifi-rtw89-avoid-to-add-interface-to-list-twice-when.patch
  (stable-fixes CVE-2024-49939 bsc#1232381).
- Update
  patches.suse/wifi-wilc1000-fix-potential-RCU-dereference-issue-in.patch
  (git-fixes CVE-2024-47712 bsc#1232017).
- Update
  patches.suse/xhci-tegra-fix-checked-USB2-port-number.patch
  (git-fixes CVE-2024-50075 bsc#1232506).
- commit a270265</changelog>
  <changelog author="neilb@suse.de" date="1730721603">- NFSv3: only use NFS timeout for MOUNT when protocols are
  compatible (bsc#1231016).
- commit ddbeb4f</changelog>
  <changelog author="neilb@suse.de" date="1730721604">- nfsd: cancel nfsd_shrinker_work using sync mode in
  nfs4_state_shutdown_net (git-fixes).
- commit ed2b339</changelog>
  <changelog author="jslaby@suse.cz" date="1730721605">- Refresh
  patches.suse/PCI-Fix-pci_enable_acs-support-for-the-ACS-quirks.patch.
  Update upstream status.
- commit f283868</changelog>
  <changelog author="tiwai@suse.de" date="1730721606">- phy: tegra: xusb: Add error pointer check in xusb.c (git-fixes).
- phy: freescale: imx8m-pcie: Do CMN_RST just before PHY PLL
  lock check (git-fixes).
- phy: ti: phy-j721e-wiz: fix usxgmii configuration (git-fixes).
- phy: qcom: qmp-combo: move driver data initialisation earlier
  (git-fixes).
- phy: qcom: qmp-usb: fix NULL-deref on runtime suspend
  (git-fixes).
- dmaengine: ti: k3-udma: Set EOP for all TRs in cyclic BCDMA
  transfer (git-fixes).
- dmaengine: sh: rz-dmac: handle configs where one address is zero
  (git-fixes).
- Revert "driver core: Fix uevent_show() vs driver detach race"
  (git-fixes).
- usb: phy: Fix API devm_usb_put_phy() can not release the phy
  (git-fixes).
- usb: typec: fix unreleased fwnode_handle in
  typec_port_register_altmodes() (git-fixes).
- xhci: Fix Link TRB DMA in command ring stopped completion event
  (git-fixes).
- xhci: Use pm_runtime_get to prevent RPM on unsupported systems
  (git-fixes).
- usbip: tools: Fix detach_port() invalid port error path
  (git-fixes).
- iio: adc: ad7124: fix division by zero in
  ad7124_set_channel_odr() (git-fixes).
- staging: iio: frequency: ad9832: fix division by zero in
  ad9832_calc_freqreg() (git-fixes).
- iio: light: veml6030: fix microlux value calculation
  (git-fixes).
- iio: gts-helper: Fix memory leaks for the error path of
  iio_gts_build_avail_scale_table() (git-fixes).
- iio: gts-helper: Fix memory leaks in
  iio_gts_build_avail_scale_table() (git-fixes).
- mei: use kvmalloc for read buffer (git-fixes).
- Input: edt-ft5x06 - fix regmap leak when probe fails
  (git-fixes).
- modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on
  32-bit host (git-fixes).
- modpost: fix acpi MODULE_DEVICE_TABLE built with mismatched
  endianness (git-fixes).
- sumversion: Fix a memory leak in get_src_version() (git-fixes).
- genirq/msi: Fix off-by-one error in msi_domain_alloc()
  (git-fixes).
- commit df7fb9d</changelog>
  <changelog author="tiwai@suse.de" date="1730721607">- Add alt-commit to AMDGPU patch
- commit 9e50980</changelog>
  <changelog author="vbabka@suse.cz" date="1730721608">- mm: split critical region in remap_file_pages() and invoke
  LSMs in between (CVE-2024-47745 bsc#1232135 git-fix).
- commit 8228ecb</changelog>
  <changelog author="dwagner@suse.de" date="1730721609">- nvme: re-fix error-handling for io_uring nvme-passthrough
  (git-fixes).
- nvmet-auth: assign dh_key to NULL after kfree_sensitive
  (git-fixes).
- nvme-pci: fix race condition between reset and
  nvme_dev_disable() (git-fixes).
- nvme: null terminate nvme_tls_attrs (git-fixes).
- nvme-pci: set doorbell config before unquiescing (git-fixes).
- commit d7598b1</changelog>
  <changelog author="tiwai@suse.de" date="1730721610">- drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
  (CVE-2024-49991 bsc#1232282).
- commit 1b15839</changelog>
  <changelog author="vkarasulli@suse.de" date="1730721611">- tipc: guard against string buffer overrun (CVE-2024-49995
  bsc#1232432).
- commit ada263e</changelog>
  <changelog author="mfranc@suse.cz" date="1730721612">- net/xen-netback: prevent UAF in xenvif_flush_hash()
  (CVE-2024-49936 bsc#1232424).
- commit ae05dab</changelog>
  <changelog author="vkarasulli@suse.de" date="1730721613">- ext4: fix timer use-after-free on failed mount (CVE-2024-49960
  bsc#1232395).
- commit bd6997d</changelog>
  <changelog author="dwagner@suse.de" date="1730721614">- scsi: lpfc: Update lpfc version to 14.4.0.5 (bsc#1232757).
- scsi: lpfc: Support loopback tests with VMID enabled
  (bsc#1232757).
- scsi: lpfc: Revise TRACE_EVENT log flag severities from KERN_ERR
  to KERN_WARNING (bsc#1232757).
- scsi: lpfc: Ensure DA_ID handling completion before deleting
  an NPIV instance (bsc#1232757).
- scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo
  handler (bsc#1232757).
- scsi: lpfc: Restrict support for 32 byte CDBs to specific HBAs
  (bsc#1232757 bsc#1228119).
- scsi: lpfc: Update phba link state conditional before sending
  CMF_SYNC_WQE (bsc#1232757).
- scsi: lpfc: Add ELS_RSP cmd to the list of WQEs to flush in
  lpfc_els_flush_cmd() (bsc#1232757).
- scsi: lpfc: Remove trailing space after \n newline
  (bsc#1232757).
- commit 3cf27b4</changelog>
  <changelog author="tiwai@suse.de" date="1730721615">- Revert "ALSA: hda/conexant: Mute speakers at suspend / shutdown"
  (bsc#1228269).
- commit 13ce240</changelog>
  <changelog author="tiwai@suse.de" date="1730721616">- Move out-of-tree patch into a proper section
- commit c581359</changelog>
  <changelog author="tiwai@suse.de" date="1730808000">- rpmsg: glink: Handle rejected intent request better (git-fixes).
- firmware: arm_scmi: Fix slab-use-after-free in
  scmi_bus_notifier() (git-fixes).
- commit 01fe6bf</changelog>
  <changelog author="tiwai@suse.de" date="1730808001">- ALSA: usb-audio: Add quirk for HP 320 FHD Webcam (bsc#1232768).
- commit 7c39137</changelog>
</package>
<package pkgid="5b4fef1a26c7c0be78223e772bebf1e1b1c0c3494c7b30eb2754bdb7ef25972d" name="cluster-md-kmp-rt" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.10.20.1"/>
  <changelog author="iivanov@suse.de" date="1733400000">- bpf, arm64: Remove garbage frame for struct_ops trampoline (git-fixes)
- commit e1353aa</changelog>
  <changelog author="msuchanek@suse.de" date="1733400001">- powerpc/fadump: Move fadump_cma_init to setup_arch() after
  initmem_init() (bsc#1215199).
- powerpc/fadump: Refactor and prepare fadump_cma_init for late
  init (bsc#1215199).
- powerpc/pseries: Use correct data types from pseries_hp_errorlog
  struct (bsc#1215199).
- powerpc/vdso: Inconditionally use CFUNC macro (bsc#1215199).
- powerpc/64s: Fix unnecessary copy to 0 when kernel is booted
  at address 0 (bsc#1215199).
- commit d36d28e</changelog>
  <changelog author="dsterba@suse.com" date="1733400002">- net: hns3: fix kernel crash when uninstalling driver (CVE-2024-50296 bsc#1233485)
- commit 6e41fd9</changelog>
  <changelog author="dsterba@suse.com" date="1733400003">- net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (CVE-2024-26596 bsc#1220355)
- commit 4861dc8</changelog>
  <changelog author="dsterba@suse.com" date="1733400004">- Bluetooth: btnxpuart: Fix random crash seen while removing driver (CVE-2024-46680 bsc#1230557)
- commit 3831431</changelog>
  <changelog author="dsterba@suse.com" date="1733400005">- Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test (bsc#1230557)
- commit 9ca14b5</changelog>
  <changelog author="dsterba@suse.com" date="1733400006">- drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() (CVE-2024-53056 bsc#1233568)
- commit 95cef70</changelog>
  <changelog author="dsterba@suse.com" date="1733400007">- wifi: iwlwifi: mvm: fix 6 GHz scan construction (CVE-2024-53055 bsc#1233550)
- commit c2d5beb</changelog>
  <changelog author="dsterba@suse.com" date="1733400008">- mctp i2c: handle NULL header address (CVE-2024-53043 bsc#1233523)
- commit 5a81634</changelog>
  <changelog author="dsterba@suse.com" date="1733400009">- drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability (CVE-2024-53051 bsc#1233547)
- commit 5262489</changelog>
  <changelog author="iivanov@suse.de" date="1733486400">- kABI: Restore exported __arm_smccc_sve_check (git-fixes)
- commit 3817c3a</changelog>
  <changelog author="iivanov@suse.de" date="1733486401">- arm64: dts: rockchip: remove num-slots property from (git-fixes)
- commit cb47197</changelog>
  <changelog author="iivanov@suse.de" date="1733486402">- arm64: dts: rockchip: Correct GPIO polarity on brcm BT nodes (git-fixes)
- commit ed87dba</changelog>
  <changelog author="tiwai@suse.de" date="1733486403">- can: j1939: j1939_session_new(): fix skb reference counting
  (git-fixes).
- can: mcp251xfd: mcp251xfd_get_tef_len(): work around erratum
  DS80000789E 6 (git-fixes).
- can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: sja1000: sja1000_err(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: hi311x: hi3110_can_ist(): fix {rx,tx}_errors statistics
  (git-fixes).
- can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors
  statistics (git-fixes).
- can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors
  statistics (git-fixes).
- can: hi311x: hi3110_can_ist(): fix potential use-after-free
  (git-fixes).
- can: sun4i_can: sun4i_can_err(): call can_change_state()
  even if cf is NULL (git-fixes).
- can: c_can: c_can_handle_bus_err(): update statistics if skb
  allocation fails (git-fixes).
- can: dev: can_set_termination(): allow sleeping GPIOs
  (git-fixes).
- HID: wacom: fix when get product name maybe null pointer
  (git-fixes).
- watchdog: rti: of: honor timeout-sec property (git-fixes).
- watchdog: mediatek: Make sure system reset gets asserted in
  mtk_wdt_restart() (git-fixes).
- watchdog: apple: Actually flush writes after requesting watchdog
  restart (git-fixes).
- iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
  (git-fixes).
- commit 535e699</changelog>
  <changelog author="tiwai@suse.de" date="1733486404">- netdevsim: copy addresses for both in and out paths (git-fixes).
- commit daf115e</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1733486405">- net/mlx5: fs, lock FTE when checking if active (CVE-2024-53121
  bsc#1234078).
- mlxsw: spectrum_ipip: Fix memory leak when changing remote
  IPv6 address (CVE-2024-50252 bsc#1233201).
- commit 06c045b</changelog>
  <changelog author="jgross@suse.com" date="1733486406">- vp_vdpa: fix id_table array not null terminated error
  (CVE-2024-53110 bsc#1234085).
- commit ffc9457</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1733486407">- net/mlx5e: kTLS, Fix incorrect page refcounting (CVE-2024-53138
  bsc#1234223).
- ice: protect XDP configuration with a mutex (CVE-2024-46765
  bsc#1230807).
- sch/netem: fix use after free in netem_dequeue (CVE-2024-46800
  bsc#1230827).
- commit c9f3783</changelog>
  <changelog author="tiwai@suse.de" date="1733572800">- drm/v3d: Enable Performance Counters before clearing them
  (git-fixes).
- drm/sti: Add __iomem for mixer_dbg_mxn's parameter (git-fixes).
- dma-fence: Use kernel's sort for merging fences (git-fixes).
- dma-fence: Fix reference leak on fence merge failure path
  (git-fixes).
- ASoC: mediatek: mt8188-mt6359: Remove hardcoded dmic codec
  (git-fixes).
- ASoC: SOF: ipc3-topology: fix resource leaks in
  sof_ipc3_widget_setup_comp_dai() (git-fixes).
- ALSA: usb-audio: Fix a DMA to stack memory bug (git-fixes).
- regmap: detach regmap from dev on regmap_exit (git-fixes).
- spi: mpc52xx: Add cancel_work_sync before module remove
  (git-fixes).
- mmc: core: Further prevent card detect during shutdown
  (git-fixes).
- commit 87e627e</changelog>
  <changelog author="tiwai@suse.de" date="1733572801">- ASoC: Intel: avs: da7219: Remove suspend_pre() and resume_post()
  (stable-fixes).
- ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360
  (NP730QFG) (stable-fixes).
- ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook
  430 G8 (stable-fixes).
- ALSA: usb-audio: add mixer mapping for Corsair HS80
  (stable-fixes).
- ALSA: hda/conexant: fix Z60MR100 startup pop issue
  (stable-fixes).
- commit 8c25a0a</changelog>
</package>
<package pkgid="7c55fc02d2368886405b03bd3f69d4fa21b675aecceb0ac2ef46bdd50c1c88d6" name="cluster-md-kmp-rt" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.10.5.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
  <changelog author="pmladek@suse.com" date="1723204800">- blacklist.conf: printk/sysctl: breaks kernel without pre-requisite
  patches (bsc#1229025)
- Delete
  patches.suse/printk-Remove-the-now-superfluous-sentinel-elements-from-ctl_table-array.patch.
- commit db77a25</changelog>
</package>
<package pkgid="189925fe76eec27dfc7b2006f0adfc6a6af99ec6d1029930f855c0d67c168664" name="cluster-md-kmp-rt" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.10.8.3"/>
  <changelog author="lhenriques@suse.de" date="1725019200">- virtiofs: forbid newlines in tags (bsc#1229940).
- commit 61514ce</changelog>
  <changelog author="lhenriques@suse.de" date="1725019201">- blacklist.conf: add 053fc4f755ad fuse: fix UAF in rcu pathwalks
  This commit breaks kABI and the data structure has no free room for the
  extra field, i.e. memcpy would fail to copy the additional member added by
  this patch.
- commit 941b81c</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019202">- iommufd/device: Fix hwpt at err_unresv in
  iommufd_device_do_replace() (git-fixes).
- commit bbc9a65</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019203">- iommu/vt-d: Fix identity map bounds in si_domain_init()
  (git-fixes).
- commit b4d27e5</changelog>
  <changelog author="lduncan@suse.com" date="1725019204">- scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315
  CVE-2024-43821).
- commit eb73e94</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019205">- iommu/amd: Convert comma to semicolon (git-fixes).
- commit 2714d8b</changelog>
  <changelog author="mkoutny@suse.com" date="1725019206">- Update
  patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch
  (git-fixes CVE-2024-35902 bsc#1224496).
- Update
  patches.suse/ASoC-TAS2781-Fix-tasdev_load_calibrated_data.patch
  (git-fixes CVE-2024-42278 bsc#1229403).
- Update
  patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch
  (git-fixes CVE-2024-43818 bsc#1229296).
- Update
  patches.suse/ASoC-fsl-fsl_qmc_audio-Check-devm_kasprintf-returned.patch
  (git-fixes CVE-2024-42298 bsc#1229369).
- Update
  patches.suse/Bluetooth-MGMT-Add-error-handling-to-pair_device.patch
  (git-fixes CVE-2024-43884 bsc#1229739).
- Update
  patches.suse/KVM-Always-flush-async-PF-workqueue-when-vCPU-is-bei.patch
  (git-fixes CVE-2024-26976 bsc#1223635).
- Update
  patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch
  (git-fixes CVE-2024-42302 bsc#1229366).
- Update
  patches.suse/PCI-endpoint-Clean-up-error-handling-in-vpci_scan_bu.patch
  (git-fixes CVE-2024-43875 bsc#1229486).
- Update
  patches.suse/PCI-endpoint-pci-epf-test-Make-use-of-cached-epc_fea.patch
  (git-fixes CVE-2024-43824 bsc#1229320).
- Update
  patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch
  (git-fixes CVE-2024-43823 bsc#1229303).
- Update
  patches.suse/PCI-rcar-Demote-WARN-to-dev_warn_ratelimited-in-rcar.patch
  (git-fixes CVE-2024-43876 bsc#1229485).
- Update
  patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch
  (git-fixes CVE-2024-43872 bsc#1229489).
- Update
  patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch
  (git-fixes CVE-2024-42285 bsc#1229381).
- Update
  patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch
  (bsc#1208783 CVE-2024-42274 bsc#1229417).
- Update
  patches.suse/SUNRPC-add-a-missing-rpc_stat-for-TCP-TLS.patch
  (git-fixes CVE-2024-36907 bsc#1225751).
- Update
  patches.suse/bpf-arm64-Fix-trampoline-for-BPF_TRAMP_F_CALL_ORIG.patch
  (git-fixes CVE-2024-43840 bsc#1229344).
- Update
  patches.suse/btrfs-fix-double-inode-unlock-for-direct-IO-sync-wri.patch
  (git-fixes CVE-2024-43885 bsc#1229747).
- Update
  patches.suse/btrfs-fix-extent-map-use-after-free-when-adding-page.patch
  (git-fixes CVE-2024-42314 bsc#1229355).
- Update
  patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch
  (bsc#1228801 CVE-2024-43853 bsc#1229292).
- Update
  patches.suse/crypto-ccp-Fix-null-pointer-dereference-in-__sev_snp.patch
  (git-fixes CVE-2024-43874 bsc#1229487).
- Update
  patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch
  (git-fixes CVE-2024-43871 bsc#1229490).
- Update
  patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch
  (git-fixes CVE-2024-43856 bsc#1229346).
- Update
  patches.suse/drm-admgpu-fix-dereferencing-null-pointer-context.patch
  (stable-fixes CVE-2024-43906 bsc#1229785).
- Update
  patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch
  (stable-fixes CVE-2024-43903 bsc#1229781).
- Update
  patches.suse/drm-amd-display-Add-null-checker-before-passing-vari.patch
  (stable-fixes CVE-2024-43902 bsc#1229767).
- Update
  patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch
  (stable-fixes CVE-2024-43895 bsc#1229755).
- Update
  patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch
  (stable-fixes CVE-2024-43905 bsc#1229784).
- Update
  patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch
  (stable-fixes CVE-2024-43908 bsc#1229788).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch
  (stable-fixes CVE-2024-43909 bsc#1229789).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch
  (stable-fixes CVE-2024-43907 bsc#1229787).
- Update
  patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch
  (git-fixes CVE-2024-43894 bsc#1229746).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch
  (git-fixes CVE-2024-42310 bsc#1229358).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch
  (git-fixes CVE-2024-42309 bsc#1229359).
- Update
  patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch
  (git-fixes CVE-2024-43867 bsc#1229493).
- Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch
  (git-fixes CVE-2024-43829 bsc#1229341).
- Update
  patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch
  (git-fixes CVE-2024-43863 bsc#1229497).
- Update
  patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch
  (git-fixes CVE-2024-42315 bsc#1229354).
- Update
  patches.suse/gpio-prevent-potential-speculation-leaks-in-gpio_dev.patch
  (stable-fixes CVE-2024-44931 bsc#1229837).
- Update
  patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch
  (git-fixes CVE-2024-42311 bsc#1229413).
- Update
  patches.suse/iio-Fix-the-sorting-functionality-in-iio_gts_build_a.patch
  (git-fixes CVE-2024-43825 bsc#1229298).
- Update
  patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch
  (git-fixes CVE-2024-43858 bsc#1229414).
- Update
  patches.suse/jfs-Fix-shift-out-of-bounds-in-dbDiscardAG.patch
  (git-fixes CVE-2024-44938 bsc#1229792).
- Update
  patches.suse/jfs-fix-null-ptr-deref-in-dtInsertEntry.patch
  (git-fixes CVE-2024-44939 bsc#1229820).
- Update
  patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch
  (git-fixes CVE-2024-42292 bsc#1229373).
- Update
  patches.suse/kvm-s390-Reject-memory-region-operations-for-ucontrol-VMs.patch
  (git-fixes bsc#1229168 CVE-2024-43819 bsc#1229290).
- Update
  patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch
  (git-fixes CVE-2024-43830 bsc#1229305).
- Update
  patches.suse/lib-objagg-Fix-general-protection-fault.patch
  (git-fixes CVE-2024-43846 bsc#1229360).
- Update
  patches.suse/libbpf-Use-OPTS_SET-macro-in-bpf_xdp_query.patch
  (git-fixes CVE-2024-27050 bsc#1223767).
- Update
  patches.suse/mISDN-Fix-a-use-after-free-in-hfcmulti_tx.patch
  (git-fixes CVE-2024-42280 bsc#1229388).
- Update
  patches.suse/mailbox-mtk-cmdq-Move-devm_mbox_controller_register-.patch
  (git-fixes CVE-2024-42319 bsc#1229350).
- Update
  patches.suse/md-raid5-fix-deadlock-that-raid5d-wait-for-itself-to-clear-MD_SB_CHANGE_PENDING-151f.patch
  (git-fixes CVE-2024-39476 bsc#1227437).
- Update
  patches.suse/media-imx-pxp-Fix-ERR_PTR-dereference-in-pxp_probe.patch
  (git-fixes CVE-2024-42303 bsc#1229365).
- Update
  patches.suse/media-pci-ivtv-Add-check-for-DMA-map-result.patch
  (git-fixes CVE-2024-43877 bsc#1229484).
- Update
  patches.suse/media-v4l-async-Fix-NULL-pointer-dereference-in-addi.patch
  (git-fixes CVE-2024-43833 bsc#1229299).
- Update
  patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch
  (git-fixes CVE-2024-42313 bsc#1229356).
- Update
  patches.suse/media-xc2028-avoid-use-after-free-in-load_firmware_c.patch
  (stable-fixes CVE-2024-43900 bsc#1229756).
- Update
  patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch
  (git-fixes CVE-2024-43892 bsc#1229761).
- Update
  patches.suse/net-drop-bad-gso-csum_start-and-offset-in-virtio_net.patch
  (git-fixes CVE-2024-43897 bsc#1229752).
- Update
  patches.suse/net-iucv-fix-use-after-free-in-iucv_sock_close.patch
  (bsc#1228973 CVE-2024-42271 bsc#1229400).
- Update patches.suse/net-missing-check-virtio.patch (git-fixes
  CVE-2024-43817 bsc#1229312).
- Update
  patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch
  (git-fixes CVE-2024-43861 bsc#1229500).
- Update
  patches.suse/nfs-pass-explicit-offset-count-to-trace-events.patch
  (git-fixes CVE-2024-43826 bsc#1229294).
- Update
  patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch
  (git-fixes CVE-2024-42276 bsc#1229410).
- Update
  patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch
  (git-fixes CVE-2024-43889 bsc#1229743).
- Update
  patches.suse/remoteproc-imx_rproc-Skip-over-memory-region-when-no.patch
  (git-fixes CVE-2024-43860 bsc#1229319).
- Update
  patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch
  (git-fixes bsc#1229173 CVE-2024-42320 bsc#1229349).
- Update
  patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch
  (bsc#1228857 CVE-2024-43816 bsc#1229318).
- Update
  patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch
  (bsc#1228850 CVE-2024-42287 bsc#1229392).
- Update
  patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch
  (bsc#1228850 CVE-2024-42289 bsc#1229399).
- Update
  patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch
  (bsc#1228850 CVE-2024-42288 bsc#1229398).
- Update
  patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch
  (bsc#1228850 CVE-2024-42286 bsc#1229395).
- Update
  patches.suse/serial-core-check-uartclk-for-zero-to-avoid-divide-b.patch
  (stable-fixes CVE-2024-43893 bsc#1229759).
- Update
  patches.suse/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch
  (git-fixes CVE-2024-43849 bsc#1229307).
- Update
  patches.suse/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch
  (git-fixes CVE-2024-43851 bsc#1229313).
- Update
  patches.suse/spi-microchip-core-ensure-TX-and-RX-FIFOs-are-empty-.patch
  (git-fixes CVE-2024-42279 bsc#1229390).
- Update
  patches.suse/usb-vhci-hcd-Do-not-drop-references-before-new-refer.patch
  (stable-fixes CVE-2024-43883 bsc#1229707).
- Update
  patches.suse/vhost-vsock-always-initialize-seqpacket_allow.patch
  (git-fixes CVE-2024-43873 bsc#1229488).
- Update
  patches.suse/wifi-ath12k-change-DMA-direction-while-mapping-reinj.patch
  (git-fixes CVE-2024-43881 bsc#1229480).
- Update
  patches.suse/wifi-ath12k-fix-invalid-memory-access-while-processi.patch
  (git-fixes CVE-2024-43847 bsc#1229291).
- Update
  patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch
  (git-fixes CVE-2024-43879 bsc#1229482).
- Update
  patches.suse/wifi-nl80211-disallow-setting-special-AP-channel-wid.patch
  (stable-fixes CVE-2024-43912 bsc#1229830).
- Update
  patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch
  (git-fixes CVE-2024-43842 bsc#1229317).
- Update
  patches.suse/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch
  (git-fixes CVE-2024-43841 bsc#1229304).
- commit 140ec33</changelog>
  <changelog author="tiwai@suse.de" date="1725105600">- dmaengine: dw: Add memory bus width verification (git-fixes).
- dmaengine: dw: Add peripheral bus width verification
  (git-fixes).
- soundwire: stream: fix programming slave ports for non-continous
  port maps (git-fixes).
- commit b7e9784</changelog>
  <changelog author="tiwai@suse.de" date="1725192000">- usb: cdnsp: fix for Link TRB with TC (git-fixes).
- usb: dwc3: st: add missing depopulate in probe error path
  (git-fixes).
- usb: dwc3: st: fix probed platform device ref count on probe
  error path (git-fixes).
- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
  remove_power_attributes() (git-fixes).
- usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).
- usb: dwc3: omap: add missing depopulate in probe error path
  (git-fixes).
- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
  (git-fixes).
- soc: qcom: pmic_glink: Actually communicate when remote goes
  down (git-fixes).
- soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).
- commit 7121142</changelog>
  <changelog author="ailiop@suse.com" date="1725192001">- xfs: Fix the owner setting issue for rmap query in xfs fsmap
  (git-fixes).
- commit 49b5eec</changelog>
  <changelog author="ailiop@suse.com" date="1725192002">- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code
  (git-fixes).
- commit 288ad9b</changelog>
  <changelog author="ailiop@suse.com" date="1725192003">- xfs: Fix missing interval for missing_owner in xfs fsmap
  (git-fixes).
- commit 5448ab5</changelog>
  <changelog author="ohering@suse.de" date="1725278400">- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).
- commit 4dc1da1</changelog>
  <changelog author="osalvador@suse.de" date="1725278401">- mm/sparsemem: fix race in accessing memory_section-&gt;usage
  (bsc#1221326 CVE-2023-52489).
- commit 6aa8957</changelog>
  <changelog author="osalvador@suse.de" date="1725278402">- mm, kmsan: fix infinite recursion due to RCU critical section
  (git-fixes).
- commit 16ad73a</changelog>
  <changelog author="osalvador@suse.de" date="1725278403">- mm: prevent derefencing NULL ptr in pfn_section_valid()
  (git-fixes).
- commit 35f619d</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278404">- bluetooth/l2cap: sync sock recv cb and release (bsc#1228576
  CVE-2024-41062).
- commit 6553526</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278405">- Bluetooth: L2CAP: Fix deadlock (git-fixes).
- commit 13aba13</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278406">- Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).
- commit 1bec58d</changelog>
  <changelog author="lhenriques@suse.de" date="1725278407">- ceph: periodically flush the cap releases (bsc#1230056).
- commit e22b6e0</changelog>
</package>
<package pkgid="8016cb3a0416afeae90716beaeea9cfc847bec22f2e56d714b47ecf5f9a8cdee" name="cmake3" arch="aarch64">
  <version epoch="0" ver="3.20.0" rel="150200.6.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- cmake 3.15.3:
  * CrayPrgEnv compiler wrapper support updated for 19.06
- includes changes from 3.15.2:
  * Fix CMAKE_FIND_PACKAGE_PREFER_CONFIG variable causing the
    find_package() command to fail on a missing package even
    without the REQUIRED option</changelog>
  <changelog author="sflees@suse.de" date="1572177600">- cmake 3.15.4
  * In CMake 3.15.0 through 3.15.3, the EXCLUDE_FROM_ALL directory
    property was regressed from pre-3.14 behavior and caused targets
    within the directory to be excluded even from its own “all”.
    This has been fixed. The bug also existed in 3.14.0 through
    3.14.6 and is fixed in 3.14.7.
- Use pkgconfig for dependencies where possible (required due to
  tumbleweed build changes)</changelog>
  <changelog author="tchvatal@suse.com" date="1572609600">- Update cmake conditionals to make sure the multibuild is
  nicely leveraged</changelog>
  <changelog author="simonf.lees@suse.com" date="1572955200">- Drop debug patch (never in factory) and update patch numbers</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573387200">- cmake 3.15.5:
  * no changelog available</changelog>
  <changelog author="mpluskal@suse.com" date="1573646400">- Switch back to libcurl-mini-devel to avoid new build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1574769600">- update to CMake 3.16
  Changelog see https://blog.kitware.com/cmake-3-16-0-available-for-download/
- drop patch form.patch, fixed upstream</changelog>
  <changelog author="sflees@suse.de" date="1574856000">- Fix numbering of patches.</changelog>
  <changelog author="foss@grueninger.de" date="1576843200">- update to CMAke 3.16.2
  * FindBLAS: Consider OpenBLAS with thread libraries only with C or CXX
  * FindBoost: Add support for Boost 1.72
  * FindLAPACK: Fix support for LAPACK symbols inside BLAS libraries
  Full changelog see https://blog.kitware.com/cmake-3-16-2-available-for-download/</changelog>
  <changelog author="asn@cryptomilk.org" date="1579003200">- Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
- Do NOT set -DCMAKE_SKIP_RPATH:BOOL=OFF
  * A lot of applications have private libraries in a subdirectory
    and require linking with RPATH which is totally valid.</changelog>
  <changelog author="junghans@votca.org" date="1579003201">- use cmake generics in marcos.cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1580904000">- Add new -mini flavor in order to break up cycles
  * make sure the default cmake links now all system libraries
    and mini uses bundled stuff as needed
- Switch to python3 variant of Sphinx on the manpage/docu creation</changelog>
  <changelog author="sflees@suse.de" date="1581076800">- Revert "use cmake generics in marcos.cmake" it breaks many
  cases in stagings.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1581336000">- Revert LIBDIR change in macros - it is inconsistent (all other
  INSTALL_&lt;dir&gt;s use absolute paths), unneeded (paths may be
  absolute or relative), and breaks a number of packages.
- Update minimum libarchive version, &gt;= 3.3.3.
- Do not flag macros as config file.
- Adjust constraints (7G disk space is required, independent
  of architecture).</changelog>
  <changelog author="dimstar@opensuse.org" date="1582113600">- Change cmake to be a meta-package that requires
  cmake-implementation. This new symbol is provided by the (newly
  named) cmake-full package as well as cmake-mini.
- This is needed as the original attempt of using Substitute in OBS
  actually rewrites the used spec files on disk, not only on the
  fly and we ended up with packages Requiring cmake-mini (which is
  not installable on end user systems).</changelog>
  <changelog author="foss@grueninger.de" date="1584878400">- update to 3.17.0
  * cmake(1) gained a “Ninja Multi-Config” generator, which
    can be used to build multiple configurations at once.
  * cmake(1) gained a “–debug-find” command-line option to
    enable additional human-readable output on where find
    commands search.
  * Target link properties are now transitive over
    private dependencies on static libraries. See policy “CMP0099”.
  * cmake(1) gained a “-E rm” command-line tool that can
    be used to remove directories and files.
  Full changelog see
  https://blog.kitware.com/cmake-3-17-0-available-for-download/</changelog>
  <changelog author="sflees@suse.de" date="1584964800">- Many Leap packages don't build without -DCMAKE_SKIP_RPATH:BOOL=ON
  so leave this change to the next major version of Leap / SLE</changelog>
  <changelog author="sflees@suse.de" date="1585224000">- Fix mistake in previous change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628251200">- copypac from SLE-15, because of Firefox91 (bsc#1188891)
  (Dependency chain: cmake3 -&gt; Rust -&gt; Firefox)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718366400">- Needed for Firefox 128 (bsc#1226316)
  (Dependency chain: cmake3 -&gt; Rust1.78 -&gt; Firefox)
- Update to 3.20.0
  * The “cmake_path()” command was added for operations on
    filesystem paths.
  * The “target_sources()” command now supports targets created
    by the “add_custom_target()” command.
  * The “ExternalProject” module “ExternalProject_Add()” function
    gained a “CONFIGURE_HANDLED_BY_BUILD” option.
  * “ctest(1)” gained a “–test-dir” option to specify the directory
    in which to look for tests.
- update to 3.19.7:
  * With :ref:`Visual Studio Generators` for VS 2017 and higher, the
    :variable:`CMAKE_GENERATOR_TOOLSET` field ``version=`` now accepts
    three-component MSVC toolset versions such as ``14.28.29910``.
    See the :variable:`CMAKE_VS_PLATFORM_TOOLSET_VERSION` variable.
- cmake 3.19.6:
  * The cmake-presets(7) feature no longer allows comments in
    CMakePresets.json or CMakeUserPresets.json files. This was
    mistakenly allowed by the implementation in 3.19.0 to 3.19.5
- Update to CMake 3.19.5
  * FindBoost: Add support for Boost 1.75
  * FindCUDAToolkit: Restore use of CUDA_PATH environment variable
- A quick note that tumbleweed isn't affeted by bsc#1181680 which
  is being fixed for SLE.
- cmake 3.19.4:
  * fixes for other platforms
- cmake 3.19.3:
  * FetchContent: Relative SOURCE_DIR override cannot be a hard error
  * FindMPI: remove single quotes from include path
  * FindHDF5: Fix finding both debug and release libs
  * cmake-gui: Restore linking of Qt resources
  * cmMakefile: Don't expand bracket arguments in --trace-expand
- update to 3.19.2:
  * various Apple-Silicon support fixes
  * The CMAKE_ISPC_HEADER_SUFFIX variable and corresponding ISPC_HEADER_SUFFIX
  target property were added to control the header suffix used by ISPC
  compiler generated headers.
- remove 5556.patch (upstream)
- Add 5556.patch: export: Do not fail generation for separate
  namelink only case. Fixes regression, blocking other packages
  from build,
- cmake 3.19.1:
  * avoid breaking projects relying on using the LANGUAGE property
    to cause the specified language's compiler to be used
  * CUDA 11.1 support for Clang.
- cmake 3.19.0:
  * cmake(1) and cmake-gui(1) now recognize CMakePresets.json and
    CMakeUserPresets.json files
  * support for ISPC
  * exctend CUDA language support for Clang
  * extend cmake-file-ap "codemodel"
  * cli --install supports --default-directory-permissions
  * cli supports creating hardlinks
  * CMake GUI now has an environment variable editor
  * Multiple cmake commands support new options and subcommands
  * Multiple variables added or functionalities extended
  * Multiple new modules and added functionality to existing modules
  * Compatibility with versions of CMake older than 2.8.12 is now
    deprecated and will be removed from a future version. Calls to
    cmake_minimum_required() or cmake_policy() that set the policy
    version to an older value now issue a deprecation diagnostic.
  * cmake-gui now requires Qt5
- cmake 3.18.4:
  * no upstream changelog
- update to 3.18.3:
  * The Compile Features functionality was updated for MSVC 19.28
- reapply this change (bsc#1174581):
  * Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
  see also
  https://gitlab.kitware.com/cmake/cmake/-/issues/20250
  https://github.com/arvidn/libtorrent/issues/5125#issuecomment-691559244
- update to 3.18.2:
  * The default value of :variable:`CMAKE_AUTOMOC_PATH_PREFIX` was changed to
  ``OFF`` because this feature can break existing projects that have
  identically named header files in different include directories.
  This restores compatibility with behavior of CMake 3.15 and below.
  * The :manual:`Compile Features &lt;cmake-compile-features(7)&gt;` functionality
  was updated for MSVC 19.27 as mentioned above.
- cmake 3.18.1:
  * Revert undocumented fix in 3.18.0 in the add_test() command
    for special characters to avoid breaking existing projects that
    worked around the issue. Will be reintroduced later
- drop no-system-nghttp2.patch, upstream
- Install the rpm provides handler to the correct location
  (%{_rpmconfigdir, not %{_libexecdir}).
- update to cmake 3.18.0
  * The “CUDA” language can now be compiled using Clang on non-Windows platforms.
  * “cmake(1)” gained support for profiling of CMake scripts
  * The “cmake_language()” command was added for meta-operations on
    scripted or built-in commands, starting with a mode to “CALL” other
    commands, and “EVAL CODE” to inplace evaluate a CMake script.
  * The “find_program()”, “find_library()”, “find_path()” and
    “find_file()” commands gained a new “REQUIRED” option that will stop
    processing with an error message if nothing is found.
  * The “CheckLinkerFlag” module has been added to provide a facility to
    check validity of link flags.
  * “ccmake(1)” learned to read a “CCMAKE_COLORS” environment variable
    to customize colors.
- Drop patch lua54.patch, it became part of upstream
- Udjust patch cmake-fix-ruby-test.patch
- Add patch no-system-nghttp2.patch which will become part of 3.18.1
  to disable nghttp2 from system for cmake-mini
- Add lua54.patch which adds 5.4 among allowed versions of
  Lua interpreter.
  (https://gitlab.kitware.com/cmake/cmake/-/issues/20933)
- Use plain autosetup
- DCMAKE_MODULES_INSTALL_DIR should be %{_libdir}/cmake/%{name}
- Set CMAKE_INSTALL_LIBEXECDIR=%{_libexecdir}
- Use -DCMAKE_SKIP_INSTALL_RPATHS:BOOL=ON instead of completely
  removing rpaths. boo#1172331
- cmake 3.17.3:
  * Selection of the Objective C or C++ compiler now considers the
    CC or CXX environment variable if the OBJC or OBJCXX
    environment variable is not set
  * The FindPkgConfig module now extracts include directories
    prefixed with -isystem into the *_INCLUDE_DIRS variables and
    INTERFACE_INCLUDE_DIRECTORIES target properties
  * FindOpenSSL: Detect OpenSSL 3.0.0 (bsc#1172267)
- cmake 3.17.2:
  * fixes dealing with boost 1.73
- Add cmake-fix-png-include-dir.patch to fix the png include dir
  search.
- cmake 3.17.1:
  * The :cpack_gen:`CPack NSIS Generator` now requires NSIS 3.0 or later</changelog>
</package>
<package pkgid="5549202c1405da3b11970b468b4816bcdfc30288dabcb6f627f45fcc532818e4" name="cmake3" arch="ppc64le">
  <version epoch="0" ver="3.20.0" rel="150200.6.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- cmake 3.15.3:
  * CrayPrgEnv compiler wrapper support updated for 19.06
- includes changes from 3.15.2:
  * Fix CMAKE_FIND_PACKAGE_PREFER_CONFIG variable causing the
    find_package() command to fail on a missing package even
    without the REQUIRED option</changelog>
  <changelog author="sflees@suse.de" date="1572177600">- cmake 3.15.4
  * In CMake 3.15.0 through 3.15.3, the EXCLUDE_FROM_ALL directory
    property was regressed from pre-3.14 behavior and caused targets
    within the directory to be excluded even from its own “all”.
    This has been fixed. The bug also existed in 3.14.0 through
    3.14.6 and is fixed in 3.14.7.
- Use pkgconfig for dependencies where possible (required due to
  tumbleweed build changes)</changelog>
  <changelog author="tchvatal@suse.com" date="1572609600">- Update cmake conditionals to make sure the multibuild is
  nicely leveraged</changelog>
  <changelog author="simonf.lees@suse.com" date="1572955200">- Drop debug patch (never in factory) and update patch numbers</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573387200">- cmake 3.15.5:
  * no changelog available</changelog>
  <changelog author="mpluskal@suse.com" date="1573646400">- Switch back to libcurl-mini-devel to avoid new build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1574769600">- update to CMake 3.16
  Changelog see https://blog.kitware.com/cmake-3-16-0-available-for-download/
- drop patch form.patch, fixed upstream</changelog>
  <changelog author="sflees@suse.de" date="1574856000">- Fix numbering of patches.</changelog>
  <changelog author="foss@grueninger.de" date="1576843200">- update to CMAke 3.16.2
  * FindBLAS: Consider OpenBLAS with thread libraries only with C or CXX
  * FindBoost: Add support for Boost 1.72
  * FindLAPACK: Fix support for LAPACK symbols inside BLAS libraries
  Full changelog see https://blog.kitware.com/cmake-3-16-2-available-for-download/</changelog>
  <changelog author="asn@cryptomilk.org" date="1579003200">- Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
- Do NOT set -DCMAKE_SKIP_RPATH:BOOL=OFF
  * A lot of applications have private libraries in a subdirectory
    and require linking with RPATH which is totally valid.</changelog>
  <changelog author="junghans@votca.org" date="1579003201">- use cmake generics in marcos.cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1580904000">- Add new -mini flavor in order to break up cycles
  * make sure the default cmake links now all system libraries
    and mini uses bundled stuff as needed
- Switch to python3 variant of Sphinx on the manpage/docu creation</changelog>
  <changelog author="sflees@suse.de" date="1581076800">- Revert "use cmake generics in marcos.cmake" it breaks many
  cases in stagings.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1581336000">- Revert LIBDIR change in macros - it is inconsistent (all other
  INSTALL_&lt;dir&gt;s use absolute paths), unneeded (paths may be
  absolute or relative), and breaks a number of packages.
- Update minimum libarchive version, &gt;= 3.3.3.
- Do not flag macros as config file.
- Adjust constraints (7G disk space is required, independent
  of architecture).</changelog>
  <changelog author="dimstar@opensuse.org" date="1582113600">- Change cmake to be a meta-package that requires
  cmake-implementation. This new symbol is provided by the (newly
  named) cmake-full package as well as cmake-mini.
- This is needed as the original attempt of using Substitute in OBS
  actually rewrites the used spec files on disk, not only on the
  fly and we ended up with packages Requiring cmake-mini (which is
  not installable on end user systems).</changelog>
  <changelog author="foss@grueninger.de" date="1584878400">- update to 3.17.0
  * cmake(1) gained a “Ninja Multi-Config” generator, which
    can be used to build multiple configurations at once.
  * cmake(1) gained a “–debug-find” command-line option to
    enable additional human-readable output on where find
    commands search.
  * Target link properties are now transitive over
    private dependencies on static libraries. See policy “CMP0099”.
  * cmake(1) gained a “-E rm” command-line tool that can
    be used to remove directories and files.
  Full changelog see
  https://blog.kitware.com/cmake-3-17-0-available-for-download/</changelog>
  <changelog author="sflees@suse.de" date="1584964800">- Many Leap packages don't build without -DCMAKE_SKIP_RPATH:BOOL=ON
  so leave this change to the next major version of Leap / SLE</changelog>
  <changelog author="sflees@suse.de" date="1585224000">- Fix mistake in previous change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628251200">- copypac from SLE-15, because of Firefox91 (bsc#1188891)
  (Dependency chain: cmake3 -&gt; Rust -&gt; Firefox)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718366400">- Needed for Firefox 128 (bsc#1226316)
  (Dependency chain: cmake3 -&gt; Rust1.78 -&gt; Firefox)
- Update to 3.20.0
  * The “cmake_path()” command was added for operations on
    filesystem paths.
  * The “target_sources()” command now supports targets created
    by the “add_custom_target()” command.
  * The “ExternalProject” module “ExternalProject_Add()” function
    gained a “CONFIGURE_HANDLED_BY_BUILD” option.
  * “ctest(1)” gained a “–test-dir” option to specify the directory
    in which to look for tests.
- update to 3.19.7:
  * With :ref:`Visual Studio Generators` for VS 2017 and higher, the
    :variable:`CMAKE_GENERATOR_TOOLSET` field ``version=`` now accepts
    three-component MSVC toolset versions such as ``14.28.29910``.
    See the :variable:`CMAKE_VS_PLATFORM_TOOLSET_VERSION` variable.
- cmake 3.19.6:
  * The cmake-presets(7) feature no longer allows comments in
    CMakePresets.json or CMakeUserPresets.json files. This was
    mistakenly allowed by the implementation in 3.19.0 to 3.19.5
- Update to CMake 3.19.5
  * FindBoost: Add support for Boost 1.75
  * FindCUDAToolkit: Restore use of CUDA_PATH environment variable
- A quick note that tumbleweed isn't affeted by bsc#1181680 which
  is being fixed for SLE.
- cmake 3.19.4:
  * fixes for other platforms
- cmake 3.19.3:
  * FetchContent: Relative SOURCE_DIR override cannot be a hard error
  * FindMPI: remove single quotes from include path
  * FindHDF5: Fix finding both debug and release libs
  * cmake-gui: Restore linking of Qt resources
  * cmMakefile: Don't expand bracket arguments in --trace-expand
- update to 3.19.2:
  * various Apple-Silicon support fixes
  * The CMAKE_ISPC_HEADER_SUFFIX variable and corresponding ISPC_HEADER_SUFFIX
  target property were added to control the header suffix used by ISPC
  compiler generated headers.
- remove 5556.patch (upstream)
- Add 5556.patch: export: Do not fail generation for separate
  namelink only case. Fixes regression, blocking other packages
  from build,
- cmake 3.19.1:
  * avoid breaking projects relying on using the LANGUAGE property
    to cause the specified language's compiler to be used
  * CUDA 11.1 support for Clang.
- cmake 3.19.0:
  * cmake(1) and cmake-gui(1) now recognize CMakePresets.json and
    CMakeUserPresets.json files
  * support for ISPC
  * exctend CUDA language support for Clang
  * extend cmake-file-ap "codemodel"
  * cli --install supports --default-directory-permissions
  * cli supports creating hardlinks
  * CMake GUI now has an environment variable editor
  * Multiple cmake commands support new options and subcommands
  * Multiple variables added or functionalities extended
  * Multiple new modules and added functionality to existing modules
  * Compatibility with versions of CMake older than 2.8.12 is now
    deprecated and will be removed from a future version. Calls to
    cmake_minimum_required() or cmake_policy() that set the policy
    version to an older value now issue a deprecation diagnostic.
  * cmake-gui now requires Qt5
- cmake 3.18.4:
  * no upstream changelog
- update to 3.18.3:
  * The Compile Features functionality was updated for MSVC 19.28
- reapply this change (bsc#1174581):
  * Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
  see also
  https://gitlab.kitware.com/cmake/cmake/-/issues/20250
  https://github.com/arvidn/libtorrent/issues/5125#issuecomment-691559244
- update to 3.18.2:
  * The default value of :variable:`CMAKE_AUTOMOC_PATH_PREFIX` was changed to
  ``OFF`` because this feature can break existing projects that have
  identically named header files in different include directories.
  This restores compatibility with behavior of CMake 3.15 and below.
  * The :manual:`Compile Features &lt;cmake-compile-features(7)&gt;` functionality
  was updated for MSVC 19.27 as mentioned above.
- cmake 3.18.1:
  * Revert undocumented fix in 3.18.0 in the add_test() command
    for special characters to avoid breaking existing projects that
    worked around the issue. Will be reintroduced later
- drop no-system-nghttp2.patch, upstream
- Install the rpm provides handler to the correct location
  (%{_rpmconfigdir, not %{_libexecdir}).
- update to cmake 3.18.0
  * The “CUDA” language can now be compiled using Clang on non-Windows platforms.
  * “cmake(1)” gained support for profiling of CMake scripts
  * The “cmake_language()” command was added for meta-operations on
    scripted or built-in commands, starting with a mode to “CALL” other
    commands, and “EVAL CODE” to inplace evaluate a CMake script.
  * The “find_program()”, “find_library()”, “find_path()” and
    “find_file()” commands gained a new “REQUIRED” option that will stop
    processing with an error message if nothing is found.
  * The “CheckLinkerFlag” module has been added to provide a facility to
    check validity of link flags.
  * “ccmake(1)” learned to read a “CCMAKE_COLORS” environment variable
    to customize colors.
- Drop patch lua54.patch, it became part of upstream
- Udjust patch cmake-fix-ruby-test.patch
- Add patch no-system-nghttp2.patch which will become part of 3.18.1
  to disable nghttp2 from system for cmake-mini
- Add lua54.patch which adds 5.4 among allowed versions of
  Lua interpreter.
  (https://gitlab.kitware.com/cmake/cmake/-/issues/20933)
- Use plain autosetup
- DCMAKE_MODULES_INSTALL_DIR should be %{_libdir}/cmake/%{name}
- Set CMAKE_INSTALL_LIBEXECDIR=%{_libexecdir}
- Use -DCMAKE_SKIP_INSTALL_RPATHS:BOOL=ON instead of completely
  removing rpaths. boo#1172331
- cmake 3.17.3:
  * Selection of the Objective C or C++ compiler now considers the
    CC or CXX environment variable if the OBJC or OBJCXX
    environment variable is not set
  * The FindPkgConfig module now extracts include directories
    prefixed with -isystem into the *_INCLUDE_DIRS variables and
    INTERFACE_INCLUDE_DIRECTORIES target properties
  * FindOpenSSL: Detect OpenSSL 3.0.0 (bsc#1172267)
- cmake 3.17.2:
  * fixes dealing with boost 1.73
- Add cmake-fix-png-include-dir.patch to fix the png include dir
  search.
- cmake 3.17.1:
  * The :cpack_gen:`CPack NSIS Generator` now requires NSIS 3.0 or later</changelog>
</package>
<package pkgid="b935562a32f7ec771106e660449ab0c46f9e31c8a5e55d15bf09a3d898d9f68b" name="cmake3" arch="s390x">
  <version epoch="0" ver="3.20.0" rel="150200.6.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- cmake 3.15.3:
  * CrayPrgEnv compiler wrapper support updated for 19.06
- includes changes from 3.15.2:
  * Fix CMAKE_FIND_PACKAGE_PREFER_CONFIG variable causing the
    find_package() command to fail on a missing package even
    without the REQUIRED option</changelog>
  <changelog author="sflees@suse.de" date="1572177600">- cmake 3.15.4
  * In CMake 3.15.0 through 3.15.3, the EXCLUDE_FROM_ALL directory
    property was regressed from pre-3.14 behavior and caused targets
    within the directory to be excluded even from its own “all”.
    This has been fixed. The bug also existed in 3.14.0 through
    3.14.6 and is fixed in 3.14.7.
- Use pkgconfig for dependencies where possible (required due to
  tumbleweed build changes)</changelog>
  <changelog author="tchvatal@suse.com" date="1572609600">- Update cmake conditionals to make sure the multibuild is
  nicely leveraged</changelog>
  <changelog author="simonf.lees@suse.com" date="1572955200">- Drop debug patch (never in factory) and update patch numbers</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573387200">- cmake 3.15.5:
  * no changelog available</changelog>
  <changelog author="mpluskal@suse.com" date="1573646400">- Switch back to libcurl-mini-devel to avoid new build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1574769600">- update to CMake 3.16
  Changelog see https://blog.kitware.com/cmake-3-16-0-available-for-download/
- drop patch form.patch, fixed upstream</changelog>
  <changelog author="sflees@suse.de" date="1574856000">- Fix numbering of patches.</changelog>
  <changelog author="foss@grueninger.de" date="1576843200">- update to CMAke 3.16.2
  * FindBLAS: Consider OpenBLAS with thread libraries only with C or CXX
  * FindBoost: Add support for Boost 1.72
  * FindLAPACK: Fix support for LAPACK symbols inside BLAS libraries
  Full changelog see https://blog.kitware.com/cmake-3-16-2-available-for-download/</changelog>
  <changelog author="asn@cryptomilk.org" date="1579003200">- Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
- Do NOT set -DCMAKE_SKIP_RPATH:BOOL=OFF
  * A lot of applications have private libraries in a subdirectory
    and require linking with RPATH which is totally valid.</changelog>
  <changelog author="junghans@votca.org" date="1579003201">- use cmake generics in marcos.cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1580904000">- Add new -mini flavor in order to break up cycles
  * make sure the default cmake links now all system libraries
    and mini uses bundled stuff as needed
- Switch to python3 variant of Sphinx on the manpage/docu creation</changelog>
  <changelog author="sflees@suse.de" date="1581076800">- Revert "use cmake generics in marcos.cmake" it breaks many
  cases in stagings.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1581336000">- Revert LIBDIR change in macros - it is inconsistent (all other
  INSTALL_&lt;dir&gt;s use absolute paths), unneeded (paths may be
  absolute or relative), and breaks a number of packages.
- Update minimum libarchive version, &gt;= 3.3.3.
- Do not flag macros as config file.
- Adjust constraints (7G disk space is required, independent
  of architecture).</changelog>
  <changelog author="dimstar@opensuse.org" date="1582113600">- Change cmake to be a meta-package that requires
  cmake-implementation. This new symbol is provided by the (newly
  named) cmake-full package as well as cmake-mini.
- This is needed as the original attempt of using Substitute in OBS
  actually rewrites the used spec files on disk, not only on the
  fly and we ended up with packages Requiring cmake-mini (which is
  not installable on end user systems).</changelog>
  <changelog author="foss@grueninger.de" date="1584878400">- update to 3.17.0
  * cmake(1) gained a “Ninja Multi-Config” generator, which
    can be used to build multiple configurations at once.
  * cmake(1) gained a “–debug-find” command-line option to
    enable additional human-readable output on where find
    commands search.
  * Target link properties are now transitive over
    private dependencies on static libraries. See policy “CMP0099”.
  * cmake(1) gained a “-E rm” command-line tool that can
    be used to remove directories and files.
  Full changelog see
  https://blog.kitware.com/cmake-3-17-0-available-for-download/</changelog>
  <changelog author="sflees@suse.de" date="1584964800">- Many Leap packages don't build without -DCMAKE_SKIP_RPATH:BOOL=ON
  so leave this change to the next major version of Leap / SLE</changelog>
  <changelog author="sflees@suse.de" date="1585224000">- Fix mistake in previous change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628251200">- copypac from SLE-15, because of Firefox91 (bsc#1188891)
  (Dependency chain: cmake3 -&gt; Rust -&gt; Firefox)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718366400">- Needed for Firefox 128 (bsc#1226316)
  (Dependency chain: cmake3 -&gt; Rust1.78 -&gt; Firefox)
- Update to 3.20.0
  * The “cmake_path()” command was added for operations on
    filesystem paths.
  * The “target_sources()” command now supports targets created
    by the “add_custom_target()” command.
  * The “ExternalProject” module “ExternalProject_Add()” function
    gained a “CONFIGURE_HANDLED_BY_BUILD” option.
  * “ctest(1)” gained a “–test-dir” option to specify the directory
    in which to look for tests.
- update to 3.19.7:
  * With :ref:`Visual Studio Generators` for VS 2017 and higher, the
    :variable:`CMAKE_GENERATOR_TOOLSET` field ``version=`` now accepts
    three-component MSVC toolset versions such as ``14.28.29910``.
    See the :variable:`CMAKE_VS_PLATFORM_TOOLSET_VERSION` variable.
- cmake 3.19.6:
  * The cmake-presets(7) feature no longer allows comments in
    CMakePresets.json or CMakeUserPresets.json files. This was
    mistakenly allowed by the implementation in 3.19.0 to 3.19.5
- Update to CMake 3.19.5
  * FindBoost: Add support for Boost 1.75
  * FindCUDAToolkit: Restore use of CUDA_PATH environment variable
- A quick note that tumbleweed isn't affeted by bsc#1181680 which
  is being fixed for SLE.
- cmake 3.19.4:
  * fixes for other platforms
- cmake 3.19.3:
  * FetchContent: Relative SOURCE_DIR override cannot be a hard error
  * FindMPI: remove single quotes from include path
  * FindHDF5: Fix finding both debug and release libs
  * cmake-gui: Restore linking of Qt resources
  * cmMakefile: Don't expand bracket arguments in --trace-expand
- update to 3.19.2:
  * various Apple-Silicon support fixes
  * The CMAKE_ISPC_HEADER_SUFFIX variable and corresponding ISPC_HEADER_SUFFIX
  target property were added to control the header suffix used by ISPC
  compiler generated headers.
- remove 5556.patch (upstream)
- Add 5556.patch: export: Do not fail generation for separate
  namelink only case. Fixes regression, blocking other packages
  from build,
- cmake 3.19.1:
  * avoid breaking projects relying on using the LANGUAGE property
    to cause the specified language's compiler to be used
  * CUDA 11.1 support for Clang.
- cmake 3.19.0:
  * cmake(1) and cmake-gui(1) now recognize CMakePresets.json and
    CMakeUserPresets.json files
  * support for ISPC
  * exctend CUDA language support for Clang
  * extend cmake-file-ap "codemodel"
  * cli --install supports --default-directory-permissions
  * cli supports creating hardlinks
  * CMake GUI now has an environment variable editor
  * Multiple cmake commands support new options and subcommands
  * Multiple variables added or functionalities extended
  * Multiple new modules and added functionality to existing modules
  * Compatibility with versions of CMake older than 2.8.12 is now
    deprecated and will be removed from a future version. Calls to
    cmake_minimum_required() or cmake_policy() that set the policy
    version to an older value now issue a deprecation diagnostic.
  * cmake-gui now requires Qt5
- cmake 3.18.4:
  * no upstream changelog
- update to 3.18.3:
  * The Compile Features functionality was updated for MSVC 19.28
- reapply this change (bsc#1174581):
  * Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
  see also
  https://gitlab.kitware.com/cmake/cmake/-/issues/20250
  https://github.com/arvidn/libtorrent/issues/5125#issuecomment-691559244
- update to 3.18.2:
  * The default value of :variable:`CMAKE_AUTOMOC_PATH_PREFIX` was changed to
  ``OFF`` because this feature can break existing projects that have
  identically named header files in different include directories.
  This restores compatibility with behavior of CMake 3.15 and below.
  * The :manual:`Compile Features &lt;cmake-compile-features(7)&gt;` functionality
  was updated for MSVC 19.27 as mentioned above.
- cmake 3.18.1:
  * Revert undocumented fix in 3.18.0 in the add_test() command
    for special characters to avoid breaking existing projects that
    worked around the issue. Will be reintroduced later
- drop no-system-nghttp2.patch, upstream
- Install the rpm provides handler to the correct location
  (%{_rpmconfigdir, not %{_libexecdir}).
- update to cmake 3.18.0
  * The “CUDA” language can now be compiled using Clang on non-Windows platforms.
  * “cmake(1)” gained support for profiling of CMake scripts
  * The “cmake_language()” command was added for meta-operations on
    scripted or built-in commands, starting with a mode to “CALL” other
    commands, and “EVAL CODE” to inplace evaluate a CMake script.
  * The “find_program()”, “find_library()”, “find_path()” and
    “find_file()” commands gained a new “REQUIRED” option that will stop
    processing with an error message if nothing is found.
  * The “CheckLinkerFlag” module has been added to provide a facility to
    check validity of link flags.
  * “ccmake(1)” learned to read a “CCMAKE_COLORS” environment variable
    to customize colors.
- Drop patch lua54.patch, it became part of upstream
- Udjust patch cmake-fix-ruby-test.patch
- Add patch no-system-nghttp2.patch which will become part of 3.18.1
  to disable nghttp2 from system for cmake-mini
- Add lua54.patch which adds 5.4 among allowed versions of
  Lua interpreter.
  (https://gitlab.kitware.com/cmake/cmake/-/issues/20933)
- Use plain autosetup
- DCMAKE_MODULES_INSTALL_DIR should be %{_libdir}/cmake/%{name}
- Set CMAKE_INSTALL_LIBEXECDIR=%{_libexecdir}
- Use -DCMAKE_SKIP_INSTALL_RPATHS:BOOL=ON instead of completely
  removing rpaths. boo#1172331
- cmake 3.17.3:
  * Selection of the Objective C or C++ compiler now considers the
    CC or CXX environment variable if the OBJC or OBJCXX
    environment variable is not set
  * The FindPkgConfig module now extracts include directories
    prefixed with -isystem into the *_INCLUDE_DIRS variables and
    INTERFACE_INCLUDE_DIRECTORIES target properties
  * FindOpenSSL: Detect OpenSSL 3.0.0 (bsc#1172267)
- cmake 3.17.2:
  * fixes dealing with boost 1.73
- Add cmake-fix-png-include-dir.patch to fix the png include dir
  search.
- cmake 3.17.1:
  * The :cpack_gen:`CPack NSIS Generator` now requires NSIS 3.0 or later</changelog>
</package>
<package pkgid="0c715b5a0f3c81798ced257a2bf89b7b9a0a39c1f53af40f11d0e118953e4107" name="cmake3" arch="src">
  <version epoch="0" ver="3.20.0" rel="150200.6.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- cmake 3.15.3:
  * CrayPrgEnv compiler wrapper support updated for 19.06
- includes changes from 3.15.2:
  * Fix CMAKE_FIND_PACKAGE_PREFER_CONFIG variable causing the
    find_package() command to fail on a missing package even
    without the REQUIRED option</changelog>
  <changelog author="sflees@suse.de" date="1572177600">- cmake 3.15.4
  * In CMake 3.15.0 through 3.15.3, the EXCLUDE_FROM_ALL directory
    property was regressed from pre-3.14 behavior and caused targets
    within the directory to be excluded even from its own “all”.
    This has been fixed. The bug also existed in 3.14.0 through
    3.14.6 and is fixed in 3.14.7.
- Use pkgconfig for dependencies where possible (required due to
  tumbleweed build changes)</changelog>
  <changelog author="tchvatal@suse.com" date="1572609600">- Update cmake conditionals to make sure the multibuild is
  nicely leveraged</changelog>
  <changelog author="simonf.lees@suse.com" date="1572955200">- Drop debug patch (never in factory) and update patch numbers</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573387200">- cmake 3.15.5:
  * no changelog available</changelog>
  <changelog author="mpluskal@suse.com" date="1573646400">- Switch back to libcurl-mini-devel to avoid new build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1574769600">- update to CMake 3.16
  Changelog see https://blog.kitware.com/cmake-3-16-0-available-for-download/
- drop patch form.patch, fixed upstream</changelog>
  <changelog author="sflees@suse.de" date="1574856000">- Fix numbering of patches.</changelog>
  <changelog author="foss@grueninger.de" date="1576843200">- update to CMAke 3.16.2
  * FindBLAS: Consider OpenBLAS with thread libraries only with C or CXX
  * FindBoost: Add support for Boost 1.72
  * FindLAPACK: Fix support for LAPACK symbols inside BLAS libraries
  Full changelog see https://blog.kitware.com/cmake-3-16-2-available-for-download/</changelog>
  <changelog author="asn@cryptomilk.org" date="1579003200">- Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
- Do NOT set -DCMAKE_SKIP_RPATH:BOOL=OFF
  * A lot of applications have private libraries in a subdirectory
    and require linking with RPATH which is totally valid.</changelog>
  <changelog author="junghans@votca.org" date="1579003201">- use cmake generics in marcos.cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1580904000">- Add new -mini flavor in order to break up cycles
  * make sure the default cmake links now all system libraries
    and mini uses bundled stuff as needed
- Switch to python3 variant of Sphinx on the manpage/docu creation</changelog>
  <changelog author="sflees@suse.de" date="1581076800">- Revert "use cmake generics in marcos.cmake" it breaks many
  cases in stagings.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1581336000">- Revert LIBDIR change in macros - it is inconsistent (all other
  INSTALL_&lt;dir&gt;s use absolute paths), unneeded (paths may be
  absolute or relative), and breaks a number of packages.
- Update minimum libarchive version, &gt;= 3.3.3.
- Do not flag macros as config file.
- Adjust constraints (7G disk space is required, independent
  of architecture).</changelog>
  <changelog author="dimstar@opensuse.org" date="1582113600">- Change cmake to be a meta-package that requires
  cmake-implementation. This new symbol is provided by the (newly
  named) cmake-full package as well as cmake-mini.
- This is needed as the original attempt of using Substitute in OBS
  actually rewrites the used spec files on disk, not only on the
  fly and we ended up with packages Requiring cmake-mini (which is
  not installable on end user systems).</changelog>
  <changelog author="foss@grueninger.de" date="1584878400">- update to 3.17.0
  * cmake(1) gained a “Ninja Multi-Config” generator, which
    can be used to build multiple configurations at once.
  * cmake(1) gained a “–debug-find” command-line option to
    enable additional human-readable output on where find
    commands search.
  * Target link properties are now transitive over
    private dependencies on static libraries. See policy “CMP0099”.
  * cmake(1) gained a “-E rm” command-line tool that can
    be used to remove directories and files.
  Full changelog see
  https://blog.kitware.com/cmake-3-17-0-available-for-download/</changelog>
  <changelog author="sflees@suse.de" date="1584964800">- Many Leap packages don't build without -DCMAKE_SKIP_RPATH:BOOL=ON
  so leave this change to the next major version of Leap / SLE</changelog>
  <changelog author="sflees@suse.de" date="1585224000">- Fix mistake in previous change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628251200">- copypac from SLE-15, because of Firefox91 (bsc#1188891)
  (Dependency chain: cmake3 -&gt; Rust -&gt; Firefox)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718366400">- Needed for Firefox 128 (bsc#1226316)
  (Dependency chain: cmake3 -&gt; Rust1.78 -&gt; Firefox)
- Update to 3.20.0
  * The “cmake_path()” command was added for operations on
    filesystem paths.
  * The “target_sources()” command now supports targets created
    by the “add_custom_target()” command.
  * The “ExternalProject” module “ExternalProject_Add()” function
    gained a “CONFIGURE_HANDLED_BY_BUILD” option.
  * “ctest(1)” gained a “–test-dir” option to specify the directory
    in which to look for tests.
- update to 3.19.7:
  * With :ref:`Visual Studio Generators` for VS 2017 and higher, the
    :variable:`CMAKE_GENERATOR_TOOLSET` field ``version=`` now accepts
    three-component MSVC toolset versions such as ``14.28.29910``.
    See the :variable:`CMAKE_VS_PLATFORM_TOOLSET_VERSION` variable.
- cmake 3.19.6:
  * The cmake-presets(7) feature no longer allows comments in
    CMakePresets.json or CMakeUserPresets.json files. This was
    mistakenly allowed by the implementation in 3.19.0 to 3.19.5
- Update to CMake 3.19.5
  * FindBoost: Add support for Boost 1.75
  * FindCUDAToolkit: Restore use of CUDA_PATH environment variable
- A quick note that tumbleweed isn't affeted by bsc#1181680 which
  is being fixed for SLE.
- cmake 3.19.4:
  * fixes for other platforms
- cmake 3.19.3:
  * FetchContent: Relative SOURCE_DIR override cannot be a hard error
  * FindMPI: remove single quotes from include path
  * FindHDF5: Fix finding both debug and release libs
  * cmake-gui: Restore linking of Qt resources
  * cmMakefile: Don't expand bracket arguments in --trace-expand
- update to 3.19.2:
  * various Apple-Silicon support fixes
  * The CMAKE_ISPC_HEADER_SUFFIX variable and corresponding ISPC_HEADER_SUFFIX
  target property were added to control the header suffix used by ISPC
  compiler generated headers.
- remove 5556.patch (upstream)
- Add 5556.patch: export: Do not fail generation for separate
  namelink only case. Fixes regression, blocking other packages
  from build,
- cmake 3.19.1:
  * avoid breaking projects relying on using the LANGUAGE property
    to cause the specified language's compiler to be used
  * CUDA 11.1 support for Clang.
- cmake 3.19.0:
  * cmake(1) and cmake-gui(1) now recognize CMakePresets.json and
    CMakeUserPresets.json files
  * support for ISPC
  * exctend CUDA language support for Clang
  * extend cmake-file-ap "codemodel"
  * cli --install supports --default-directory-permissions
  * cli supports creating hardlinks
  * CMake GUI now has an environment variable editor
  * Multiple cmake commands support new options and subcommands
  * Multiple variables added or functionalities extended
  * Multiple new modules and added functionality to existing modules
  * Compatibility with versions of CMake older than 2.8.12 is now
    deprecated and will be removed from a future version. Calls to
    cmake_minimum_required() or cmake_policy() that set the policy
    version to an older value now issue a deprecation diagnostic.
  * cmake-gui now requires Qt5
- cmake 3.18.4:
  * no upstream changelog
- update to 3.18.3:
  * The Compile Features functionality was updated for MSVC 19.28
- reapply this change (bsc#1174581):
  * Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
  see also
  https://gitlab.kitware.com/cmake/cmake/-/issues/20250
  https://github.com/arvidn/libtorrent/issues/5125#issuecomment-691559244
- update to 3.18.2:
  * The default value of :variable:`CMAKE_AUTOMOC_PATH_PREFIX` was changed to
  ``OFF`` because this feature can break existing projects that have
  identically named header files in different include directories.
  This restores compatibility with behavior of CMake 3.15 and below.
  * The :manual:`Compile Features &lt;cmake-compile-features(7)&gt;` functionality
  was updated for MSVC 19.27 as mentioned above.
- cmake 3.18.1:
  * Revert undocumented fix in 3.18.0 in the add_test() command
    for special characters to avoid breaking existing projects that
    worked around the issue. Will be reintroduced later
- drop no-system-nghttp2.patch, upstream
- Install the rpm provides handler to the correct location
  (%{_rpmconfigdir, not %{_libexecdir}).
- update to cmake 3.18.0
  * The “CUDA” language can now be compiled using Clang on non-Windows platforms.
  * “cmake(1)” gained support for profiling of CMake scripts
  * The “cmake_language()” command was added for meta-operations on
    scripted or built-in commands, starting with a mode to “CALL” other
    commands, and “EVAL CODE” to inplace evaluate a CMake script.
  * The “find_program()”, “find_library()”, “find_path()” and
    “find_file()” commands gained a new “REQUIRED” option that will stop
    processing with an error message if nothing is found.
  * The “CheckLinkerFlag” module has been added to provide a facility to
    check validity of link flags.
  * “ccmake(1)” learned to read a “CCMAKE_COLORS” environment variable
    to customize colors.
- Drop patch lua54.patch, it became part of upstream
- Udjust patch cmake-fix-ruby-test.patch
- Add patch no-system-nghttp2.patch which will become part of 3.18.1
  to disable nghttp2 from system for cmake-mini
- Add lua54.patch which adds 5.4 among allowed versions of
  Lua interpreter.
  (https://gitlab.kitware.com/cmake/cmake/-/issues/20933)
- Use plain autosetup
- DCMAKE_MODULES_INSTALL_DIR should be %{_libdir}/cmake/%{name}
- Set CMAKE_INSTALL_LIBEXECDIR=%{_libexecdir}
- Use -DCMAKE_SKIP_INSTALL_RPATHS:BOOL=ON instead of completely
  removing rpaths. boo#1172331
- cmake 3.17.3:
  * Selection of the Objective C or C++ compiler now considers the
    CC or CXX environment variable if the OBJC or OBJCXX
    environment variable is not set
  * The FindPkgConfig module now extracts include directories
    prefixed with -isystem into the *_INCLUDE_DIRS variables and
    INTERFACE_INCLUDE_DIRECTORIES target properties
  * FindOpenSSL: Detect OpenSSL 3.0.0 (bsc#1172267)
- cmake 3.17.2:
  * fixes dealing with boost 1.73
- Add cmake-fix-png-include-dir.patch to fix the png include dir
  search.
- cmake 3.17.1:
  * The :cpack_gen:`CPack NSIS Generator` now requires NSIS 3.0 or later</changelog>
</package>
<package pkgid="930d5d446c50ed4e4c213be46951eb1ef569ffb150ef7351d711d2220c137d3d" name="cmake3" arch="x86_64">
  <version epoch="0" ver="3.20.0" rel="150200.6.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- cmake 3.15.3:
  * CrayPrgEnv compiler wrapper support updated for 19.06
- includes changes from 3.15.2:
  * Fix CMAKE_FIND_PACKAGE_PREFER_CONFIG variable causing the
    find_package() command to fail on a missing package even
    without the REQUIRED option</changelog>
  <changelog author="sflees@suse.de" date="1572177600">- cmake 3.15.4
  * In CMake 3.15.0 through 3.15.3, the EXCLUDE_FROM_ALL directory
    property was regressed from pre-3.14 behavior and caused targets
    within the directory to be excluded even from its own “all”.
    This has been fixed. The bug also existed in 3.14.0 through
    3.14.6 and is fixed in 3.14.7.
- Use pkgconfig for dependencies where possible (required due to
  tumbleweed build changes)</changelog>
  <changelog author="tchvatal@suse.com" date="1572609600">- Update cmake conditionals to make sure the multibuild is
  nicely leveraged</changelog>
  <changelog author="simonf.lees@suse.com" date="1572955200">- Drop debug patch (never in factory) and update patch numbers</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573387200">- cmake 3.15.5:
  * no changelog available</changelog>
  <changelog author="mpluskal@suse.com" date="1573646400">- Switch back to libcurl-mini-devel to avoid new build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1574769600">- update to CMake 3.16
  Changelog see https://blog.kitware.com/cmake-3-16-0-available-for-download/
- drop patch form.patch, fixed upstream</changelog>
  <changelog author="sflees@suse.de" date="1574856000">- Fix numbering of patches.</changelog>
  <changelog author="foss@grueninger.de" date="1576843200">- update to CMAke 3.16.2
  * FindBLAS: Consider OpenBLAS with thread libraries only with C or CXX
  * FindBoost: Add support for Boost 1.72
  * FindLAPACK: Fix support for LAPACK symbols inside BLAS libraries
  Full changelog see https://blog.kitware.com/cmake-3-16-2-available-for-download/</changelog>
  <changelog author="asn@cryptomilk.org" date="1579003200">- Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
- Do NOT set -DCMAKE_SKIP_RPATH:BOOL=OFF
  * A lot of applications have private libraries in a subdirectory
    and require linking with RPATH which is totally valid.</changelog>
  <changelog author="junghans@votca.org" date="1579003201">- use cmake generics in marcos.cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1580904000">- Add new -mini flavor in order to break up cycles
  * make sure the default cmake links now all system libraries
    and mini uses bundled stuff as needed
- Switch to python3 variant of Sphinx on the manpage/docu creation</changelog>
  <changelog author="sflees@suse.de" date="1581076800">- Revert "use cmake generics in marcos.cmake" it breaks many
  cases in stagings.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1581336000">- Revert LIBDIR change in macros - it is inconsistent (all other
  INSTALL_&lt;dir&gt;s use absolute paths), unneeded (paths may be
  absolute or relative), and breaks a number of packages.
- Update minimum libarchive version, &gt;= 3.3.3.
- Do not flag macros as config file.
- Adjust constraints (7G disk space is required, independent
  of architecture).</changelog>
  <changelog author="dimstar@opensuse.org" date="1582113600">- Change cmake to be a meta-package that requires
  cmake-implementation. This new symbol is provided by the (newly
  named) cmake-full package as well as cmake-mini.
- This is needed as the original attempt of using Substitute in OBS
  actually rewrites the used spec files on disk, not only on the
  fly and we ended up with packages Requiring cmake-mini (which is
  not installable on end user systems).</changelog>
  <changelog author="foss@grueninger.de" date="1584878400">- update to 3.17.0
  * cmake(1) gained a “Ninja Multi-Config” generator, which
    can be used to build multiple configurations at once.
  * cmake(1) gained a “–debug-find” command-line option to
    enable additional human-readable output on where find
    commands search.
  * Target link properties are now transitive over
    private dependencies on static libraries. See policy “CMP0099”.
  * cmake(1) gained a “-E rm” command-line tool that can
    be used to remove directories and files.
  Full changelog see
  https://blog.kitware.com/cmake-3-17-0-available-for-download/</changelog>
  <changelog author="sflees@suse.de" date="1584964800">- Many Leap packages don't build without -DCMAKE_SKIP_RPATH:BOOL=ON
  so leave this change to the next major version of Leap / SLE</changelog>
  <changelog author="sflees@suse.de" date="1585224000">- Fix mistake in previous change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628251200">- copypac from SLE-15, because of Firefox91 (bsc#1188891)
  (Dependency chain: cmake3 -&gt; Rust -&gt; Firefox)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718366400">- Needed for Firefox 128 (bsc#1226316)
  (Dependency chain: cmake3 -&gt; Rust1.78 -&gt; Firefox)
- Update to 3.20.0
  * The “cmake_path()” command was added for operations on
    filesystem paths.
  * The “target_sources()” command now supports targets created
    by the “add_custom_target()” command.
  * The “ExternalProject” module “ExternalProject_Add()” function
    gained a “CONFIGURE_HANDLED_BY_BUILD” option.
  * “ctest(1)” gained a “–test-dir” option to specify the directory
    in which to look for tests.
- update to 3.19.7:
  * With :ref:`Visual Studio Generators` for VS 2017 and higher, the
    :variable:`CMAKE_GENERATOR_TOOLSET` field ``version=`` now accepts
    three-component MSVC toolset versions such as ``14.28.29910``.
    See the :variable:`CMAKE_VS_PLATFORM_TOOLSET_VERSION` variable.
- cmake 3.19.6:
  * The cmake-presets(7) feature no longer allows comments in
    CMakePresets.json or CMakeUserPresets.json files. This was
    mistakenly allowed by the implementation in 3.19.0 to 3.19.5
- Update to CMake 3.19.5
  * FindBoost: Add support for Boost 1.75
  * FindCUDAToolkit: Restore use of CUDA_PATH environment variable
- A quick note that tumbleweed isn't affeted by bsc#1181680 which
  is being fixed for SLE.
- cmake 3.19.4:
  * fixes for other platforms
- cmake 3.19.3:
  * FetchContent: Relative SOURCE_DIR override cannot be a hard error
  * FindMPI: remove single quotes from include path
  * FindHDF5: Fix finding both debug and release libs
  * cmake-gui: Restore linking of Qt resources
  * cmMakefile: Don't expand bracket arguments in --trace-expand
- update to 3.19.2:
  * various Apple-Silicon support fixes
  * The CMAKE_ISPC_HEADER_SUFFIX variable and corresponding ISPC_HEADER_SUFFIX
  target property were added to control the header suffix used by ISPC
  compiler generated headers.
- remove 5556.patch (upstream)
- Add 5556.patch: export: Do not fail generation for separate
  namelink only case. Fixes regression, blocking other packages
  from build,
- cmake 3.19.1:
  * avoid breaking projects relying on using the LANGUAGE property
    to cause the specified language's compiler to be used
  * CUDA 11.1 support for Clang.
- cmake 3.19.0:
  * cmake(1) and cmake-gui(1) now recognize CMakePresets.json and
    CMakeUserPresets.json files
  * support for ISPC
  * exctend CUDA language support for Clang
  * extend cmake-file-ap "codemodel"
  * cli --install supports --default-directory-permissions
  * cli supports creating hardlinks
  * CMake GUI now has an environment variable editor
  * Multiple cmake commands support new options and subcommands
  * Multiple variables added or functionalities extended
  * Multiple new modules and added functionality to existing modules
  * Compatibility with versions of CMake older than 2.8.12 is now
    deprecated and will be removed from a future version. Calls to
    cmake_minimum_required() or cmake_policy() that set the policy
    version to an older value now issue a deprecation diagnostic.
  * cmake-gui now requires Qt5
- cmake 3.18.4:
  * no upstream changelog
- update to 3.18.3:
  * The Compile Features functionality was updated for MSVC 19.28
- reapply this change (bsc#1174581):
  * Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
  see also
  https://gitlab.kitware.com/cmake/cmake/-/issues/20250
  https://github.com/arvidn/libtorrent/issues/5125#issuecomment-691559244
- update to 3.18.2:
  * The default value of :variable:`CMAKE_AUTOMOC_PATH_PREFIX` was changed to
  ``OFF`` because this feature can break existing projects that have
  identically named header files in different include directories.
  This restores compatibility with behavior of CMake 3.15 and below.
  * The :manual:`Compile Features &lt;cmake-compile-features(7)&gt;` functionality
  was updated for MSVC 19.27 as mentioned above.
- cmake 3.18.1:
  * Revert undocumented fix in 3.18.0 in the add_test() command
    for special characters to avoid breaking existing projects that
    worked around the issue. Will be reintroduced later
- drop no-system-nghttp2.patch, upstream
- Install the rpm provides handler to the correct location
  (%{_rpmconfigdir, not %{_libexecdir}).
- update to cmake 3.18.0
  * The “CUDA” language can now be compiled using Clang on non-Windows platforms.
  * “cmake(1)” gained support for profiling of CMake scripts
  * The “cmake_language()” command was added for meta-operations on
    scripted or built-in commands, starting with a mode to “CALL” other
    commands, and “EVAL CODE” to inplace evaluate a CMake script.
  * The “find_program()”, “find_library()”, “find_path()” and
    “find_file()” commands gained a new “REQUIRED” option that will stop
    processing with an error message if nothing is found.
  * The “CheckLinkerFlag” module has been added to provide a facility to
    check validity of link flags.
  * “ccmake(1)” learned to read a “CCMAKE_COLORS” environment variable
    to customize colors.
- Drop patch lua54.patch, it became part of upstream
- Udjust patch cmake-fix-ruby-test.patch
- Add patch no-system-nghttp2.patch which will become part of 3.18.1
  to disable nghttp2 from system for cmake-mini
- Add lua54.patch which adds 5.4 among allowed versions of
  Lua interpreter.
  (https://gitlab.kitware.com/cmake/cmake/-/issues/20933)
- Use plain autosetup
- DCMAKE_MODULES_INSTALL_DIR should be %{_libdir}/cmake/%{name}
- Set CMAKE_INSTALL_LIBEXECDIR=%{_libexecdir}
- Use -DCMAKE_SKIP_INSTALL_RPATHS:BOOL=ON instead of completely
  removing rpaths. boo#1172331
- cmake 3.17.3:
  * Selection of the Objective C or C++ compiler now considers the
    CC or CXX environment variable if the OBJC or OBJCXX
    environment variable is not set
  * The FindPkgConfig module now extracts include directories
    prefixed with -isystem into the *_INCLUDE_DIRS variables and
    INTERFACE_INCLUDE_DIRECTORIES target properties
  * FindOpenSSL: Detect OpenSSL 3.0.0 (bsc#1172267)
- cmake 3.17.2:
  * fixes dealing with boost 1.73
- Add cmake-fix-png-include-dir.patch to fix the png include dir
  search.
- cmake 3.17.1:
  * The :cpack_gen:`CPack NSIS Generator` now requires NSIS 3.0 or later</changelog>
</package>
<package pkgid="3d0ba1c1265b4769b22524184147475e7a95f6544b0c295be89b4154f3286e80" name="cmake3-full" arch="aarch64">
  <version epoch="0" ver="3.20.0" rel="150200.6.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- cmake 3.15.3:
  * CrayPrgEnv compiler wrapper support updated for 19.06
- includes changes from 3.15.2:
  * Fix CMAKE_FIND_PACKAGE_PREFER_CONFIG variable causing the
    find_package() command to fail on a missing package even
    without the REQUIRED option</changelog>
  <changelog author="sflees@suse.de" date="1572177600">- cmake 3.15.4
  * In CMake 3.15.0 through 3.15.3, the EXCLUDE_FROM_ALL directory
    property was regressed from pre-3.14 behavior and caused targets
    within the directory to be excluded even from its own “all”.
    This has been fixed. The bug also existed in 3.14.0 through
    3.14.6 and is fixed in 3.14.7.
- Use pkgconfig for dependencies where possible (required due to
  tumbleweed build changes)</changelog>
  <changelog author="tchvatal@suse.com" date="1572609600">- Update cmake conditionals to make sure the multibuild is
  nicely leveraged</changelog>
  <changelog author="simonf.lees@suse.com" date="1572955200">- Drop debug patch (never in factory) and update patch numbers</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573387200">- cmake 3.15.5:
  * no changelog available</changelog>
  <changelog author="mpluskal@suse.com" date="1573646400">- Switch back to libcurl-mini-devel to avoid new build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1574769600">- update to CMake 3.16
  Changelog see https://blog.kitware.com/cmake-3-16-0-available-for-download/
- drop patch form.patch, fixed upstream</changelog>
  <changelog author="sflees@suse.de" date="1574856000">- Fix numbering of patches.</changelog>
  <changelog author="foss@grueninger.de" date="1576843200">- update to CMAke 3.16.2
  * FindBLAS: Consider OpenBLAS with thread libraries only with C or CXX
  * FindBoost: Add support for Boost 1.72
  * FindLAPACK: Fix support for LAPACK symbols inside BLAS libraries
  Full changelog see https://blog.kitware.com/cmake-3-16-2-available-for-download/</changelog>
  <changelog author="asn@cryptomilk.org" date="1579003200">- Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
- Do NOT set -DCMAKE_SKIP_RPATH:BOOL=OFF
  * A lot of applications have private libraries in a subdirectory
    and require linking with RPATH which is totally valid.</changelog>
  <changelog author="junghans@votca.org" date="1579003201">- use cmake generics in marcos.cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1580904000">- Add new -mini flavor in order to break up cycles
  * make sure the default cmake links now all system libraries
    and mini uses bundled stuff as needed
- Switch to python3 variant of Sphinx on the manpage/docu creation</changelog>
  <changelog author="sflees@suse.de" date="1581076800">- Revert "use cmake generics in marcos.cmake" it breaks many
  cases in stagings.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1581336000">- Revert LIBDIR change in macros - it is inconsistent (all other
  INSTALL_&lt;dir&gt;s use absolute paths), unneeded (paths may be
  absolute or relative), and breaks a number of packages.
- Update minimum libarchive version, &gt;= 3.3.3.
- Do not flag macros as config file.
- Adjust constraints (7G disk space is required, independent
  of architecture).</changelog>
  <changelog author="dimstar@opensuse.org" date="1582113600">- Change cmake to be a meta-package that requires
  cmake-implementation. This new symbol is provided by the (newly
  named) cmake-full package as well as cmake-mini.
- This is needed as the original attempt of using Substitute in OBS
  actually rewrites the used spec files on disk, not only on the
  fly and we ended up with packages Requiring cmake-mini (which is
  not installable on end user systems).</changelog>
  <changelog author="foss@grueninger.de" date="1584878400">- update to 3.17.0
  * cmake(1) gained a “Ninja Multi-Config” generator, which
    can be used to build multiple configurations at once.
  * cmake(1) gained a “–debug-find” command-line option to
    enable additional human-readable output on where find
    commands search.
  * Target link properties are now transitive over
    private dependencies on static libraries. See policy “CMP0099”.
  * cmake(1) gained a “-E rm” command-line tool that can
    be used to remove directories and files.
  Full changelog see
  https://blog.kitware.com/cmake-3-17-0-available-for-download/</changelog>
  <changelog author="sflees@suse.de" date="1584964800">- Many Leap packages don't build without -DCMAKE_SKIP_RPATH:BOOL=ON
  so leave this change to the next major version of Leap / SLE</changelog>
  <changelog author="sflees@suse.de" date="1585224000">- Fix mistake in previous change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628251200">- copypac from SLE-15, because of Firefox91 (bsc#1188891)
  (Dependency chain: cmake3 -&gt; Rust -&gt; Firefox)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718366400">- Needed for Firefox 128 (bsc#1226316)
  (Dependency chain: cmake3 -&gt; Rust1.78 -&gt; Firefox)
- Update to 3.20.0
  * The “cmake_path()” command was added for operations on
    filesystem paths.
  * The “target_sources()” command now supports targets created
    by the “add_custom_target()” command.
  * The “ExternalProject” module “ExternalProject_Add()” function
    gained a “CONFIGURE_HANDLED_BY_BUILD” option.
  * “ctest(1)” gained a “–test-dir” option to specify the directory
    in which to look for tests.
- update to 3.19.7:
  * With :ref:`Visual Studio Generators` for VS 2017 and higher, the
    :variable:`CMAKE_GENERATOR_TOOLSET` field ``version=`` now accepts
    three-component MSVC toolset versions such as ``14.28.29910``.
    See the :variable:`CMAKE_VS_PLATFORM_TOOLSET_VERSION` variable.
- cmake 3.19.6:
  * The cmake-presets(7) feature no longer allows comments in
    CMakePresets.json or CMakeUserPresets.json files. This was
    mistakenly allowed by the implementation in 3.19.0 to 3.19.5
- Update to CMake 3.19.5
  * FindBoost: Add support for Boost 1.75
  * FindCUDAToolkit: Restore use of CUDA_PATH environment variable
- A quick note that tumbleweed isn't affeted by bsc#1181680 which
  is being fixed for SLE.
- cmake 3.19.4:
  * fixes for other platforms
- cmake 3.19.3:
  * FetchContent: Relative SOURCE_DIR override cannot be a hard error
  * FindMPI: remove single quotes from include path
  * FindHDF5: Fix finding both debug and release libs
  * cmake-gui: Restore linking of Qt resources
  * cmMakefile: Don't expand bracket arguments in --trace-expand
- update to 3.19.2:
  * various Apple-Silicon support fixes
  * The CMAKE_ISPC_HEADER_SUFFIX variable and corresponding ISPC_HEADER_SUFFIX
  target property were added to control the header suffix used by ISPC
  compiler generated headers.
- remove 5556.patch (upstream)
- Add 5556.patch: export: Do not fail generation for separate
  namelink only case. Fixes regression, blocking other packages
  from build,
- cmake 3.19.1:
  * avoid breaking projects relying on using the LANGUAGE property
    to cause the specified language's compiler to be used
  * CUDA 11.1 support for Clang.
- cmake 3.19.0:
  * cmake(1) and cmake-gui(1) now recognize CMakePresets.json and
    CMakeUserPresets.json files
  * support for ISPC
  * exctend CUDA language support for Clang
  * extend cmake-file-ap "codemodel"
  * cli --install supports --default-directory-permissions
  * cli supports creating hardlinks
  * CMake GUI now has an environment variable editor
  * Multiple cmake commands support new options and subcommands
  * Multiple variables added or functionalities extended
  * Multiple new modules and added functionality to existing modules
  * Compatibility with versions of CMake older than 2.8.12 is now
    deprecated and will be removed from a future version. Calls to
    cmake_minimum_required() or cmake_policy() that set the policy
    version to an older value now issue a deprecation diagnostic.
  * cmake-gui now requires Qt5
- cmake 3.18.4:
  * no upstream changelog
- update to 3.18.3:
  * The Compile Features functionality was updated for MSVC 19.28
- reapply this change (bsc#1174581):
  * Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
  see also
  https://gitlab.kitware.com/cmake/cmake/-/issues/20250
  https://github.com/arvidn/libtorrent/issues/5125#issuecomment-691559244
- update to 3.18.2:
  * The default value of :variable:`CMAKE_AUTOMOC_PATH_PREFIX` was changed to
  ``OFF`` because this feature can break existing projects that have
  identically named header files in different include directories.
  This restores compatibility with behavior of CMake 3.15 and below.
  * The :manual:`Compile Features &lt;cmake-compile-features(7)&gt;` functionality
  was updated for MSVC 19.27 as mentioned above.
- cmake 3.18.1:
  * Revert undocumented fix in 3.18.0 in the add_test() command
    for special characters to avoid breaking existing projects that
    worked around the issue. Will be reintroduced later
- drop no-system-nghttp2.patch, upstream
- Install the rpm provides handler to the correct location
  (%{_rpmconfigdir, not %{_libexecdir}).
- update to cmake 3.18.0
  * The “CUDA” language can now be compiled using Clang on non-Windows platforms.
  * “cmake(1)” gained support for profiling of CMake scripts
  * The “cmake_language()” command was added for meta-operations on
    scripted or built-in commands, starting with a mode to “CALL” other
    commands, and “EVAL CODE” to inplace evaluate a CMake script.
  * The “find_program()”, “find_library()”, “find_path()” and
    “find_file()” commands gained a new “REQUIRED” option that will stop
    processing with an error message if nothing is found.
  * The “CheckLinkerFlag” module has been added to provide a facility to
    check validity of link flags.
  * “ccmake(1)” learned to read a “CCMAKE_COLORS” environment variable
    to customize colors.
- Drop patch lua54.patch, it became part of upstream
- Udjust patch cmake-fix-ruby-test.patch
- Add patch no-system-nghttp2.patch which will become part of 3.18.1
  to disable nghttp2 from system for cmake-mini
- Add lua54.patch which adds 5.4 among allowed versions of
  Lua interpreter.
  (https://gitlab.kitware.com/cmake/cmake/-/issues/20933)
- Use plain autosetup
- DCMAKE_MODULES_INSTALL_DIR should be %{_libdir}/cmake/%{name}
- Set CMAKE_INSTALL_LIBEXECDIR=%{_libexecdir}
- Use -DCMAKE_SKIP_INSTALL_RPATHS:BOOL=ON instead of completely
  removing rpaths. boo#1172331
- cmake 3.17.3:
  * Selection of the Objective C or C++ compiler now considers the
    CC or CXX environment variable if the OBJC or OBJCXX
    environment variable is not set
  * The FindPkgConfig module now extracts include directories
    prefixed with -isystem into the *_INCLUDE_DIRS variables and
    INTERFACE_INCLUDE_DIRECTORIES target properties
  * FindOpenSSL: Detect OpenSSL 3.0.0 (bsc#1172267)
- cmake 3.17.2:
  * fixes dealing with boost 1.73
- Add cmake-fix-png-include-dir.patch to fix the png include dir
  search.
- cmake 3.17.1:
  * The :cpack_gen:`CPack NSIS Generator` now requires NSIS 3.0 or later</changelog>
</package>
<package pkgid="d110a1e0f8308ddb618a1c92e059e7a4d288628a3d94c6897b0d2df059dc46c1" name="cmake3-full" arch="ppc64le">
  <version epoch="0" ver="3.20.0" rel="150200.6.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- cmake 3.15.3:
  * CrayPrgEnv compiler wrapper support updated for 19.06
- includes changes from 3.15.2:
  * Fix CMAKE_FIND_PACKAGE_PREFER_CONFIG variable causing the
    find_package() command to fail on a missing package even
    without the REQUIRED option</changelog>
  <changelog author="sflees@suse.de" date="1572177600">- cmake 3.15.4
  * In CMake 3.15.0 through 3.15.3, the EXCLUDE_FROM_ALL directory
    property was regressed from pre-3.14 behavior and caused targets
    within the directory to be excluded even from its own “all”.
    This has been fixed. The bug also existed in 3.14.0 through
    3.14.6 and is fixed in 3.14.7.
- Use pkgconfig for dependencies where possible (required due to
  tumbleweed build changes)</changelog>
  <changelog author="tchvatal@suse.com" date="1572609600">- Update cmake conditionals to make sure the multibuild is
  nicely leveraged</changelog>
  <changelog author="simonf.lees@suse.com" date="1572955200">- Drop debug patch (never in factory) and update patch numbers</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573387200">- cmake 3.15.5:
  * no changelog available</changelog>
  <changelog author="mpluskal@suse.com" date="1573646400">- Switch back to libcurl-mini-devel to avoid new build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1574769600">- update to CMake 3.16
  Changelog see https://blog.kitware.com/cmake-3-16-0-available-for-download/
- drop patch form.patch, fixed upstream</changelog>
  <changelog author="sflees@suse.de" date="1574856000">- Fix numbering of patches.</changelog>
  <changelog author="foss@grueninger.de" date="1576843200">- update to CMAke 3.16.2
  * FindBLAS: Consider OpenBLAS with thread libraries only with C or CXX
  * FindBoost: Add support for Boost 1.72
  * FindLAPACK: Fix support for LAPACK symbols inside BLAS libraries
  Full changelog see https://blog.kitware.com/cmake-3-16-2-available-for-download/</changelog>
  <changelog author="asn@cryptomilk.org" date="1579003200">- Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
- Do NOT set -DCMAKE_SKIP_RPATH:BOOL=OFF
  * A lot of applications have private libraries in a subdirectory
    and require linking with RPATH which is totally valid.</changelog>
  <changelog author="junghans@votca.org" date="1579003201">- use cmake generics in marcos.cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1580904000">- Add new -mini flavor in order to break up cycles
  * make sure the default cmake links now all system libraries
    and mini uses bundled stuff as needed
- Switch to python3 variant of Sphinx on the manpage/docu creation</changelog>
  <changelog author="sflees@suse.de" date="1581076800">- Revert "use cmake generics in marcos.cmake" it breaks many
  cases in stagings.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1581336000">- Revert LIBDIR change in macros - it is inconsistent (all other
  INSTALL_&lt;dir&gt;s use absolute paths), unneeded (paths may be
  absolute or relative), and breaks a number of packages.
- Update minimum libarchive version, &gt;= 3.3.3.
- Do not flag macros as config file.
- Adjust constraints (7G disk space is required, independent
  of architecture).</changelog>
  <changelog author="dimstar@opensuse.org" date="1582113600">- Change cmake to be a meta-package that requires
  cmake-implementation. This new symbol is provided by the (newly
  named) cmake-full package as well as cmake-mini.
- This is needed as the original attempt of using Substitute in OBS
  actually rewrites the used spec files on disk, not only on the
  fly and we ended up with packages Requiring cmake-mini (which is
  not installable on end user systems).</changelog>
  <changelog author="foss@grueninger.de" date="1584878400">- update to 3.17.0
  * cmake(1) gained a “Ninja Multi-Config” generator, which
    can be used to build multiple configurations at once.
  * cmake(1) gained a “–debug-find” command-line option to
    enable additional human-readable output on where find
    commands search.
  * Target link properties are now transitive over
    private dependencies on static libraries. See policy “CMP0099”.
  * cmake(1) gained a “-E rm” command-line tool that can
    be used to remove directories and files.
  Full changelog see
  https://blog.kitware.com/cmake-3-17-0-available-for-download/</changelog>
  <changelog author="sflees@suse.de" date="1584964800">- Many Leap packages don't build without -DCMAKE_SKIP_RPATH:BOOL=ON
  so leave this change to the next major version of Leap / SLE</changelog>
  <changelog author="sflees@suse.de" date="1585224000">- Fix mistake in previous change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628251200">- copypac from SLE-15, because of Firefox91 (bsc#1188891)
  (Dependency chain: cmake3 -&gt; Rust -&gt; Firefox)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718366400">- Needed for Firefox 128 (bsc#1226316)
  (Dependency chain: cmake3 -&gt; Rust1.78 -&gt; Firefox)
- Update to 3.20.0
  * The “cmake_path()” command was added for operations on
    filesystem paths.
  * The “target_sources()” command now supports targets created
    by the “add_custom_target()” command.
  * The “ExternalProject” module “ExternalProject_Add()” function
    gained a “CONFIGURE_HANDLED_BY_BUILD” option.
  * “ctest(1)” gained a “–test-dir” option to specify the directory
    in which to look for tests.
- update to 3.19.7:
  * With :ref:`Visual Studio Generators` for VS 2017 and higher, the
    :variable:`CMAKE_GENERATOR_TOOLSET` field ``version=`` now accepts
    three-component MSVC toolset versions such as ``14.28.29910``.
    See the :variable:`CMAKE_VS_PLATFORM_TOOLSET_VERSION` variable.
- cmake 3.19.6:
  * The cmake-presets(7) feature no longer allows comments in
    CMakePresets.json or CMakeUserPresets.json files. This was
    mistakenly allowed by the implementation in 3.19.0 to 3.19.5
- Update to CMake 3.19.5
  * FindBoost: Add support for Boost 1.75
  * FindCUDAToolkit: Restore use of CUDA_PATH environment variable
- A quick note that tumbleweed isn't affeted by bsc#1181680 which
  is being fixed for SLE.
- cmake 3.19.4:
  * fixes for other platforms
- cmake 3.19.3:
  * FetchContent: Relative SOURCE_DIR override cannot be a hard error
  * FindMPI: remove single quotes from include path
  * FindHDF5: Fix finding both debug and release libs
  * cmake-gui: Restore linking of Qt resources
  * cmMakefile: Don't expand bracket arguments in --trace-expand
- update to 3.19.2:
  * various Apple-Silicon support fixes
  * The CMAKE_ISPC_HEADER_SUFFIX variable and corresponding ISPC_HEADER_SUFFIX
  target property were added to control the header suffix used by ISPC
  compiler generated headers.
- remove 5556.patch (upstream)
- Add 5556.patch: export: Do not fail generation for separate
  namelink only case. Fixes regression, blocking other packages
  from build,
- cmake 3.19.1:
  * avoid breaking projects relying on using the LANGUAGE property
    to cause the specified language's compiler to be used
  * CUDA 11.1 support for Clang.
- cmake 3.19.0:
  * cmake(1) and cmake-gui(1) now recognize CMakePresets.json and
    CMakeUserPresets.json files
  * support for ISPC
  * exctend CUDA language support for Clang
  * extend cmake-file-ap "codemodel"
  * cli --install supports --default-directory-permissions
  * cli supports creating hardlinks
  * CMake GUI now has an environment variable editor
  * Multiple cmake commands support new options and subcommands
  * Multiple variables added or functionalities extended
  * Multiple new modules and added functionality to existing modules
  * Compatibility with versions of CMake older than 2.8.12 is now
    deprecated and will be removed from a future version. Calls to
    cmake_minimum_required() or cmake_policy() that set the policy
    version to an older value now issue a deprecation diagnostic.
  * cmake-gui now requires Qt5
- cmake 3.18.4:
  * no upstream changelog
- update to 3.18.3:
  * The Compile Features functionality was updated for MSVC 19.28
- reapply this change (bsc#1174581):
  * Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
  see also
  https://gitlab.kitware.com/cmake/cmake/-/issues/20250
  https://github.com/arvidn/libtorrent/issues/5125#issuecomment-691559244
- update to 3.18.2:
  * The default value of :variable:`CMAKE_AUTOMOC_PATH_PREFIX` was changed to
  ``OFF`` because this feature can break existing projects that have
  identically named header files in different include directories.
  This restores compatibility with behavior of CMake 3.15 and below.
  * The :manual:`Compile Features &lt;cmake-compile-features(7)&gt;` functionality
  was updated for MSVC 19.27 as mentioned above.
- cmake 3.18.1:
  * Revert undocumented fix in 3.18.0 in the add_test() command
    for special characters to avoid breaking existing projects that
    worked around the issue. Will be reintroduced later
- drop no-system-nghttp2.patch, upstream
- Install the rpm provides handler to the correct location
  (%{_rpmconfigdir, not %{_libexecdir}).
- update to cmake 3.18.0
  * The “CUDA” language can now be compiled using Clang on non-Windows platforms.
  * “cmake(1)” gained support for profiling of CMake scripts
  * The “cmake_language()” command was added for meta-operations on
    scripted or built-in commands, starting with a mode to “CALL” other
    commands, and “EVAL CODE” to inplace evaluate a CMake script.
  * The “find_program()”, “find_library()”, “find_path()” and
    “find_file()” commands gained a new “REQUIRED” option that will stop
    processing with an error message if nothing is found.
  * The “CheckLinkerFlag” module has been added to provide a facility to
    check validity of link flags.
  * “ccmake(1)” learned to read a “CCMAKE_COLORS” environment variable
    to customize colors.
- Drop patch lua54.patch, it became part of upstream
- Udjust patch cmake-fix-ruby-test.patch
- Add patch no-system-nghttp2.patch which will become part of 3.18.1
  to disable nghttp2 from system for cmake-mini
- Add lua54.patch which adds 5.4 among allowed versions of
  Lua interpreter.
  (https://gitlab.kitware.com/cmake/cmake/-/issues/20933)
- Use plain autosetup
- DCMAKE_MODULES_INSTALL_DIR should be %{_libdir}/cmake/%{name}
- Set CMAKE_INSTALL_LIBEXECDIR=%{_libexecdir}
- Use -DCMAKE_SKIP_INSTALL_RPATHS:BOOL=ON instead of completely
  removing rpaths. boo#1172331
- cmake 3.17.3:
  * Selection of the Objective C or C++ compiler now considers the
    CC or CXX environment variable if the OBJC or OBJCXX
    environment variable is not set
  * The FindPkgConfig module now extracts include directories
    prefixed with -isystem into the *_INCLUDE_DIRS variables and
    INTERFACE_INCLUDE_DIRECTORIES target properties
  * FindOpenSSL: Detect OpenSSL 3.0.0 (bsc#1172267)
- cmake 3.17.2:
  * fixes dealing with boost 1.73
- Add cmake-fix-png-include-dir.patch to fix the png include dir
  search.
- cmake 3.17.1:
  * The :cpack_gen:`CPack NSIS Generator` now requires NSIS 3.0 or later</changelog>
</package>
<package pkgid="3af5ffb316796971faf56e8ebf4a688202d319d99ba02708bbe637b5fc1e836c" name="cmake3-full" arch="s390x">
  <version epoch="0" ver="3.20.0" rel="150200.6.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- cmake 3.15.3:
  * CrayPrgEnv compiler wrapper support updated for 19.06
- includes changes from 3.15.2:
  * Fix CMAKE_FIND_PACKAGE_PREFER_CONFIG variable causing the
    find_package() command to fail on a missing package even
    without the REQUIRED option</changelog>
  <changelog author="sflees@suse.de" date="1572177600">- cmake 3.15.4
  * In CMake 3.15.0 through 3.15.3, the EXCLUDE_FROM_ALL directory
    property was regressed from pre-3.14 behavior and caused targets
    within the directory to be excluded even from its own “all”.
    This has been fixed. The bug also existed in 3.14.0 through
    3.14.6 and is fixed in 3.14.7.
- Use pkgconfig for dependencies where possible (required due to
  tumbleweed build changes)</changelog>
  <changelog author="tchvatal@suse.com" date="1572609600">- Update cmake conditionals to make sure the multibuild is
  nicely leveraged</changelog>
  <changelog author="simonf.lees@suse.com" date="1572955200">- Drop debug patch (never in factory) and update patch numbers</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573387200">- cmake 3.15.5:
  * no changelog available</changelog>
  <changelog author="mpluskal@suse.com" date="1573646400">- Switch back to libcurl-mini-devel to avoid new build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1574769600">- update to CMake 3.16
  Changelog see https://blog.kitware.com/cmake-3-16-0-available-for-download/
- drop patch form.patch, fixed upstream</changelog>
  <changelog author="sflees@suse.de" date="1574856000">- Fix numbering of patches.</changelog>
  <changelog author="foss@grueninger.de" date="1576843200">- update to CMAke 3.16.2
  * FindBLAS: Consider OpenBLAS with thread libraries only with C or CXX
  * FindBoost: Add support for Boost 1.72
  * FindLAPACK: Fix support for LAPACK symbols inside BLAS libraries
  Full changelog see https://blog.kitware.com/cmake-3-16-2-available-for-download/</changelog>
  <changelog author="asn@cryptomilk.org" date="1579003200">- Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
- Do NOT set -DCMAKE_SKIP_RPATH:BOOL=OFF
  * A lot of applications have private libraries in a subdirectory
    and require linking with RPATH which is totally valid.</changelog>
  <changelog author="junghans@votca.org" date="1579003201">- use cmake generics in marcos.cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1580904000">- Add new -mini flavor in order to break up cycles
  * make sure the default cmake links now all system libraries
    and mini uses bundled stuff as needed
- Switch to python3 variant of Sphinx on the manpage/docu creation</changelog>
  <changelog author="sflees@suse.de" date="1581076800">- Revert "use cmake generics in marcos.cmake" it breaks many
  cases in stagings.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1581336000">- Revert LIBDIR change in macros - it is inconsistent (all other
  INSTALL_&lt;dir&gt;s use absolute paths), unneeded (paths may be
  absolute or relative), and breaks a number of packages.
- Update minimum libarchive version, &gt;= 3.3.3.
- Do not flag macros as config file.
- Adjust constraints (7G disk space is required, independent
  of architecture).</changelog>
  <changelog author="dimstar@opensuse.org" date="1582113600">- Change cmake to be a meta-package that requires
  cmake-implementation. This new symbol is provided by the (newly
  named) cmake-full package as well as cmake-mini.
- This is needed as the original attempt of using Substitute in OBS
  actually rewrites the used spec files on disk, not only on the
  fly and we ended up with packages Requiring cmake-mini (which is
  not installable on end user systems).</changelog>
  <changelog author="foss@grueninger.de" date="1584878400">- update to 3.17.0
  * cmake(1) gained a “Ninja Multi-Config” generator, which
    can be used to build multiple configurations at once.
  * cmake(1) gained a “–debug-find” command-line option to
    enable additional human-readable output on where find
    commands search.
  * Target link properties are now transitive over
    private dependencies on static libraries. See policy “CMP0099”.
  * cmake(1) gained a “-E rm” command-line tool that can
    be used to remove directories and files.
  Full changelog see
  https://blog.kitware.com/cmake-3-17-0-available-for-download/</changelog>
  <changelog author="sflees@suse.de" date="1584964800">- Many Leap packages don't build without -DCMAKE_SKIP_RPATH:BOOL=ON
  so leave this change to the next major version of Leap / SLE</changelog>
  <changelog author="sflees@suse.de" date="1585224000">- Fix mistake in previous change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628251200">- copypac from SLE-15, because of Firefox91 (bsc#1188891)
  (Dependency chain: cmake3 -&gt; Rust -&gt; Firefox)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718366400">- Needed for Firefox 128 (bsc#1226316)
  (Dependency chain: cmake3 -&gt; Rust1.78 -&gt; Firefox)
- Update to 3.20.0
  * The “cmake_path()” command was added for operations on
    filesystem paths.
  * The “target_sources()” command now supports targets created
    by the “add_custom_target()” command.
  * The “ExternalProject” module “ExternalProject_Add()” function
    gained a “CONFIGURE_HANDLED_BY_BUILD” option.
  * “ctest(1)” gained a “–test-dir” option to specify the directory
    in which to look for tests.
- update to 3.19.7:
  * With :ref:`Visual Studio Generators` for VS 2017 and higher, the
    :variable:`CMAKE_GENERATOR_TOOLSET` field ``version=`` now accepts
    three-component MSVC toolset versions such as ``14.28.29910``.
    See the :variable:`CMAKE_VS_PLATFORM_TOOLSET_VERSION` variable.
- cmake 3.19.6:
  * The cmake-presets(7) feature no longer allows comments in
    CMakePresets.json or CMakeUserPresets.json files. This was
    mistakenly allowed by the implementation in 3.19.0 to 3.19.5
- Update to CMake 3.19.5
  * FindBoost: Add support for Boost 1.75
  * FindCUDAToolkit: Restore use of CUDA_PATH environment variable
- A quick note that tumbleweed isn't affeted by bsc#1181680 which
  is being fixed for SLE.
- cmake 3.19.4:
  * fixes for other platforms
- cmake 3.19.3:
  * FetchContent: Relative SOURCE_DIR override cannot be a hard error
  * FindMPI: remove single quotes from include path
  * FindHDF5: Fix finding both debug and release libs
  * cmake-gui: Restore linking of Qt resources
  * cmMakefile: Don't expand bracket arguments in --trace-expand
- update to 3.19.2:
  * various Apple-Silicon support fixes
  * The CMAKE_ISPC_HEADER_SUFFIX variable and corresponding ISPC_HEADER_SUFFIX
  target property were added to control the header suffix used by ISPC
  compiler generated headers.
- remove 5556.patch (upstream)
- Add 5556.patch: export: Do not fail generation for separate
  namelink only case. Fixes regression, blocking other packages
  from build,
- cmake 3.19.1:
  * avoid breaking projects relying on using the LANGUAGE property
    to cause the specified language's compiler to be used
  * CUDA 11.1 support for Clang.
- cmake 3.19.0:
  * cmake(1) and cmake-gui(1) now recognize CMakePresets.json and
    CMakeUserPresets.json files
  * support for ISPC
  * exctend CUDA language support for Clang
  * extend cmake-file-ap "codemodel"
  * cli --install supports --default-directory-permissions
  * cli supports creating hardlinks
  * CMake GUI now has an environment variable editor
  * Multiple cmake commands support new options and subcommands
  * Multiple variables added or functionalities extended
  * Multiple new modules and added functionality to existing modules
  * Compatibility with versions of CMake older than 2.8.12 is now
    deprecated and will be removed from a future version. Calls to
    cmake_minimum_required() or cmake_policy() that set the policy
    version to an older value now issue a deprecation diagnostic.
  * cmake-gui now requires Qt5
- cmake 3.18.4:
  * no upstream changelog
- update to 3.18.3:
  * The Compile Features functionality was updated for MSVC 19.28
- reapply this change (bsc#1174581):
  * Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
  see also
  https://gitlab.kitware.com/cmake/cmake/-/issues/20250
  https://github.com/arvidn/libtorrent/issues/5125#issuecomment-691559244
- update to 3.18.2:
  * The default value of :variable:`CMAKE_AUTOMOC_PATH_PREFIX` was changed to
  ``OFF`` because this feature can break existing projects that have
  identically named header files in different include directories.
  This restores compatibility with behavior of CMake 3.15 and below.
  * The :manual:`Compile Features &lt;cmake-compile-features(7)&gt;` functionality
  was updated for MSVC 19.27 as mentioned above.
- cmake 3.18.1:
  * Revert undocumented fix in 3.18.0 in the add_test() command
    for special characters to avoid breaking existing projects that
    worked around the issue. Will be reintroduced later
- drop no-system-nghttp2.patch, upstream
- Install the rpm provides handler to the correct location
  (%{_rpmconfigdir, not %{_libexecdir}).
- update to cmake 3.18.0
  * The “CUDA” language can now be compiled using Clang on non-Windows platforms.
  * “cmake(1)” gained support for profiling of CMake scripts
  * The “cmake_language()” command was added for meta-operations on
    scripted or built-in commands, starting with a mode to “CALL” other
    commands, and “EVAL CODE” to inplace evaluate a CMake script.
  * The “find_program()”, “find_library()”, “find_path()” and
    “find_file()” commands gained a new “REQUIRED” option that will stop
    processing with an error message if nothing is found.
  * The “CheckLinkerFlag” module has been added to provide a facility to
    check validity of link flags.
  * “ccmake(1)” learned to read a “CCMAKE_COLORS” environment variable
    to customize colors.
- Drop patch lua54.patch, it became part of upstream
- Udjust patch cmake-fix-ruby-test.patch
- Add patch no-system-nghttp2.patch which will become part of 3.18.1
  to disable nghttp2 from system for cmake-mini
- Add lua54.patch which adds 5.4 among allowed versions of
  Lua interpreter.
  (https://gitlab.kitware.com/cmake/cmake/-/issues/20933)
- Use plain autosetup
- DCMAKE_MODULES_INSTALL_DIR should be %{_libdir}/cmake/%{name}
- Set CMAKE_INSTALL_LIBEXECDIR=%{_libexecdir}
- Use -DCMAKE_SKIP_INSTALL_RPATHS:BOOL=ON instead of completely
  removing rpaths. boo#1172331
- cmake 3.17.3:
  * Selection of the Objective C or C++ compiler now considers the
    CC or CXX environment variable if the OBJC or OBJCXX
    environment variable is not set
  * The FindPkgConfig module now extracts include directories
    prefixed with -isystem into the *_INCLUDE_DIRS variables and
    INTERFACE_INCLUDE_DIRECTORIES target properties
  * FindOpenSSL: Detect OpenSSL 3.0.0 (bsc#1172267)
- cmake 3.17.2:
  * fixes dealing with boost 1.73
- Add cmake-fix-png-include-dir.patch to fix the png include dir
  search.
- cmake 3.17.1:
  * The :cpack_gen:`CPack NSIS Generator` now requires NSIS 3.0 or later</changelog>
</package>
<package pkgid="d5fa21e2633ace52fa5699c86d4d71ecd8790d7955729ec9a326d1ae352a44c0" name="cmake3-full" arch="src">
  <version epoch="0" ver="3.20.0" rel="150200.6.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- cmake 3.15.3:
  * CrayPrgEnv compiler wrapper support updated for 19.06
- includes changes from 3.15.2:
  * Fix CMAKE_FIND_PACKAGE_PREFER_CONFIG variable causing the
    find_package() command to fail on a missing package even
    without the REQUIRED option</changelog>
  <changelog author="sflees@suse.de" date="1572177600">- cmake 3.15.4
  * In CMake 3.15.0 through 3.15.3, the EXCLUDE_FROM_ALL directory
    property was regressed from pre-3.14 behavior and caused targets
    within the directory to be excluded even from its own “all”.
    This has been fixed. The bug also existed in 3.14.0 through
    3.14.6 and is fixed in 3.14.7.
- Use pkgconfig for dependencies where possible (required due to
  tumbleweed build changes)</changelog>
  <changelog author="tchvatal@suse.com" date="1572609600">- Update cmake conditionals to make sure the multibuild is
  nicely leveraged</changelog>
  <changelog author="simonf.lees@suse.com" date="1572955200">- Drop debug patch (never in factory) and update patch numbers</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573387200">- cmake 3.15.5:
  * no changelog available</changelog>
  <changelog author="mpluskal@suse.com" date="1573646400">- Switch back to libcurl-mini-devel to avoid new build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1574769600">- update to CMake 3.16
  Changelog see https://blog.kitware.com/cmake-3-16-0-available-for-download/
- drop patch form.patch, fixed upstream</changelog>
  <changelog author="sflees@suse.de" date="1574856000">- Fix numbering of patches.</changelog>
  <changelog author="foss@grueninger.de" date="1576843200">- update to CMAke 3.16.2
  * FindBLAS: Consider OpenBLAS with thread libraries only with C or CXX
  * FindBoost: Add support for Boost 1.72
  * FindLAPACK: Fix support for LAPACK symbols inside BLAS libraries
  Full changelog see https://blog.kitware.com/cmake-3-16-2-available-for-download/</changelog>
  <changelog author="asn@cryptomilk.org" date="1579003200">- Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
- Do NOT set -DCMAKE_SKIP_RPATH:BOOL=OFF
  * A lot of applications have private libraries in a subdirectory
    and require linking with RPATH which is totally valid.</changelog>
  <changelog author="junghans@votca.org" date="1579003201">- use cmake generics in marcos.cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1580904000">- Add new -mini flavor in order to break up cycles
  * make sure the default cmake links now all system libraries
    and mini uses bundled stuff as needed
- Switch to python3 variant of Sphinx on the manpage/docu creation</changelog>
  <changelog author="sflees@suse.de" date="1581076800">- Revert "use cmake generics in marcos.cmake" it breaks many
  cases in stagings.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1581336000">- Revert LIBDIR change in macros - it is inconsistent (all other
  INSTALL_&lt;dir&gt;s use absolute paths), unneeded (paths may be
  absolute or relative), and breaks a number of packages.
- Update minimum libarchive version, &gt;= 3.3.3.
- Do not flag macros as config file.
- Adjust constraints (7G disk space is required, independent
  of architecture).</changelog>
  <changelog author="dimstar@opensuse.org" date="1582113600">- Change cmake to be a meta-package that requires
  cmake-implementation. This new symbol is provided by the (newly
  named) cmake-full package as well as cmake-mini.
- This is needed as the original attempt of using Substitute in OBS
  actually rewrites the used spec files on disk, not only on the
  fly and we ended up with packages Requiring cmake-mini (which is
  not installable on end user systems).</changelog>
  <changelog author="foss@grueninger.de" date="1584878400">- update to 3.17.0
  * cmake(1) gained a “Ninja Multi-Config” generator, which
    can be used to build multiple configurations at once.
  * cmake(1) gained a “–debug-find” command-line option to
    enable additional human-readable output on where find
    commands search.
  * Target link properties are now transitive over
    private dependencies on static libraries. See policy “CMP0099”.
  * cmake(1) gained a “-E rm” command-line tool that can
    be used to remove directories and files.
  Full changelog see
  https://blog.kitware.com/cmake-3-17-0-available-for-download/</changelog>
  <changelog author="sflees@suse.de" date="1584964800">- Many Leap packages don't build without -DCMAKE_SKIP_RPATH:BOOL=ON
  so leave this change to the next major version of Leap / SLE</changelog>
  <changelog author="sflees@suse.de" date="1585224000">- Fix mistake in previous change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628251200">- copypac from SLE-15, because of Firefox91 (bsc#1188891)
  (Dependency chain: cmake3 -&gt; Rust -&gt; Firefox)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718366400">- Needed for Firefox 128 (bsc#1226316)
  (Dependency chain: cmake3 -&gt; Rust1.78 -&gt; Firefox)
- Update to 3.20.0
  * The “cmake_path()” command was added for operations on
    filesystem paths.
  * The “target_sources()” command now supports targets created
    by the “add_custom_target()” command.
  * The “ExternalProject” module “ExternalProject_Add()” function
    gained a “CONFIGURE_HANDLED_BY_BUILD” option.
  * “ctest(1)” gained a “–test-dir” option to specify the directory
    in which to look for tests.
- update to 3.19.7:
  * With :ref:`Visual Studio Generators` for VS 2017 and higher, the
    :variable:`CMAKE_GENERATOR_TOOLSET` field ``version=`` now accepts
    three-component MSVC toolset versions such as ``14.28.29910``.
    See the :variable:`CMAKE_VS_PLATFORM_TOOLSET_VERSION` variable.
- cmake 3.19.6:
  * The cmake-presets(7) feature no longer allows comments in
    CMakePresets.json or CMakeUserPresets.json files. This was
    mistakenly allowed by the implementation in 3.19.0 to 3.19.5
- Update to CMake 3.19.5
  * FindBoost: Add support for Boost 1.75
  * FindCUDAToolkit: Restore use of CUDA_PATH environment variable
- A quick note that tumbleweed isn't affeted by bsc#1181680 which
  is being fixed for SLE.
- cmake 3.19.4:
  * fixes for other platforms
- cmake 3.19.3:
  * FetchContent: Relative SOURCE_DIR override cannot be a hard error
  * FindMPI: remove single quotes from include path
  * FindHDF5: Fix finding both debug and release libs
  * cmake-gui: Restore linking of Qt resources
  * cmMakefile: Don't expand bracket arguments in --trace-expand
- update to 3.19.2:
  * various Apple-Silicon support fixes
  * The CMAKE_ISPC_HEADER_SUFFIX variable and corresponding ISPC_HEADER_SUFFIX
  target property were added to control the header suffix used by ISPC
  compiler generated headers.
- remove 5556.patch (upstream)
- Add 5556.patch: export: Do not fail generation for separate
  namelink only case. Fixes regression, blocking other packages
  from build,
- cmake 3.19.1:
  * avoid breaking projects relying on using the LANGUAGE property
    to cause the specified language's compiler to be used
  * CUDA 11.1 support for Clang.
- cmake 3.19.0:
  * cmake(1) and cmake-gui(1) now recognize CMakePresets.json and
    CMakeUserPresets.json files
  * support for ISPC
  * exctend CUDA language support for Clang
  * extend cmake-file-ap "codemodel"
  * cli --install supports --default-directory-permissions
  * cli supports creating hardlinks
  * CMake GUI now has an environment variable editor
  * Multiple cmake commands support new options and subcommands
  * Multiple variables added or functionalities extended
  * Multiple new modules and added functionality to existing modules
  * Compatibility with versions of CMake older than 2.8.12 is now
    deprecated and will be removed from a future version. Calls to
    cmake_minimum_required() or cmake_policy() that set the policy
    version to an older value now issue a deprecation diagnostic.
  * cmake-gui now requires Qt5
- cmake 3.18.4:
  * no upstream changelog
- update to 3.18.3:
  * The Compile Features functionality was updated for MSVC 19.28
- reapply this change (bsc#1174581):
  * Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
  see also
  https://gitlab.kitware.com/cmake/cmake/-/issues/20250
  https://github.com/arvidn/libtorrent/issues/5125#issuecomment-691559244
- update to 3.18.2:
  * The default value of :variable:`CMAKE_AUTOMOC_PATH_PREFIX` was changed to
  ``OFF`` because this feature can break existing projects that have
  identically named header files in different include directories.
  This restores compatibility with behavior of CMake 3.15 and below.
  * The :manual:`Compile Features &lt;cmake-compile-features(7)&gt;` functionality
  was updated for MSVC 19.27 as mentioned above.
- cmake 3.18.1:
  * Revert undocumented fix in 3.18.0 in the add_test() command
    for special characters to avoid breaking existing projects that
    worked around the issue. Will be reintroduced later
- drop no-system-nghttp2.patch, upstream
- Install the rpm provides handler to the correct location
  (%{_rpmconfigdir, not %{_libexecdir}).
- update to cmake 3.18.0
  * The “CUDA” language can now be compiled using Clang on non-Windows platforms.
  * “cmake(1)” gained support for profiling of CMake scripts
  * The “cmake_language()” command was added for meta-operations on
    scripted or built-in commands, starting with a mode to “CALL” other
    commands, and “EVAL CODE” to inplace evaluate a CMake script.
  * The “find_program()”, “find_library()”, “find_path()” and
    “find_file()” commands gained a new “REQUIRED” option that will stop
    processing with an error message if nothing is found.
  * The “CheckLinkerFlag” module has been added to provide a facility to
    check validity of link flags.
  * “ccmake(1)” learned to read a “CCMAKE_COLORS” environment variable
    to customize colors.
- Drop patch lua54.patch, it became part of upstream
- Udjust patch cmake-fix-ruby-test.patch
- Add patch no-system-nghttp2.patch which will become part of 3.18.1
  to disable nghttp2 from system for cmake-mini
- Add lua54.patch which adds 5.4 among allowed versions of
  Lua interpreter.
  (https://gitlab.kitware.com/cmake/cmake/-/issues/20933)
- Use plain autosetup
- DCMAKE_MODULES_INSTALL_DIR should be %{_libdir}/cmake/%{name}
- Set CMAKE_INSTALL_LIBEXECDIR=%{_libexecdir}
- Use -DCMAKE_SKIP_INSTALL_RPATHS:BOOL=ON instead of completely
  removing rpaths. boo#1172331
- cmake 3.17.3:
  * Selection of the Objective C or C++ compiler now considers the
    CC or CXX environment variable if the OBJC or OBJCXX
    environment variable is not set
  * The FindPkgConfig module now extracts include directories
    prefixed with -isystem into the *_INCLUDE_DIRS variables and
    INTERFACE_INCLUDE_DIRECTORIES target properties
  * FindOpenSSL: Detect OpenSSL 3.0.0 (bsc#1172267)
- cmake 3.17.2:
  * fixes dealing with boost 1.73
- Add cmake-fix-png-include-dir.patch to fix the png include dir
  search.
- cmake 3.17.1:
  * The :cpack_gen:`CPack NSIS Generator` now requires NSIS 3.0 or later</changelog>
</package>
<package pkgid="4ef9c46e36ee0e4c0644746c02003b4408eb05352835ee74aabd982108c72dc7" name="cmake3-full" arch="x86_64">
  <version epoch="0" ver="3.20.0" rel="150200.6.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- cmake 3.15.3:
  * CrayPrgEnv compiler wrapper support updated for 19.06
- includes changes from 3.15.2:
  * Fix CMAKE_FIND_PACKAGE_PREFER_CONFIG variable causing the
    find_package() command to fail on a missing package even
    without the REQUIRED option</changelog>
  <changelog author="sflees@suse.de" date="1572177600">- cmake 3.15.4
  * In CMake 3.15.0 through 3.15.3, the EXCLUDE_FROM_ALL directory
    property was regressed from pre-3.14 behavior and caused targets
    within the directory to be excluded even from its own “all”.
    This has been fixed. The bug also existed in 3.14.0 through
    3.14.6 and is fixed in 3.14.7.
- Use pkgconfig for dependencies where possible (required due to
  tumbleweed build changes)</changelog>
  <changelog author="tchvatal@suse.com" date="1572609600">- Update cmake conditionals to make sure the multibuild is
  nicely leveraged</changelog>
  <changelog author="simonf.lees@suse.com" date="1572955200">- Drop debug patch (never in factory) and update patch numbers</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573387200">- cmake 3.15.5:
  * no changelog available</changelog>
  <changelog author="mpluskal@suse.com" date="1573646400">- Switch back to libcurl-mini-devel to avoid new build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1574769600">- update to CMake 3.16
  Changelog see https://blog.kitware.com/cmake-3-16-0-available-for-download/
- drop patch form.patch, fixed upstream</changelog>
  <changelog author="sflees@suse.de" date="1574856000">- Fix numbering of patches.</changelog>
  <changelog author="foss@grueninger.de" date="1576843200">- update to CMAke 3.16.2
  * FindBLAS: Consider OpenBLAS with thread libraries only with C or CXX
  * FindBoost: Add support for Boost 1.72
  * FindLAPACK: Fix support for LAPACK symbols inside BLAS libraries
  Full changelog see https://blog.kitware.com/cmake-3-16-2-available-for-download/</changelog>
  <changelog author="asn@cryptomilk.org" date="1579003200">- Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
- Do NOT set -DCMAKE_SKIP_RPATH:BOOL=OFF
  * A lot of applications have private libraries in a subdirectory
    and require linking with RPATH which is totally valid.</changelog>
  <changelog author="junghans@votca.org" date="1579003201">- use cmake generics in marcos.cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1580904000">- Add new -mini flavor in order to break up cycles
  * make sure the default cmake links now all system libraries
    and mini uses bundled stuff as needed
- Switch to python3 variant of Sphinx on the manpage/docu creation</changelog>
  <changelog author="sflees@suse.de" date="1581076800">- Revert "use cmake generics in marcos.cmake" it breaks many
  cases in stagings.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1581336000">- Revert LIBDIR change in macros - it is inconsistent (all other
  INSTALL_&lt;dir&gt;s use absolute paths), unneeded (paths may be
  absolute or relative), and breaks a number of packages.
- Update minimum libarchive version, &gt;= 3.3.3.
- Do not flag macros as config file.
- Adjust constraints (7G disk space is required, independent
  of architecture).</changelog>
  <changelog author="dimstar@opensuse.org" date="1582113600">- Change cmake to be a meta-package that requires
  cmake-implementation. This new symbol is provided by the (newly
  named) cmake-full package as well as cmake-mini.
- This is needed as the original attempt of using Substitute in OBS
  actually rewrites the used spec files on disk, not only on the
  fly and we ended up with packages Requiring cmake-mini (which is
  not installable on end user systems).</changelog>
  <changelog author="foss@grueninger.de" date="1584878400">- update to 3.17.0
  * cmake(1) gained a “Ninja Multi-Config” generator, which
    can be used to build multiple configurations at once.
  * cmake(1) gained a “–debug-find” command-line option to
    enable additional human-readable output on where find
    commands search.
  * Target link properties are now transitive over
    private dependencies on static libraries. See policy “CMP0099”.
  * cmake(1) gained a “-E rm” command-line tool that can
    be used to remove directories and files.
  Full changelog see
  https://blog.kitware.com/cmake-3-17-0-available-for-download/</changelog>
  <changelog author="sflees@suse.de" date="1584964800">- Many Leap packages don't build without -DCMAKE_SKIP_RPATH:BOOL=ON
  so leave this change to the next major version of Leap / SLE</changelog>
  <changelog author="sflees@suse.de" date="1585224000">- Fix mistake in previous change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628251200">- copypac from SLE-15, because of Firefox91 (bsc#1188891)
  (Dependency chain: cmake3 -&gt; Rust -&gt; Firefox)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718366400">- Needed for Firefox 128 (bsc#1226316)
  (Dependency chain: cmake3 -&gt; Rust1.78 -&gt; Firefox)
- Update to 3.20.0
  * The “cmake_path()” command was added for operations on
    filesystem paths.
  * The “target_sources()” command now supports targets created
    by the “add_custom_target()” command.
  * The “ExternalProject” module “ExternalProject_Add()” function
    gained a “CONFIGURE_HANDLED_BY_BUILD” option.
  * “ctest(1)” gained a “–test-dir” option to specify the directory
    in which to look for tests.
- update to 3.19.7:
  * With :ref:`Visual Studio Generators` for VS 2017 and higher, the
    :variable:`CMAKE_GENERATOR_TOOLSET` field ``version=`` now accepts
    three-component MSVC toolset versions such as ``14.28.29910``.
    See the :variable:`CMAKE_VS_PLATFORM_TOOLSET_VERSION` variable.
- cmake 3.19.6:
  * The cmake-presets(7) feature no longer allows comments in
    CMakePresets.json or CMakeUserPresets.json files. This was
    mistakenly allowed by the implementation in 3.19.0 to 3.19.5
- Update to CMake 3.19.5
  * FindBoost: Add support for Boost 1.75
  * FindCUDAToolkit: Restore use of CUDA_PATH environment variable
- A quick note that tumbleweed isn't affeted by bsc#1181680 which
  is being fixed for SLE.
- cmake 3.19.4:
  * fixes for other platforms
- cmake 3.19.3:
  * FetchContent: Relative SOURCE_DIR override cannot be a hard error
  * FindMPI: remove single quotes from include path
  * FindHDF5: Fix finding both debug and release libs
  * cmake-gui: Restore linking of Qt resources
  * cmMakefile: Don't expand bracket arguments in --trace-expand
- update to 3.19.2:
  * various Apple-Silicon support fixes
  * The CMAKE_ISPC_HEADER_SUFFIX variable and corresponding ISPC_HEADER_SUFFIX
  target property were added to control the header suffix used by ISPC
  compiler generated headers.
- remove 5556.patch (upstream)
- Add 5556.patch: export: Do not fail generation for separate
  namelink only case. Fixes regression, blocking other packages
  from build,
- cmake 3.19.1:
  * avoid breaking projects relying on using the LANGUAGE property
    to cause the specified language's compiler to be used
  * CUDA 11.1 support for Clang.
- cmake 3.19.0:
  * cmake(1) and cmake-gui(1) now recognize CMakePresets.json and
    CMakeUserPresets.json files
  * support for ISPC
  * exctend CUDA language support for Clang
  * extend cmake-file-ap "codemodel"
  * cli --install supports --default-directory-permissions
  * cli supports creating hardlinks
  * CMake GUI now has an environment variable editor
  * Multiple cmake commands support new options and subcommands
  * Multiple variables added or functionalities extended
  * Multiple new modules and added functionality to existing modules
  * Compatibility with versions of CMake older than 2.8.12 is now
    deprecated and will be removed from a future version. Calls to
    cmake_minimum_required() or cmake_policy() that set the policy
    version to an older value now issue a deprecation diagnostic.
  * cmake-gui now requires Qt5
- cmake 3.18.4:
  * no upstream changelog
- update to 3.18.3:
  * The Compile Features functionality was updated for MSVC 19.28
- reapply this change (bsc#1174581):
  * Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
  see also
  https://gitlab.kitware.com/cmake/cmake/-/issues/20250
  https://github.com/arvidn/libtorrent/issues/5125#issuecomment-691559244
- update to 3.18.2:
  * The default value of :variable:`CMAKE_AUTOMOC_PATH_PREFIX` was changed to
  ``OFF`` because this feature can break existing projects that have
  identically named header files in different include directories.
  This restores compatibility with behavior of CMake 3.15 and below.
  * The :manual:`Compile Features &lt;cmake-compile-features(7)&gt;` functionality
  was updated for MSVC 19.27 as mentioned above.
- cmake 3.18.1:
  * Revert undocumented fix in 3.18.0 in the add_test() command
    for special characters to avoid breaking existing projects that
    worked around the issue. Will be reintroduced later
- drop no-system-nghttp2.patch, upstream
- Install the rpm provides handler to the correct location
  (%{_rpmconfigdir, not %{_libexecdir}).
- update to cmake 3.18.0
  * The “CUDA” language can now be compiled using Clang on non-Windows platforms.
  * “cmake(1)” gained support for profiling of CMake scripts
  * The “cmake_language()” command was added for meta-operations on
    scripted or built-in commands, starting with a mode to “CALL” other
    commands, and “EVAL CODE” to inplace evaluate a CMake script.
  * The “find_program()”, “find_library()”, “find_path()” and
    “find_file()” commands gained a new “REQUIRED” option that will stop
    processing with an error message if nothing is found.
  * The “CheckLinkerFlag” module has been added to provide a facility to
    check validity of link flags.
  * “ccmake(1)” learned to read a “CCMAKE_COLORS” environment variable
    to customize colors.
- Drop patch lua54.patch, it became part of upstream
- Udjust patch cmake-fix-ruby-test.patch
- Add patch no-system-nghttp2.patch which will become part of 3.18.1
  to disable nghttp2 from system for cmake-mini
- Add lua54.patch which adds 5.4 among allowed versions of
  Lua interpreter.
  (https://gitlab.kitware.com/cmake/cmake/-/issues/20933)
- Use plain autosetup
- DCMAKE_MODULES_INSTALL_DIR should be %{_libdir}/cmake/%{name}
- Set CMAKE_INSTALL_LIBEXECDIR=%{_libexecdir}
- Use -DCMAKE_SKIP_INSTALL_RPATHS:BOOL=ON instead of completely
  removing rpaths. boo#1172331
- cmake 3.17.3:
  * Selection of the Objective C or C++ compiler now considers the
    CC or CXX environment variable if the OBJC or OBJCXX
    environment variable is not set
  * The FindPkgConfig module now extracts include directories
    prefixed with -isystem into the *_INCLUDE_DIRS variables and
    INTERFACE_INCLUDE_DIRECTORIES target properties
  * FindOpenSSL: Detect OpenSSL 3.0.0 (bsc#1172267)
- cmake 3.17.2:
  * fixes dealing with boost 1.73
- Add cmake-fix-png-include-dir.patch to fix the png include dir
  search.
- cmake 3.17.1:
  * The :cpack_gen:`CPack NSIS Generator` now requires NSIS 3.0 or later</changelog>
</package>
<package pkgid="d1358fea7c21e0fb6ef60582944391f530e090f8720bf834febed24db7359a02" name="collectd" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="3abf8dd0e15602777858e08238ef9999f070ca2fa12d71e60d6173d68aea1880" name="collectd" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="7717e1f099194d5a1b7bd996309eb35da6cf86d283c6517e5236638f75b84ee3" name="collectd" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="671e76c1f20740d08c88628bb0ab90241fdc9265df66cd4f351e5768b4c1f500" name="collectd" arch="src">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="0371141869e0690b19539a6064421bf6c7857225fddb2b20938425e5243d3e7b" name="collectd" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="6b66f3de51e66dd7139e04b5f28cafe601973f21c0c0a8fc7d44dfb793e8808f" name="collectd-plugin-buddyinfo" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="f01ea35fc8d67d389a2cce7b2133981842c52ed106eef61f37a7c70e8ff1d46a" name="collectd-plugin-buddyinfo" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="40fb069ace22b9ae3aa9d3c383c2f46e2eb1e8140988196649cbea8688f1cf65" name="collectd-plugin-buddyinfo" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="d7c332669235d8574d0f9bfc19dd919b897a4d98d4cb8137439bc4f29b1895d4" name="collectd-plugin-buddyinfo" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="8d93be5815dd7b2e594b30e768add66cf142ffda6e4581282d726c1c295e5c7e" name="collectd-plugin-connectivity" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="32e807d93fe9c2bad90b5a03f55ba5a3647358b943ffdc8ea7fe576dd03faa4d" name="collectd-plugin-connectivity" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="780b1105834e133178a6d49703640c9c70b0ddd0598bc7b6eb2a7ddbfeb1c90a" name="collectd-plugin-connectivity" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="779f544207b53f0d8b79b8c876f0ec21fb1b0093e97978453abeea6eaf313f2c" name="collectd-plugin-connectivity" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="e0ac0096d3d5a68ddd3ec03516cca304f806bfa14cb9e435a81dd75d092b245b" name="collectd-plugin-dbi" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="c6934b96abcf97e80497d11dab3c66c9da944eb25b6013a4294250f5ccfa246e" name="collectd-plugin-dbi" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="a8859e41020aba43ff059ab85ba755fa7fc0fc24c7d64dbbcfcdae0991ce6e33" name="collectd-plugin-dbi" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="33e27a6be873db9d0b12f2c406103166db62659a0baf3d67b13415222dcc203c" name="collectd-plugin-dbi" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="2688379c9ac1e38ac1085ae5cb2f24bad06576dfd73289f7619f1835da0ca505" name="collectd-plugin-ipmi" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="9dda8cd27016179d4e9c34b07a902ac871543ece088d8ec619cbcc089f036af3" name="collectd-plugin-ipmi" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="9442c7701b682b2c253cfc6ca212549165940efd0f2ccfe39f4b9b9d691d155d" name="collectd-plugin-ipmi" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="da970b3d27da977a8604a8c23b62ca97f1bbe8a45c70c66fb536fe2c90f6a657" name="collectd-plugin-ipmi" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="27b82efebe83fe66061994e4b2efb1c80897fa39ad106f8b6df50f03b067e914" name="collectd-plugin-java" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="8c30b8933ad974b569258d85217512582ceba4393374d221bf519267ecb2e677" name="collectd-plugin-java" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="1480aee518accfad21d5bcc163ff5a25abd871662e979561ff0cb72e3a980665" name="collectd-plugin-java" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="425e5b5b9cd8bd75438b166cf0d59e713934a395aaab4c029832ae11c650b9d9" name="collectd-plugin-java" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="6dc3dc241749a186958a02693f4db5e65b61faf52aa28003f671a94e77e5ba3d" name="collectd-plugin-logparser" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="aadc717c49a882a2a8589ee24b67da226d156eb732846e86d62ada5cb322950a" name="collectd-plugin-logparser" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="c200498135b43824aef31dba2c425448a34d5a55f52a93dcaeeb797d78c3b2cf" name="collectd-plugin-logparser" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="e6948f7ed269adaedb6b5a4b5f719656a46a5a000aa770b7fdc439a9517bda69" name="collectd-plugin-logparser" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="ac78b60837865d0fb502d42a8462d648af48259a720a7e9fbce7fa40e5b4690a" name="collectd-plugin-lua" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="1f1b78829e9be1fba84a3b2daeeb67384a9a792aa7e6554f537944bf4be4ae1a" name="collectd-plugin-lua" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="20315b387a21a5d5c2f9ae18b9aff5d66e50045dafc934b4daa93ee04a5508d3" name="collectd-plugin-lua" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="7515e15ca7b0f413a3ce6613542bcf1146bf3c4b392c2c0efb66995becfd03bf" name="collectd-plugin-lua" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="7363047e87928030a0cd2e363bd75b2da1c03a458714e46588a370ebb1ed280b" name="collectd-plugin-mcelog" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="301e0ed095d4df4349e32276f3cd6ae102345d9f6743d8c34560973cd069e50d" name="collectd-plugin-mcelog" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="642b2bf6287a65d4351743695ec54c1f01fa2fc98f652fa3e1ccc443edd50bca" name="collectd-plugin-mcelog" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="ac6d43ad89045468e25481410cd4ab02948f98247274c1c72954f211ed8a45dd" name="collectd-plugin-mcelog" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="d053ddb98a05678abf5a3e8e3611c678355a23de1caa921ea69ea9771b255ebe" name="collectd-plugin-memcachec" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="5598f86e1ae899030b04bf19b8c9ffe63f4a0c841d1659ba79792623f7f6e6fd" name="collectd-plugin-memcachec" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="842e82a4a66f3fc6c78c62be98873e093db4b9f43fab461b2aef0c0a8e5427cf" name="collectd-plugin-memcachec" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="65c65c8a4d0399c88ecd0017faf5db6ce1d0f95ef9a5918d08a665d9fa8c0092" name="collectd-plugin-memcachec" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="3c8f4ddf129de52d4eaf5ec7febd6b1b1d50aa957ee7d19676aebf2af6c9c62c" name="collectd-plugin-mysql" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="e2c69b566fa45aa17462e8310f2d5be3d648ef2ba20354dfa32c900b23fe17fb" name="collectd-plugin-mysql" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="ec52d71422e12edce793c9fbbe19a8251e6461cc1192cb37d775d403c99f38be" name="collectd-plugin-mysql" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="0703fc3f03cc0e5d6b2b59ac0324b433d03a89ba132c767118e5183bf1515ff0" name="collectd-plugin-mysql" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="e95686541c52db1cb8a44757885fed30cb64d0e7853168a151c1d3158cff3bdb" name="collectd-plugin-notify-desktop" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="ade06c309632322003156285338327b07fdbc382cb16f53d5ee072eb7004c4e8" name="collectd-plugin-notify-desktop" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="e04ce5b063a53541394ac3152385341c4c7f1cd0a55250e053e9755484e433b7" name="collectd-plugin-notify-desktop" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="668d72c23d7548df693b3708bdf53f5f5b093b0d6b2b26f58be38edf6509c284" name="collectd-plugin-notify-desktop" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="5526b32531b41484decbd317ef025080a11e345d345413dcf3d58bd5f389598b" name="collectd-plugin-nut" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="7791af7cae64f1097ccc61f9d0f14ddf35ef5b9d628bc2b90299b7db24a090b9" name="collectd-plugin-nut" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="13a51dab13864d586f85a4b6ccb89ca18c8f09e8cd35eed2591ee56854a1b2af" name="collectd-plugin-nut" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="0525d38de6c72c9e4b042530a61db42257e8db46d1d4ef869cb310b50a908c42" name="collectd-plugin-nut" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="c472047ee59ad0a2b340a5a5b04365dfdc3ad947b686fedc7fa91f3c20d1d281" name="collectd-plugin-openldap" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="f33c89da6282864f4dc094e23f9e93e8dcf904cbda5e8506a3c176fe9ae67c05" name="collectd-plugin-openldap" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="9f4f0e0f583ee06bb05caf2692519659fc3c850c5e74862c6f842888e6bcd66c" name="collectd-plugin-openldap" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="bc2f79d6c7d164c7894d05aa8ef15ebcdd0d1afaef8251f2b1eb4ad726220723" name="collectd-plugin-openldap" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="c8711cab337ea56c34a791c885f8aa3086ca6cf18b1f65b12f97bdd0d2ba1d39" name="collectd-plugin-ovs" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="3c704225737bdb150e419dfebbc723ada80ee02614bd3fd4f5eb39374aa3da24" name="collectd-plugin-ovs" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="31c04d76e95c6ef18971cad2970e316c9122aa8a22bbd90422668ba46f04ad45" name="collectd-plugin-ovs" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="8544976be95f68c3821ee1d607056255ff9043eac9a5a31de65b6d56f84f43d1" name="collectd-plugin-ovs" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="457907d935f7250abf07bfe5be9ef8c9a9680c781c88fc9c91d75de5f8f7b15c" name="collectd-plugin-pcie" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="401377cd67efee41731fee143151a8a3f4a53489678dbc5b8944f5736d016b14" name="collectd-plugin-pcie" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="3dbb481a075beea6ddcb56c557600fbb32708bd6f83566eeb5717f24b7e9f2f7" name="collectd-plugin-pcie" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="8b492b736fd4fae402cc98bda5a06e8cd2ce9e85245652fcb66da80e5cbe91eb" name="collectd-plugin-pcie" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="1f35a1e805545127e593fef7897e24d3a6d6ffb9534232ce3272be1549ec7d19" name="collectd-plugin-pinba" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="4d7b5a8e2bf51de54e9a11928ed6c6f09d6be3ca7e36b7685ccf87d90fe87ea8" name="collectd-plugin-pinba" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="152fe0365bde429237b4a100041de1c062cea2fbb5c9312727b1ccdd9bda88cf" name="collectd-plugin-pinba" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="d5109f96b45c811d95776e7ae7e365ee2f96f1b8efc06dea3af5b9f499fa36fc" name="collectd-plugin-pinba" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="331093bf11218979e3ef548b1a54620312a4258777956b92315f969774587dd2" name="collectd-plugin-postgresql" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="0b9f21403b69bf4b739ddf938eb89dacd654e6b5dd5a792907ff8ec7970b7eac" name="collectd-plugin-postgresql" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="4170897127abc466c3b39ab72287d3a60f055c92397e538aa32099e4e0329d0d" name="collectd-plugin-postgresql" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="e7acc8e6b19bf31bde320f6c7a29b4e515fb297707e7cfcd6c01a78429d3f90c" name="collectd-plugin-postgresql" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="5142aaf7e480ed469290ffc49cc36b0b2c1d5208bc69d56191eeaa695d33ae81" name="collectd-plugin-procevent" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="1203405072f20331f64fd4e867190aadb30278c32cdd1ea2b7128ef265992145" name="collectd-plugin-procevent" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="26af0c8940f12f607873707ab4bf403081bc884cdd422ab7282a3590d4e1e49a" name="collectd-plugin-procevent" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="fd1c6445734c92a0e41bcae29dbf6b532ccea115f473a6102ca82e169668c3de" name="collectd-plugin-procevent" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="b25e43d1ba97b0da525972d0bfd33f5d5792b9e280f67179f7a1b07ecef4b662" name="collectd-plugin-python3" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="548d0b9f3f19e9636d9f212563b08b54323c984e170d5a5dd6ee305f4a597a5f" name="collectd-plugin-python3" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="b8f541c2a762ec7d163d61821f560ac859296fa9f3b7673d4f00a0aca8166290" name="collectd-plugin-python3" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="c69ee01d4230a8f310901e379701896b0a64a067a7b63a1db547b1c9dd9335b2" name="collectd-plugin-python3" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="3ae2d0d6c32db244e220d7039b78108e8c6aea7ba2dea18534984658533943a6" name="collectd-plugin-smart" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="4523d6c857bdd269e86dc87de5e634c8b0182b22633a79adf4bca9ef8de3503e" name="collectd-plugin-smart" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="53b81fa344bd513f4fc13b76eaff50de8e7b084bab3414fc4661471f780743a8" name="collectd-plugin-smart" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="80bce1ef8918ee48ca751173b6642a12381f85bc9d992a567652e705709409c1" name="collectd-plugin-smart" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="1b75d7f696e8765a0030bdbf54934fb9ccae8b7268a761be66f84f45ba6c34bf" name="collectd-plugin-snmp" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="5bb3c14a65097489da3f2e920c428bd6ce15577c1c2326b35d3058163289db20" name="collectd-plugin-snmp" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="6eb99535c5509498a70eaec033b142c2f0a7966f06fcb3d338fd37faa15ee80e" name="collectd-plugin-snmp" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="5c1f072599912b2668cb917d648e1fc71bf3f0845ca56e043ca4d5b94fc2269a" name="collectd-plugin-snmp" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="f035624f36543862f037b22b2b3dcbf200622fbce577ab443ec0b5acb5d5208f" name="collectd-plugin-synproxy" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="65884b994bbe6ca84526deee90ead214309630e93a859ee594502b24fe2bcdf9" name="collectd-plugin-synproxy" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="4b1f99cc8a2e1333c8bb089acab9dc307ccbe6d304d1cedde74fce65b3d46d3f" name="collectd-plugin-synproxy" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="0a2c6e2c7bb1af78fd27d921b0b766698613df1271f00ea34250cd9032f01d5d" name="collectd-plugin-synproxy" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="f1409da5788661446c2ee3b4de8cd03441576fb179cc25cfeebd42fd26c85f02" name="collectd-plugin-sysevent" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="5894bf2d1eef3443177d79d47167cfb92b28595db99c434298b6f15e45cdd624" name="collectd-plugin-sysevent" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="98983517dc6edf2d166e95fe4ac583cf26de29f021a90cb864d407af1846ac9c" name="collectd-plugin-sysevent" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="25dff3ac11121e131707dd922fb2a807b8d51c25db2b363ac90e18f07203f395" name="collectd-plugin-sysevent" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="3909dc83ad8a3c1cff98064cef96d4e5a3b31ccf12292a7c63f7acfbeee4f5f6" name="collectd-plugin-ubi" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="98558e9f14e4f987353563011dc27bcaed057aaccb8b9a34191677ea33f25ae5" name="collectd-plugin-ubi" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="7ece679504050fa4c2e32fa3afede1303dc6c082366151aa75b5f863f1781700" name="collectd-plugin-ubi" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="794a1d0796debb65f8c7e6be0a8cea17cda55aa2270b01729d5c5d76b6cc2e4f" name="collectd-plugin-ubi" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="1cff95ed277354d124d8602b18d9ea9b8d31756ef112f90502e8bba9dc9caa64" name="collectd-plugin-uptime" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="9978a9a12270d96f4baa083767023179306f186ced2c313545ca97871f5af89d" name="collectd-plugin-uptime" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="117ac0bbef25091ffeb8ebe214ffbba56b470444e9819fa843a12c594ad0a529" name="collectd-plugin-uptime" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="80e971ec1089dba3ef2faa4bc77608bf51a093775684dad8320cff294fd9633b" name="collectd-plugin-uptime" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="bc60794c6037e0587eb389c2ab5fa852dd49d7766b8aa630244148f632b9499a" name="collectd-plugin-virt" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="b1750d523a2496d150fb84e6dede29f6a18b572205f4a898e8c4dd45eadb00f1" name="collectd-plugin-virt" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="cd9aab30e704309b049ead47c33b58a266d60e978896217de034cd5139a834e6" name="collectd-plugin-virt" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="96ab2e077ab29d171faa58d2c509149f6f62203682dc50fa9557536e9a842811" name="collectd-plugin-virt" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="5892b5bed8b30d6ccc8880ad61b38e001007b5fb6990d181f9113710ffe33c33" name="collectd-plugin-write_influxdb_udp" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="2d9e54548d3a34adbc50e053e1a7b2dbf449d74eae597670fc70587bb1e74cf8" name="collectd-plugin-write_influxdb_udp" arch="ppc64le">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="61b335ce3aacbf8cff7833ddbc4dc57aff16a0d22c587cc59a90089a40fc9812" name="collectd-plugin-write_influxdb_udp" arch="s390x">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="8314167d202364d2a306a5bb2de46178335fc098ff43a662244a0f04a691b07d" name="collectd-plugin-write_influxdb_udp" arch="x86_64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
    libtool 1 has been dropped.
  Check the ChangeLog file for the complete list of changes.
- Add Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add avoid-pg-config.patch to use pkg-config instead of pg_config
- Refresh patches
- Drop Patches:
  * collectd-split_README.patch (merged upstream)
  * collectd-javac_target.patch (doesn't applies)</changelog>
  <changelog author="mardnh@gmx.de" date="1560427200">- Update to 5.9.0:
  * collectd: A new "UNKNOWN" state as the initial state of metrics has
    been added.
  * collectd: config parser: Improved error reporting on global options.
  * collectd: daemon: make plugin_dispatch_multivalue() obey write queue
    limits.
  * collectd: Macros "STRERROR" and "STRERRNO" have been added.
  * collectd: Plugin name field has been added to plugin context to
    improve error reporting.
  * collectd-tg: Use "CLOCK_REALTIME" for collectd-tg times.
  * AMPQ1 plugin: A new plugin to write to amqp1 protocol.
  * Chrony plugin: Ignoring late responses has been added.
  * CPUFreq plugin: Read number of p-state transitions and time spent in
    each p-state.
  * cURL, cURL-XML plugins: Option "Interval" has been added.
  * Exec plugin: Dynamic allocation of grname buffer has been added.
  * GPU NVML plugin: New plugin to collect NVIDIA GPU stats.
  * gRPC plugin: The "VerifyPeer" option for servers has been added.
  * Intel RDT plugin: Support for groups of PIDs has been added.
  * IPMI plugin: Config options "SELSensor" and "SELIgnoreSelected" have
    been added.
  * Modbus plugin: Support for 64 bit vals has been added, support for
    CDAB endian 32-bit modbus polls has been added.
  * Modbus plugin: The "Scale" and "Shift" metrics have been added.
  * Netlink plugin: Handle new counter from Linux kernel version 4.6+.
  * Network plugin: Option "BindAddress" has been added.
  * Ping plugin: An "AddressFamily" configuration option has been added.
  * OVS Stats plugin: Extended metrics "ovs-dpdk" have been added.
  * OVS Stats plugin: Support of bond interface and a "InterfaceStats"
    config option have been added.
  * PCIe Errors plugin: New plugin to read "PCIe" errors.
  * Processes plugin: Support for Linux Delay Accounting has been added.
  * Redis plugin: Keyspace "hitratio" metric has been added, metric
    "operations_per_second" has been removed, an option for connecting via
    UNIX socket has been added.
  * RouterOS plugin: Support for temperature and voltage data has been
    added, use MAC-address when Radio-name is missing.
  * RRDCacheD plugin: Time resolution has been improved to microseconds.
  * Sensors plugin: Checks for upper limit of "SENSORS_API_VERSION" have
    been removed, support for libsensors older than 3.0.0 has been
    dropped.
  * SNMP plugin: New options "PluginInstance", "TypeInstance",
    "TypeInstanceOID", "PluginInstanceOID", "FilterOID", "FilterValues"
    and "FilterIgnoreSelected" have been added.
  * SNMP Agent plugin: Multiple key indexes to snmp table and other new
    features have been added, refactoring, coverity scan issues have been
    fixed.
  * Swap plugin: Support for Linux 2.4 has been dropped.
  * Turbostat plugin: Configuration option "RestoreAffinityPolicy" has
    been added.
  * Turbostat plugin: New metrics "P-states", "Turboboost", "Platform
    TDP", "Uncore bus ratio" have been added.
  * Turbostat plugin: Support of reporting GPU power on SKL has been
    added.
  * virt plugin: Allow read "Hostname" from libvirt metadata.
  * virt plugin: Block info statistics for disk devices have been added.
  * Wireless plugin: A "bitrate" metric has been added.
  * Write Graphite, Write Kafka plugins: Support for Graphite 1.1+ tag has
    been added.
  * Write Prometheus plugin: Option "Host" has been added.
  * Write Stackdriver plugin: New plugin to write to Google Stackdriver
    Monitoring.
  * Write Syslog plugin: "write_syslog" plugin writes values lists as
    syslog messages.
  * collectd: collectdmon cannot exit command line options parse loop has
    been fixed.
  * collectd: Include "kstat.h" if available to provide "kstat_ctl_t",
    include "kstat.h" when available.
  * collectd: Parsing option for avoiding making BaseDir has been fixed.
  * collectd: Remove empty "cmd_listval_t" data structure and related
    no-op code.
  * collectd: src/daemon/plugin.c: Refactor plugin_load_file(),
    src/utils_format_json.c: Remove chatty debug messages.
  * collectd: Stop poisoning function in debug mode.
  * collectd: The number of allocations when parsing types.db has been
    reduced.
  * AMQP1 plugin: Potential memory leaks found via scan-build have been
    fixed, a typo in error log message has been fixed, cleanups.
  * Barometer plugin: Support to "libi2c-4.0" has been added.
  * DBI, Oracle, PostgreSQL plugins: Fixes and improvements.
  * Disk plugin: In linux, reset the disk when it disappears from
    "/proc/diskstats".
  * DPDK Events, DPDK Stats plugins: Buffer size for parsing lcores has
    been increased, a deprecation warning has been fixed, runtime config
    file path has been fixed.
  * GPS plugin: Build with gpsd version 3.18 has been fixed.
  * LUA plugin: A memory leak has been fixed.
  * MySQL plugin: Properly cleanup dropped MySQL connections.
  * Netlink plugin: Truncation warnings have been fixed.
  * NFS plugin: Message "Unexpected number of fields for NFSv4 server
    statistics: 62" has been fixed.
  * NFS plugin: Number of fields for "NFSv4" has been fixed.
  * Notify Email plugin: All notification parameters have been included
    into email.
  * NTPd plugin: Don't treat normal peers as refclocks, skip "0.0.0.0"
    hosts in ntpd plugin.
  * OVS Stats plugin: A macro to populate counters list has been added,
    value of "OpenFlow" has been corrected.
  * OVS Stats, OVS Events plugins: utils_ovs: Avoid potential access of
    freed memory, fixes.
  * Processes plugin: Compilation has been fixed when ps_delay() is not
    used.
  * Python plugin: A compilation warning with Python 3.7 has been fixed.
  * Redis plugin: Bugfixes, extended error reporting, persistent
    connections and parallel polling, ability to select db for queries has
    been fixed.
  * RRDTool plugin: Error reporting has been extended.
  * Sensors plugin: Support for humidity sensors has been added.
  * Sensu, OVS Stat, Turbostat, virt, OAuth, Write Prometheus, Intel RDT
    plugins: Compiler warnings have been fixed.
  * virt plugin: Compiler warnings, a segfault in libvirt, typo in error
    messages have been fixed.
  * virt plugin: Optional "virDomainGetCPUStats()" has been removed from
    main flow, cleanup.
  * virt plugin: Tracking of VM state changes has been fixed.
  * Write MongoDB plugin: Plugin dependencies have been fixed.
  * Write Redis plugin: Bug ""max_set_duration" deletes unexpected data"
    has been fixed.
- Drop patches (fixed by upstream):
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch
  * Removed-checks-for-upper-limit-of-SENSORS_API_VERSION.patch
- Add new subpackages:
  * plugin-pcie
  * plugin-write_stackdriver
  * plugin-write_syslog</changelog>
  <changelog author="cvoegl@suse.de" date="1574683200">- Update to 5.10.0 (jsc#SLE-9892)
  * turbostat plugin: Power metrics update for recent server CPUs. Thanks
    to Chris MacNamara. #3276
  * turbostat plugin: Fix warnings generated by the turbostat plugin.
    Thanks to Ryan Mccabe. #3340
  * ZFS ARC plugin: New cache values are now read on Linux. Thanks to
    Jan-Philipp Litza. #3247, #2843
  * connectivity plugin: monitor the network interface up/down status via
    the netlink library. Thanks to Andrew Bays. #2622
  * sysevent plugin: A new plugin that monitors rsyslog for system events.
    Thanks to Andrew Bays. #2624
  * procevent plugin: A new plugin that monitors process starts/stops via
    netlink library. Thanks to Andrew Bays. #2623
  * daemon: Check if plugin actually loaded before reporting configuration
    issues. Thanks to Pavel Rochnyak. #3217
  * daemon: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3181, #3214
  * Build System: Only include &lt;sys/sysctl.h&gt; when needed. Thanks to Ruben
    Kerkhof. #3298
  * Build System: Link to libnsl.so if needed for inet_ntop(). Thanks to
    Dagobert Michelsen. #3291
  * Build System: Remove double "without" added by commit b781871. Thanks
    to Fabrice Fontaine. #3261
  * Build System: fix compile time issues. Thanks to Matthias Runge.
    [#3179], #3242, #3245
  * Build System: Fix activation of snmp_agent. Thanks to Fabrice
    Fontaine. #3241
  * Build System: Fix bug that leads to CPPFLAGS gets overridden with
    CFLAGS when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * perl module: Collectd::Plugins::Openvz: Fix indentation of some
    closing curlies. Thanks to Christian Bartolomäus. #3239
  * tree-wide: Fix a few issues found with LGTM. Thanks to Ruben Kerkhof.
    [#3252]
  * tree-wide: fix ssnprintf wrapper. Thanks to Fabien Wernli.
    [#3237], #3232, #3235, #3236
  * tree-wide: Fix make check. Thanks to Ruben Kerkhof. #3306
  * CI System: Travis: switch to Bionic. Thanks to Ruben Kerkhof. #3307
  * CI System: Travis improvements for MacOS. Thanks to Ruben Kerkhof.
    [#3308]
  * MySQL plugin: Minor documentation improvements. Thanks to Christian
    Bartolomäus. #3288
  * Java plugin: Fix typo in an error message. Thanks to Matthias Runge.
    [#3285], #3286
  * sysevent plugin: Add a few missing calloc result checks in the
    sysevent_init function. Thanks to Andrew Bays. #3282
  * ZFS ARC plugin: A bug that caused the first to values to be skipped
    was fixed. Thanks to Jan-Philipp Litza. #3246
  * SysLog plugin: restore previous behaviour: fallback to info for
    unsupported level. Thanks to Fabien Wernli. #3236, #3238
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3228
  * GPU NVidia plugin: Fix build of the plugin. Thanks to Ruben Kerkhof.
    [#3320]
- Changes from 5.9.2:
  * syslog plugin: Don't fail if syslog loglevel doesn't match. Thanks to
    Fabien Wernli. #3236 #3238
  * collectd: Fix ssnprintf wrapper. Thanks to Fabien Wernli. #3237
  * rdt plugin: Fix compile time issues. Thanks to Matthias Runge. #3245
- Changes from 5.9.1:
  * collectd: regex match: Fix unexpected match with empty meta data .
    Thanks to Takuro Ashie. #3178
  * collectd: Fix return value or loglevel for several plugins. Thanks to
    Fabien Wernli. #3182
  * collectd: Add standard include early or _FILE_OFFSET_BITS will have
    definition … . Thanks to Dagobert Michelsen. #3193
  * collectd: Use GCC-specific flags only when compiling with GCC. Thanks
    to Dagobert Michelsen. #3195
  * Use test_utils_proc_pids only when compiling the plugin that uses it.
    Thanks to Dagobert Michelsen. #3197
  * DNS plugin: Do not use headers from glibc. Thanks to Pavel Rochnyak.
    [#3156], #3145
  * collectd: Add missing definitions for libnetsnmpagent. Thanks to
    Dagobert Michelsen. #3203
  * collectd: Move Makefile rules for pid_test inside conditional for
    code. Thanks to Dagobert Michelsen. #3206
  * collectd: Recover setlocale() call in src/daemon/collectd.c do_init().
    Thanks to Pavel Rochnyak. #3214, #3181
  * collectd: Add snprintf wrapper for GCC 8.2/3. Thanks to zebity. #3153,
    [#2895], #3038
  * collectd: Fix bug that leads to CPPFLAGS gets overridden with CFLAGS
    when libxmms is enabled. Thanks to Dagobert Michelsen. #3207
  * Write_Riemann plugin: Copy MetaData to Riemann events in
    write_riemann. Thanks to Romain Tartière. #3158
  * virt plugin: Fix memory leak with libvirt MetadataXPath enabled.
    Thanks to Pavel Rochnyak. #3225, #3230
-Disabled Plugins due to missing dependencies:
  * lvm on Factory, Tumbleweed, Leap15.2 and SLES_15-SP2
  * gps and sigrok on SLES_15 and later
-Removed libstatgrab from buildrequires: only needed for non-Linux systems.
-Rebased patch 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
-Add new subpackages:
  * plugin-sysevent
  * plugin-procevent
  * plugin-uptime
  - ------------------------------------------------------------------</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Cleanup BuildRequires that are not actually in use:
  pkgconfig(devmapper),  pkgconfig(freetype2), pkgconfig(gail),
  pkgconfig(gdk-2.0),  pkgconfig(gtk+-2.0), pkgconfig(libart-2.0).</changelog>
  <changelog author="christian.voegl@suse.com" date="1593086400">- Update to 5.11
  * Adds buddyinfo, logparser, ubi, and write_influxdb_udp plugins
  * Remove lvm plugin
  * Multiple bugfixes/improvements
- update collectd-fix_collection_cgi.patch</changelog>
  <changelog author="dmueller@suse.com" date="1600862400">- update to 5.12.0:
  * varnish plugin: Added varnish 6 support.
  * amqp1 plugin: New options to limit send queue length has been added.
  * mdevents plugin: New plugin to generate notifications about events
  * amqp plugin: Updated option to allow multiple hosts to support
    failover.
  * mysql plugin: Reporting of the fields Slave_IO_Running and
    Slave_SQL_Running has been added.
  * write_http plugin: libcurl default HTTP response has been moved to a
    buffer instead of stdout.
  * disk plugin: Provided an udev rule with ID_SERIAL based attribute so
    disk and partition data don't get mixed incorrectly in udev-based disk
    naming.
  * swap plugin: Implementation for NetBSD has been added.
  * netstat_udp plugin: New plugin ((currently NetBSD-only) to report UDP
    summary statistics has been aded.
  * smart plugin: SMART plugin has been extended with NVMe device
    functionality.
  * infiniband plugin: New plugin to collect metrics about IB ports has
    been added.
  * snmp plugin: Count option was added allowing to gather the number of
    table entries (matching given criteria) rather than their values.
  * cpu plugin: Implementation for NetBSD has been added.
  * irq plugin: Implementation for NetBSD has been added.
  * processes plugin: Implementation for NetBSD has been added.
  * entropy plugin: Implementation for NetBSD has been added.
  * netlink plugin: VFs statistics and link info has been added.
  * memory plugin: Implementation for NetBSD has been added.
  * curl_jolokia plugin: New plugin has been added to integrate jolokia to
    fetch jmx counters via HTTP/json. Thanks to Wilfried Goesgens. #2470
  * write_sensu plugin: IncludeSource option has been added.
  * intel_pmu plugin: Check for libjevents version has been improved.
  * python plugin: Error-handling code of PyType_Ready has been added.
  * collectd: Updated specfile for EL8. Thanks to Fabien Wernli. #3346
  * openvpn plugin: Parsing of empty fields has been fixed.
  * dpdk_telemetry plugin: Build issues has been fixed.
  * mqtt plugin: A problem with stuck after 20 (qos=1) messages has been
    fixed.
  * varnish plugin: Target in category for varnish 6 has been added.
  * mqtt plugin: Resubscribe after a reconnect. Thanks to Maciej
  * zookeeper plugin: Missing 3.5 mntr fields has been added. Thanks to
  * sensors plugin: The documentation has been improved. Thanks to Florian
  * types.db(5): Documentation of metric definitions has been improved.
  * intel_pmu plugin: The possible crash on plugin init has been fixed.
  * processes plugin: Size of reading buffer for /proc/stat has been
  * ubi plugin: Data source type has been fixed from counter to gauge.
  * intelrdt plugin: NaN values in csv output has been fixed. Thanks to
  * capabilities plugin: Conditionalized return type for microhttpd</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1608465600">- add mqtt plugin</changelog>
  <changelog author="max@suse.com" date="1614081600">- The bind plugin does not need bind-devel.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1624881600">- add modbus plugin</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_collectd.service.patch</changelog>
  <changelog author="christian.voegl@suse.com" date="1630497600">- Disabled the mqtt plugin for SLES and the modbus plugin for
  everything except Tumpleweed as the dependencies are not met in
  those distributions
- Added the modbus plugin as dependency to plugins-all</changelog>
  <changelog author="cxiong@suse.com" date="1727352000">- build for bsc#1230895, fixing collectd-fix_collection_cgi.patch
  M collectd-fix-config.patch</changelog>
</package>
<package pkgid="4fedcb8b899e259a7e4284d502a5773e4dc2fc7c109b0663cc0c629e25580cc9" name="collectd-plugin-write_stackdriver" arch="aarch64">
  <version epoch="0" ver="5.12.0" rel="150400.3.5.2"/>
  <changelog author="jengelh@inai.de" date="1495713600">- Trim filler wording from descriptions, resolve orthographic
  errors, and shorten a find–delete call.</changelog>
  <changelog author="tchvatal@suse.com" date="1498132800">- Disable libdb collectd integration as we would like to reduce
  libdb exposure everywhere. There are other db backends in collectd
  anyway</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Remove all the always true conditionals for readability
- Convert to pkgconfig style dependencies
- Remove never applied patch collectd-pkgconfig_libnotify_add_gtk.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498564801">- Disable NUT plugin on older distros (broken NUT devel package)
- Make sure we build lvm plugin
- Disable turbostat plugin as it does not work with new kernels
  https://github.com/collectd/collectd/issues/2311
- Version update to 5.7.2:
  * Various small fixes around, notable fix for CVE-2017-7401
- Update buildrequires to include dependencies not detected by
  configure.ac (like python3)
- Disable Werror
- List all the modules in files and thus stick to --enable-all passed
  to configure to avoid having to name them all
- Switch to python3 from python2 as plugin can be built only once...
- Fix build on Factory
- Remove unused collectd-pthread.pc SOURCE file as it does not
  need to be done anymore</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1504872000">- Sort list of plugins bundled in main package, add line breaks
- Add BuildRequires for libsigrok and create a sigrok plugin
  subpackage
- Add 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
  Apply patch conditionally for libsigrok &gt;= 0.4.0, the API
  is different from the libsigrok 0.3.0 API.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1513166400">- Buildrequires for gpsd changed, upstream renamed the pkgconfig
  file in gpsd 3.17.</changelog>
  <changelog author="mardnh@gmx.de" date="1528372800">- Fix BuildRequires for collectd-web
- Make apache configuration files compatible with Apache v2.2 and v2.4</changelog>
  <changelog author="mardnh@gmx.de" date="1546084800">- Add patch:
  * 0001-gps-plugin-fix-build-with-newer-gpsd.patch</changelog>
  <changelog author="christophe@krop.fr" date="1555243200">- Update to 5.8.1:
  * collectd: Fix "BaseDir" option.
  * collectd: improve error handling, check return values.
  * Build System: use "kstat.h", when available.
  * Build System: Out-of-tree builds have been fixed.
  * Configuration: Error handling in the config parsing code has been
    improved.
  * collectd: The core daemon is now completely licensed under the
    MIT license.
  * Build system: Dependency on libltdl has been removed, support for
